OCI CIS AI Agent

Oracle Cloud Infrastructure — CIS Foundations Benchmark 3.0 — AI-Powered Compliance Platform

---

Overview

OCI CIS AI Agent is a self-hosted web application that automates CIS Oracle Cloud Infrastructure Foundations Benchmark 3.0 compliance checks, powered by OCI Generative AI for intelligent analysis and an MCP (Model Context Protocol) server architecture for extensible task execution.

The platform combines security compliance scanning, AI-powered chat with RAG (Retrieval-Augmented Generation), infrastructure exploration, and vector-based knowledge storage into a single, containerized solution with Oracle Cloud's official light theme.

---

Features

🤖 AI Chat Agent with RAG + MCP Tool Use

• OCI Generative AI integration via official SDK (oci.generative_ai_inference)
• RAG (Retrieval-Augmented Generation): automatically queries ADB vector store for relevant context before generating responses
• MCP Tool Use (Function Calling): GenAI models can call tools from registered MCP servers during chat — supports both Cohere and Generic (OpenAI-style) function calling formats with automatic tool execution loop (max 5 iterations)
• Chat Memory Compaction: automatic summarization of older messages when conversation exceeds ~8000 tokens — keeps 6 recent messages intact and generates an LLM-based summary of older context, similar to Claude Code's context compression
• Thinking Indicator: button disables and shows spinner + "Pensando..." while waiting for GenAI response
• 69 chat models + 11 embedding models across 6 providers: Cohere, Meta, Google, OpenAI (GPT-5.3/5.2/5.1/5/4.1/4o, Codex, Image, Audio, o1/o3/o4-mini, GPT-oss), xAI (Grok 4.1/4/3), ProtectAI
• OCID-based model resolution: catalog maps model IDs to OCI resource IDs per region for reliable API calls
• 16 OCI regions supported with auto-generated endpoints
• Full parameter control: temperature, max_tokens, top_p, top_k, frequency/presence penalty
• Toggle MCP tools on/off per chat session
• Conversation history with session management
• On-Demand and Dedicated serving modes

🔍 OCI Account Explorer

• Browse tenancy resources directly from the UI
• Explore: Compartments, Regions, VCNs, Compute Instances, Autonomous Databases, Object Storage Buckets
• Select which OCI connection to explore
• Real-time API calls via OCI Python SDK

📊 CIS Compliance Reports (Oracle Official Engine)

• Powered by Oracle's official cis_reports.py (6660 lines, 48 CIS + 11 OBP checks)
• Granular execution parameters: CIS Level (1/2), OCI Best Practices, Raw Data, OCID Redaction
  • Level 1: Essential security controls that can be implemented with minimal impact on operations. Recommended as baseline for all organizations.
  • Level 2: Advanced security controls that may restrict functionality or require more effort to implement. Recommended for high-security environments.
• Multiple output formats: HTML summary, CSV per section/finding, JSON summary, optional XLSX
• File browser: all generated files stored per report, browsable and downloadable individually
• Tenancy filter: filter reports by tenancy in the Downloads tab
• Region filtering with multi-select
• Real-time progress tracking with phase-based progress bar
• CIS Engine auto-update: check for new versions of cis_reports.py from Oracle's GitHub repository and update with one click (admin only). Custom patches are automatically reapplied after update

🛡️ Built-in CIS MCP Server (Granular Per-Section)

