awesome-federal-tech

Curated code repositories for people who deliver federal technology.

Not policy portals. Not marketplaces. Not slideware. Repos you can clone, inspect, and run through your own security process.

Focus areas: RMF / FedRAMP / ATO automation, DevSecOps, supply chain, containers, accessibility, telecommunications and real-time communications, continuous monitoring, and experimental cyber infrastructure.

Inclusion is not endorsement. Evaluate license, supply chain, and fitness for your environment yourself.

• RMF, OSCAL & ATO automation
• Continuous monitoring & assessment
• Supply chain & SBOM
• DevSecOps, policy-as-code & IaC
• Containers & platforms
• Observability
• Accessibility
• Telecommunications & real-time communications
• AI tooling
• Experimental Infrastructure and Scientific Assurance
• Federal digital service code
• Contributing
• Security & disclaimer
• License

• OSCAL – Machine-readable controls, SSPs, assessment plans/results. The path off Word/Excel packages.
• OSCAL Content – NIST catalogs and profiles in OSCAL.
• Heimdall2 – Store and visualize assessment results (HDF).
• SAF CLI – Convert/filter/report assessment data in pipelines.
• Lula – OSCAL validation aimed at cloud-native systems.
• GovReady-Q – Open GRC for security documentation workflows.
• ComplianceAsCode Content – SCAP/Ansible/Bash content mapped to baselines.
• OpenSCAP – SCAP evaluation engine.
• CSET – Structured assessments against multiple frameworks.

• InSpec ecosystem via SAF/Heimdall – Infrastructure testing results into a federal-friendly reporting path.
• OpenSCAP / ComplianceAsCode – Configuration and baseline scanning.
• CSET – Facilitated/self assessment tooling from CISA.

• Trivy – Vulns, misconfigs, secrets, IaC, images.
• Syft – SBOM generation.
• Grype – Scan images and SBOMs.
• Cosign – Sign and verify artifacts.
• OpenSSF Scorecard – Upstream project hygiene signals.
• Semgrep – Fast SAST / custom rules.
• OWASP Dependency-Check – SCA for known vulnerable dependencies.
• Gitleaks – Secrets in git history and pipelines.

• OPA – Portable policy engine.
• Kyverno – Kubernetes-native policy.
• Checkov – IaC and pipeline static analysis.
• Cloud Custodian – Cloud policy-as-code and remediation.
• Terraform – Still the default IaC in many agencies. Confirm current license terms for your org.
• OWASP ZAP – DAST for web apps.

• Kubernetes – Default orchestration target. Hardening and admission control are not optional.
• Platform One Big Bang – DoD reference packaging/GitOps for hardened stacks. Reference architecture, not a free ATO.
• Falco – Runtime detection for containers and hosts.

• OpenTelemetry – Vendor-neutral telemetry specs.
• Prometheus – Metrics and alerting.
• Grafana – Dashboards. Confirm edition/license fit.
• Wazuh – Open monitoring/XDR-style stack. Evaluate agent privilege and rules before wide deploy.

• USWDS – Federal design system and accessible components.
• axe-core – Automated accessibility testing. Necessary; not sufficient.

• NIST JAIN-SIP (JSIP) – Official JAIN-SIP 1.2 Java reference implementation from NIST. Useful for SIP protocol interoperability, controlled telecom integration, and reference work around accessible real-time calling systems. Treat it as a mature maintenance/reference codebase: assess current Java dependencies, TLS/cipher support, parser hardening, and production fit before deployment.

• Atlas UI 3 – Governed AI agents (MCP, access control, audit) for high-trust environments.
• TalkPipe – Streaming AI pipelines and composable RAG.
• TalkPipe Vault – Local-first document search and grounded Q&A built on TalkPipe, with local embeddings and selectable local/cloud chat providers.
• AI Verify – Testing toolkit for AI governance and model behavior.

High-fidelity cyber experimentation, cyber ranges, synthetic users, cyber-physical systems, scientific workflow provenance, uncertainty quantification, and authorization evidence pipelines. These tools form capability stacks, not isolated links.

See also:

• Reference architectures
• Accessible Information Emulytics
• Sandia Emulytics ecosystem
• CMU SEI Crucible ecosystem
• MITRE SAF ecosystem

• minimega – Lightweight VMs, containers, SDN; scales from laptop to large clusters.
• FIREWHEEL – Modular experiment orchestration and model-component framework (Emulytics).
• phenix – Topology and orchestration UI/workflow engine for minimega, including SCEPTRE ICS workflows.
• TopoMojo – Virtual lab builder/player for training topologies (Crucible).
• wiretap – Privilege-light WireGuard tunneling for segmented experiment networks.

• GHOSTS – Realistic NPC / synthetic-user framework spanning cyber, social, and cognitive domains.
• Apache CALDERA – ATT&CK-based adversary emulation, now incubating at Apache after originating at MITRE.
• CALDERA for OT – OT/ICS protocol plugins for CALDERA.

• SCEPTRE documentation + phenix apps – High-fidelity ICS and critical-infrastructure Emulytics.
• ExaGO – Exascale power-grid optimization (consequence modeling).
• Conduit – Hierarchical scientific data exchange for multi-physics coupling.

• Flowcept – Runtime provenance for scientific and AI workflows.
• Dakota – Optimization, uncertainty quantification, sensitivity analysis.
• Pyomo – Python optimization modeling language (Sandia roots).

• Atlas UI 3 – Governed multi-LLM agents with MCP, access control, and audit.
• TalkPipe – Streaming AI / RAG pipeline composition.
• TalkPipe Vault – Local-first retrieval and grounded document Q&A; useful as an inspectable reference for provider choice, local embeddings, and controlled knowledge access.
• Heimdall2 / SAF CLI – Assessment result storage, visualization, and pipeline tooling.
• eMASSer – CLI automation against the eMASS RMF API.
• Vulcan – STIG authoring and InSpec profile development.

1. Cyber Experimentation – A proposed stack combining CALDERA, GHOSTS, minimega/TopoMojo, FIREWHEEL/phenix, Flowcept, Dakota, and SAF/Heimdall through project-specific adapters.
2. Cyber-Physical Resilience – A proposed composition of SCEPTRE/phenix, ExaGO, Conduit, Dakota/Pyomo, and Flowcept.
3. High-Assurance AI Operations – A proposed composition of Atlas UI 3, TalkPipe/TalkPipe Vault, Flowcept, and SAF/Heimdall/eMASSer/OSCAL.

Expect operational overhead, privileged components, and isolation requirements. Read licenses, security notes, and deployment assumptions before committing a range or analysis design to any of these platforms.

• 18F GitHub – Public digital service patterns and historical implementations. Check activity; some repos are archival.

See CONTRIBUTING.md and inclusion criteria.

Scope rule: public code and official technical repositories containing deployable software, schemas, models, reference implementations, or essential project documentation. Policy portals, marketplaces, and standalone guidance are out of scope.

Submit via the Resource Submission issue template. Canonical data: data/resources.yml (validated in CI).

Inclusion is not endorsement by the U.S. Government or any agency.

You must evaluate third-party code for security, supply chain, license, and fitness; follow your agency authorization process; prefer SBOMs, signed releases, and clear security contacts; track NVD, CISA KEV, and project advisories.

See SECURITY.md.

Repository content: CC BY 4.0. Listed projects keep their own licenses.