ClaudeLoops/
SOC2 evidence collector swarm
All loops
SecurityHard 30 min· claude-opus-4

SOC2 evidence collector swarm

Pulls audit evidence from AWS, GitHub, Okta — assembles a quarterly pack.

Read the full Security build guide →
NOT DEPLOYEDNOT DEPLOYED
0145ms
Trigger
cron(0 7 * * *) fired · every day · 07:00
02805ms
Agent
claude-opus-4 · in 905 tok · out 230 tok
03195ms
Tools
aws-mcp/aws:invoke → 200 OK · 225ms
0435ms
Verify
schema check · zod v3 passed
0565ms
Output
github issue opened · SEC-142
0625ms
Notify
audit log written · runbook link attached
SUCCESS
0%
0 runs
P50
0ms
median
P95
0ms
tail
AVG COST
—
per run
LAST OK
never
—
LAST FAIL
never
none
Latency · last 30 runs0 samples
no runs yet
Latest output · what your users see
SEC-1225CWE-798
Public S3 bucket `acme-logs-prod` — no encryption at rest
// press Test to run once · Watch live to keep streaming · Deploy to make it real
The problem

Evidence collection takes a senior engineer a full week every quarter. Most of it is the same screenshots.

The outcome

An `evidence-Q3-2026.zip` lands in the audit bucket on schedule. PDFs, CSVs, and a summary `INDEX.md` that maps controls → files.

Ingredients & skills

Secrets
  • ANTHROPIC_API_KEY
  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • OKTA_API_TOKEN
  • GITHUB_TOKEN
  • S3_AUDIT_BUCKET
Providers
  • Anthropic
  • AWS
  • Okta
  • GitHub
  • S3
MCP servers
  • aws-mcp
  • github-mcp
#security#compliance#soc2

How it works

On the 1st of each quarter, agents pull access reviews from Okta, IAM diffs from AWS, branch-protection state from GitHub, and produce a zip your auditor can read.

Step 1

1 — Per-source collectors

One file per source. They emit a typed `EvidenceItem[]` so the assembler is generic.

typescript
export type EvidenceItem = { control: "CC6.1" | "CC6.3" | "CC7.1" | string; source: string; filename: string; content: Buffer | string };
Step 2

2 — Assembler

Claude generates `INDEX.md` that explains each artifact to the auditor in plain English.

Step 3

3 — Sign and ship

Detached signature next to the zip. Auditor verifies provenance.

bash
openssl dgst -sha256 -sign audit.key -out evidence-Q3-2026.zip.sig evidence-Q3-2026.zip
aws s3 cp evidence-Q3-2026.zip s3://$S3_AUDIT_BUCKET/
One-line deploy

The button above runs the same command with your saved config. This is the raw CLI form.

bash
locker schedule soc2-collector agent.ts --cron '0 0 1 */3 *'

Related loops

RAG
Compliance RAG
Indexes SOC2 / ISO controls and answers auditor questions.
Ops
Secret rotation reminder
Tracks secret age and reminds owners to rotate.
Security
Phish triage
Phish triage with audit-grade logs.