• Auto-registered CIS Compliance Scanner MCP server — available out of the box
• 12 granular tools instead of monolithic full-tenancy scan:
  • cis_scan_iam — IAM checks (CIS 1.1–1.17): users, policies, groups, MFA, API keys
  • cis_scan_networking — Network checks (CIS 2.1–2.8): security lists, NSGs, VCNs
  • cis_scan_compute — Compute checks (CIS 3.1–3.3): instance metadata, monitoring
  • cis_scan_logging_monitoring — Logging/Monitoring checks (CIS 4.1–4.17): audit, alarms, events
  • cis_scan_storage — Storage checks (CIS 5.1–5.3): buckets, block volumes, file systems
  • cis_scan_asset_management — Asset checks (CIS 6.1–6.2): compartments, tagging
  • cis_list_configs / cis_list_checks — list available OCI configs and CIS checks
  • cis_get_check / cis_get_remediation — detailed findings and remediation guidance
  • cis_get_scan_status / cis_invalidate_cache — session status and cache management
• Per-section data collection: each scan tool collects only the OCI data needed for that section, avoiding unnecessary API calls
• Session caching: collected data is cached per config, so subsequent scans on different sections reuse shared prerequisites (compartments, identity domains)
• Based on Oracle's official cis_reports.py (6660 lines, 48 CIS + 11 OBP checks)

🔌 MCP Server Registry + Tool Discovery

• Register multiple MCP servers (stdio, SSE, Python module)
• Automatic tool discovery: connect to MCP servers and discover available tools with names, descriptions, and input schemas
• Manual tool definition: add/edit tools with JSON Schema parameter definitions
• Chat Agent integration: discovered tools are automatically available as GenAI function calls during chat
• Upload .py scripts directly to servers
• Link MCP servers to ADB Vector databases as tools
• Activate/deactivate servers
• Select which MCP server to use per report execution

🗄️ Autonomous Database Vector Storage

• Oracle Autonomous Database connection with mTLS Wallet authentication
• python-oracledb Thin mode (no Oracle Client needed)
• Wallet ZIP upload and automatic extraction
• Connection testing
• Multiple vector tables per ADB: register, edit, toggle active/inactive for each table
• Multi-table RAG search: queries all active tables across all ADB configs, merges results by cosine distance
• Link to GenAI config for embedding generation via OCI GenAI

🧬 Embeddings Management

• Dedicated tab for managing vector embeddings
• Preview chunks before embedding: review generated sections before creating embeddings
• Embed CIS Reports: automatically chunk reports by section with tenancy name, regions, and compartments enrichment
• Upload text files: upload .txt files, automatically chunked by paragraphs
• Table selector: choose which ADB vector table to store embeddings in
• OCI GenAI Embeddings: uses Cohere Embed models (v3.0/v4.0, multilingual, light) via OCI GenAI embed_text API
• Browse, inspect and delete individual embeddings from the ADB vector store
• 11 embedding models supported including Cohere Embed v4.0 and OpenAI Text Embedding 3

📜 Configuration Logs

• Persistent activity log per configuration tab (OCI, GenAI, ADB, MCP)
• Logs all test, save, upload, report, and ingest operations with severity (success/error/info)
• Inline log panel at the bottom of each config tab with severity filter
• Auto-cleanup of logs older than 30 days
• Admin can view all logs; users see only their own
• API endpoints for listing and clearing logs

🔐 Security

• JWT authentication with configurable expiry
• TOTP MFA (Google Authenticator / Authy compatible)
• RBAC with 3 roles: Admin, User, Viewer
• Audit logging for all operations
• Encrypted credential storage

---

Architecture

┌─────────────────────────────────────────────────────────────┐
│                    Docker Compose                            │
│                                                              │
│  ┌──────────────┐       ┌──────────────────────────────┐    │
│  │  Nginx        │       │  FastAPI Backend              │    │
│  │  (Frontend)   │──────▶│  (Python 3.12)               │    │
│  │  :8080        │       │  :8000                        │    │
│  └──────────────┘       │                                │    │
│                          │  ┌─────────────┐              │    │
│                          │  │ OCI SDK      │──▶ OCI APIs │    │
│                          │  ├─────────────┤              │    │
│                          │  │ GenAI Client │──▶ LLM      │    │
│                          │  ├─────────────┤   (tools)   │    │
│                          │  │ MCP Client   │──▶ MCP Svrs │    │
│                          │  ├─────────────┤   (discover │    │
│                          │  │              │   +execute) │    │
│                          │  ├─────────────┤              │    │
│                          │  │ oracledb     │──▶ ADB      │    │
│                          │  ├─────────────┤              │    │
│                          │  │ RAG Pipeline │──▶ Embed +  │    │
│                          │  │              │   Search    │    │
│                          │  └─────────────┘              │    │
│                          │                                │    │
│                          │  SQLite (agent.db)             │    │
│                          └──────────────────────────────┘    │
│                                     │                        │
│                              agent-data volume               │
└─────────────────────────────────────────────────────────────┘

---

Quick Start

Prerequisites

• Docker and Docker Compose
• OCI API Key pair (private .pem key + fingerprint)
• OCI Tenancy OCID, User OCID, Compartment OCID

1. Clone & Configure

git clone https://github.com/nogueiragustavo/oci-cis-agent.git
cd oci-cis-agent
cp .env.example .env

Edit .env:

APP_SECRET=your-very-long-random-secret-string-here-at-least-64-chars
JWT_EXPIRY_HOURS=12
PORT=8080

2. Build & Run

docker compose up -d --build

3. Access

Open http://localhost:8080

Default credentials:

• Username: admin
• Password: admin123

⚠️ Change the default password immediately after first login.

---

Configuration Guide

Step 1 — OCI Credentials

Navigate to OCI Credentials tab and add:

Field	Description
Tenancy Name	Friendly name (e.g., my-company)
OCID Tenancy	ocid1.tenancy.oc1..xxxxx
OCID User	ocid1.user.oc1..xxxxx
Fingerprint	aa:bb:cc:dd:ee:ff:...
Region	sa-saopaulo-1, us-ashburn-1, etc.
Compartment OCID	ocid1.compartment.oc1..xxxxx
Private Key	.pem file
Key Passphrase	(optional) Only required if the private key is encrypted

Click Testar to validate the connection.

Step 2 — GenAI Model

Navigate to GenAI Config tab:

1. Select the OCI Credential created in Step 1 — Region and Compartment OCID are auto-filled from the selected credential
2. Choose a model from the catalog
3. Adjust the GenAI region if needed (auto-populated, must have Generative AI service available)
4. Adjust parameters (temperature, max_tokens, etc.)
5. The endpoint is auto-generated: https://inference.generativeai.{region}.oci.oraclecloud.com

For dedicated endpoints, switch Serving Type to DEDICATED and provide the endpoint ID.

The GenAI connection follows Oracle's official SDK pattern:

# Auth via stored OCI config
config = oci.config.from_file(config_path, "DEFAULT")

# Client with endpoint, retry, and timeout
client = oci.generative_ai_inference.GenerativeAiInferenceClient(
    config=config,
    service_endpoint=endpoint,
    retry_strategy=oci.retry.NoneRetryStrategy(),
    timeout=(10, 240)
)

# Chat with TextContent + Message objects
chat_detail = oci.generative_ai_inference.models.ChatDetails()
chat_detail.serving_mode = OnDemandServingMode(model_id="...")
chat_detail.chat_request = GenericChatRequest(messages=[...])
chat_detail.compartment_id = compartment_id

Step 3 — MCP Servers (Optional)

Register MCP servers for extended task execution and Chat Agent tool use:

Type	Use Case
stdio	Local Python scripts (e.g., CIS check runner)
SSE	Remote HTTP servers
module	Upload .py files directly

MCP servers can be linked to ADB Vector databases, enabling them to use the vector store as a tool during report execution.

Tool Discovery: After registering a server, click "Descobrir Tools" to automatically discover available tools via MCP protocol. You can also add tools manually with name, description, and JSON Schema parameters. Discovered tools are automatically available as function calls in the Chat Agent.

Step 4 — ADB Vector + RAG (Optional)

For persistent vector storage and RAG-powered chat:

1. Add DSN (TNS name from tnsnames.ora, e.g., myatp_high)
2. Set credentials (username/password)
3. Select a GenAI Config (for embedding generation via OCI GenAI)
4. Select an Embedding Model (Cohere Embed v4.0 recommended)
5. Upload Wallet ZIP (for mTLS)
6. Test the connection
7. Register vector tables: add the names of existing tables in your ADB that contain vectorized data (e.g., CIS_REPORT, CIS_RECOMMENDATIONS). Toggle tables active/inactive to control which are queried during RAG.

Step 5 — Embeddings (Optional)

Navigate to the Embeddings tab to populate the vector store:

1. From CIS Reports: Select a completed report, preview chunks (with tenancy/regions/compartments context), then generate embeddings
2. From text files: Upload .txt files for automatic chunking and embedding
3. Select target table: choose which ADB vector table to store embeddings in
4. Browse and manage existing embeddings per table

Once embeddings exist, the chat automatically uses RAG — it queries all active vector tables across all ADB configs for relevant context before generating responses with the selected GenAI model.

---

OCI IAM Policies

The following policies are required in your tenancy:

Allow group <group-name> to use generative-ai-family in compartment <compartment-name>
Allow group <group-name> to read all-resources in tenancy
Allow group <group-name> to inspect compartments in tenancy
Allow group <group-name> to inspect autonomous-databases in compartment <compartment-name>
Allow group <group-name> to read virtual-network-family in compartment <compartment-name>
Allow group <group-name> to read instance-family in compartment <compartment-name>
Allow group <group-name> to read objectstorage-namespaces in tenancy
Allow group <group-name> to read buckets in compartment <compartment-name>

---

Project Structure

oci-cis-agent/
├── backend/
│   ├── app.py              # FastAPI application (~2600 lines)
│   ├── cis_reports.py       # Oracle CIS Benchmark checker (6660 lines, report engine)
│   ├── mcp_cis_server.py    # MCP server with 12 granular CIS tools
│   ├── Dockerfile           # Python 3.12 + OCI CLI
│   └── requirements.txt     # Dependencies
├── frontend/
│   └── index.html           # SPA with Oracle Cloud theme (~900 lines)
├── nginx/
│   └── default.conf         # Reverse proxy config
├── docker-compose.yml       # Orchestration
├── logo.svg                 # Project logo (Oracle AI Robot)
├── .env.example             # Environment template
├── .gitignore
└── README.md

---

API Reference

Authentication

Method	Endpoint	Description
POST	/api/auth/login	Login (username + password + optional TOTP)
POST	/api/auth/logout	Logout and invalidate session
POST	/api/auth/register	Create user (admin only)
POST	/api/auth/change-password	Change password

OCI Management

Method	Endpoint	Description
POST	/api/oci/config	Save OCI credentials (multipart)
GET	/api/oci/configs	List OCI credentials
PUT	/api/oci/configs/{id}	Update OCI credential (multipart)
POST	/api/oci/test/{id}	Test OCI connection
DELETE	/api/oci/configs/{id}	Delete OCI credential

OCI Account Explorer

Method	Endpoint	Description
GET	/api/oci/explore/{id}/compartments	List compartments
GET	/api/oci/explore/{id}/regions	List subscribed regions
GET	/api/oci/explore/{id}/vcns	List VCNs
GET	/api/oci/explore/{id}/instances	List compute instances
GET	/api/oci/explore/{id}/databases	List Autonomous Databases
GET	/api/oci/explore/{id}/buckets	List Object Storage buckets

Generative AI

Method	Endpoint	Description
GET	/api/genai/models	List available models and regions
POST	/api/genai/config	Save GenAI configuration
GET	/api/genai/configs	List GenAI configurations
PUT	/api/genai/configs/{id}	Update GenAI configuration
POST	/api/genai/test/{id}	Test GenAI connection
DELETE	/api/genai/configs/{id}	Delete GenAI config

MCP Servers

Method	Endpoint	Description
POST	/api/mcp/servers	Register MCP server
GET	/api/mcp/servers	List MCP servers
PUT	/api/mcp/servers/{id}	Update MCP server
PUT	/api/mcp/servers/{id}/toggle	Activate/deactivate
POST	/api/mcp/servers/{id}/upload	Upload script file
PUT	/api/mcp/servers/{id}/link-adb	Link to ADB Vector
POST	/api/mcp/servers/{id}/discover-tools	Auto-discover tools from MCP server
PUT	/api/mcp/servers/{id}/tools	Manually update tool definitions
DELETE	/api/mcp/servers/{id}	Delete MCP server

ADB Vector

Method	Endpoint	Description
POST	/api/adb/config	Save ADB connection (with GenAI config + embedding model)
GET	/api/adb/configs	List ADB connections (includes vector tables)
PUT	/api/adb/configs/{id}	Update ADB connection (multipart)
POST	/api/adb/parse-wallet	Parse wallet ZIP and extract DSN names
POST	/api/adb/{id}/upload-wallet	Upload wallet ZIP
POST	/api/adb/test/{id}	Test ADB connection
GET	/api/adb/{id}/tables	List vector tables for ADB config
POST	/api/adb/{id}/tables	Add vector table
PUT	/api/adb/{id}/tables/{tid}	Update vector table (name, description, active)
DELETE	/api/adb/{id}/tables/{tid}	Remove vector table
DELETE	/api/adb/configs/{id}	Delete ADB config

Embeddings

Method	Endpoint	Description
GET	/api/embeddings/preview/{rid}	Preview report chunks before embedding (with tenancy/regions/compartments)
POST	/api/embeddings/report/{rid}	Generate embeddings from CIS report (chunked by section, accepts table_name)
POST	/api/embeddings/upload	Upload .txt file and generate embeddings (accepts table_name)
GET	/api/embeddings/{vid}/list	List embeddings in ADB (paginated, accepts table_name query param)
DELETE	/api/embeddings/{vid}/{doc_id}	Delete individual embedding (accepts table_name query param)

Chat & Reports

Method	Endpoint	Description
POST	/api/chat	Send message (with RAG + MCP tool use, accepts use_tools flag)
POST	/api/reports/run	Execute CIS report
GET	/api/reports	List reports
GET	/api/reports/{id}/html	View HTML report
GET	/api/reports/{id}/download	Download report
GET	/api/reports/{rid}/files	List report files by category
GET	/api/reports/{rid}/files/{fid}/download	Download individual report file

CIS Engine

Method	Endpoint	Description
GET	/api/cis-engine/version	Current CIS engine version
GET	/api/cis-engine/check-update	Check GitHub for newer version (admin)
POST	/api/cis-engine/update	Download + apply update with patches (admin)

Config Logs

Method	Endpoint	Description
GET	/api/config-logs	List config logs (filterable by config_type, severity, config_id)
DELETE	/api/config-logs	Clear config logs (admin, filterable by config_type, config_id)

Admin

Method	Endpoint	Description
GET	/api/users	List users (admin)
PUT	/api/users/{id}	Update user role/status
POST	/api/mfa/setup	Generate MFA secret
POST	/api/mfa/verify	Activate MFA
GET	/api/audit-log	View audit log (admin)
GET	/api/health	Health check

---

Supported GenAI Models (69 Chat + 11 Embedding)

All models include OCID mapping for us-ashburn-1. For other regions, use the "Personalizado (usar OCID)" option.

Chat Models

Provider	Model	Model ID	API Format
Cohere	Command A Reasoning	cohere.command-a-reasoning	COHERE
Cohere	Command A Vision	cohere.command-a-vision	COHERE
Cohere	Command A	cohere.command-a-03-2025	COHERE
Cohere	Command R+ (08-2024)	cohere.command-r-plus-08-2024	COHERE
Cohere	Command R (08-2024)	cohere.command-r-08-2024	COHERE
Meta	Llama 4 Maverick	meta.llama-4-maverick-17b-128e-instruct-fp8	GENERIC
Meta	Llama 4 Scout	meta.llama-4-scout-17b-16e-instruct	GENERIC
Meta	Llama Guard 4 (12B)	meta.llama-guard-4-12b	GENERIC
Google	Gemini 2.5 Pro	google.gemini-2.5-pro	GENERIC
Google	Gemini 2.5 Flash	google.gemini-2.5-flash	GENERIC
Google	Gemini 2.5 Flash-Lite	google.gemini-2.5-flash-lite	GENERIC
OpenAI	GPT-5.3 Codex	openai.gpt-5.3-codex	GENERIC
OpenAI	GPT-5.2 Codex	openai.gpt-5.2-codex	GENERIC
OpenAI	GPT-5.2 Pro	openai.gpt-5.2-pro	GENERIC
OpenAI	GPT-5.2 Pro (2025-12-11)	openai.gpt-5.2-pro-2025-12-11	GENERIC
OpenAI	GPT-5.2	openai.gpt-5.2	GENERIC
OpenAI	GPT-5.2 (2025-12-11)	openai.gpt-5.2-2025-12-11	GENERIC
OpenAI	GPT-5.2 Chat Latest	openai.gpt-5.2-chat-latest	GENERIC
OpenAI	GPT-5.1 Codex Max	openai.gpt-5.1-codex-max	GENERIC
OpenAI	GPT-5.1 Codex	openai.gpt-5.1-codex	GENERIC
OpenAI	GPT-5.1 Codex Mini	openai.gpt-5.1-codex-mini	GENERIC
OpenAI	GPT-5.1	openai.gpt-5.1	GENERIC
OpenAI	GPT-5.1 (2025-11-13)	openai.gpt-5.1-2025-11-13	GENERIC
OpenAI	GPT-5.1 Chat Latest	openai.gpt-5.1-chat-latest	GENERIC
OpenAI	GPT-5 Codex	openai.gpt-5-codex	GENERIC
OpenAI	GPT-5	openai.gpt-5	GENERIC
OpenAI	GPT-5 (2025-08-07)	openai.gpt-5-2025-08-07	GENERIC
OpenAI	GPT-5 Mini	openai.gpt-5-mini	GENERIC
OpenAI	GPT-5 Mini (2025-08-07)	openai.gpt-5-mini-2025-08-07	GENERIC
OpenAI	GPT-5 Nano	openai.gpt-5-nano	GENERIC
OpenAI	GPT-5 Nano (2025-08-07)	openai.gpt-5-nano-2025-08-07	GENERIC
OpenAI	GPT-4.1	openai.gpt-4.1	GENERIC
OpenAI	GPT-4.1 (2025-04-14)	openai.gpt-4.1-2025-04-14	GENERIC
OpenAI	GPT-4.1 Mini	openai.gpt-4.1-mini	GENERIC
OpenAI	GPT-4.1 Mini (2025-04-14)	openai.gpt-4.1-mini-2025-04-14	GENERIC
OpenAI	GPT-4.1 Nano	openai.gpt-4.1-nano	GENERIC
OpenAI	GPT-4.1 Nano (2025-04-14)	openai.gpt-4.1-nano-2025-04-14	GENERIC
OpenAI	GPT-4o	openai.gpt-4o	GENERIC
OpenAI	GPT-4o (2024-08-06)	openai.gpt-4o-2024-08-06	GENERIC
OpenAI	GPT-4o (2024-11-20)	openai.gpt-4o-2024-11-20	GENERIC
OpenAI	GPT-4o Mini	openai.gpt-4o-mini	GENERIC
OpenAI	GPT-4o Mini Search Preview	openai.gpt-4o-mini-search-preview	GENERIC
OpenAI	GPT-4o Mini Search (2025-03-11)	openai.gpt-4o-mini-search-preview-2025-03-11	GENERIC
OpenAI	GPT-4o Search Preview	openai.gpt-4o-search-preview	GENERIC
OpenAI	GPT-4o Search (2025-03-11)	openai.gpt-4o-search-preview-2025-03-11	GENERIC
OpenAI	GPT Image 1.5	openai.gpt-image-1.5	GENERIC
OpenAI	GPT Image 1	openai.gpt-image-1	GENERIC
OpenAI	GPT Audio	openai.gpt-audio	GENERIC
OpenAI	o4-mini	openai.o4-mini	GENERIC
OpenAI	o4-mini (2025-04-16)	openai.o4-mini-2025-04-16	GENERIC
OpenAI	o3	openai.o3	GENERIC
OpenAI	o3 (2025-04-16)	openai.o3-2025-04-16	GENERIC
OpenAI	o3-mini	openai.o3-mini	GENERIC
OpenAI	o3-mini (2025-01-31)	openai.o3-mini-2025-01-31	GENERIC
OpenAI	o1	openai.o1	GENERIC
OpenAI	o1 (2024-12-17)	openai.o1-2024-12-17	GENERIC
OpenAI	GPT-oss (120B)	openai.gpt-oss-120b	GENERIC
OpenAI	GPT-oss (20B)	openai.gpt-oss-20b	GENERIC
xAI	Grok 4	xai.grok-4	GENERIC
xAI	Grok 4.1 Fast Reasoning	xai.grok-4-1-fast-reasoning	GENERIC
xAI	Grok 4.1 Fast Non-Reasoning	xai.grok-4-1-fast-non-reasoning	GENERIC
xAI	Grok 4 Fast Reasoning	xai.grok-4-fast-reasoning	GENERIC
xAI	Grok 4 Fast Non-Reasoning	xai.grok-4-fast-non-reasoning	GENERIC
xAI	Grok 3	xai.grok-3	GENERIC
xAI	Grok 3 Mini	xai.grok-3-mini	GENERIC
xAI	Grok 3 Fast	xai.grok-3-fast	GENERIC
xAI	Grok 3 Mini Fast	xai.grok-3-mini-fast	GENERIC
xAI	Grok Code Fast 1	xai.grok-code-fast-1	GENERIC
ProtectAI	DeBERTa Prompt Injection v2	protectai.deberta-v3-base-prompt-injection-v2	GENERIC

Custom OCID: You can also use any model available in your region by selecting "Personalizado (usar OCID)" and providing the full model OCID.

Embedding Models

Provider	Model	Model ID	Dimensions
Cohere	Embed v4.0 (Multimodal)	cohere.embed-v4.0	1536
OpenAI	Text Embedding 3 Large	openai.text-embedding-3-large	3072
OpenAI	Text Embedding 3 Small	openai.text-embedding-3-small	1536
Cohere	Embed English v3.0	cohere.embed-english-v3.0	1024
Cohere	Embed Multilingual v3.0	cohere.embed-multilingual-v3.0	1024
Cohere	Embed English Light v3.0	cohere.embed-english-light-v3.0	384
Cohere	Embed Multilingual Light v3.0	cohere.embed-multilingual-light-v3.0	384
Cohere	Embed English Image v3.0	cohere.embed-english-image-v3.0	1024
Cohere	Embed Multilingual Image v3.0	cohere.embed-multilingual-image-v3.0	1024
Cohere	Embed English Light Image v3.0	cohere.embed-english-light-image-v3.0	384
Cohere	Embed Multilingual Light Image v3.0	cohere.embed-multilingual-light-image-v3.0	384

GenAI Regions

us-chicago-1 · us-ashburn-1 · us-phoenix-1 · uk-london-1 · eu-frankfurt-1 · ap-tokyo-1 · ap-osaka-1 · sa-saopaulo-1 · ca-toronto-1 · ap-melbourne-1 · ap-mumbai-1 · eu-amsterdam-1 · me-jeddah-1 · ap-singapore-1 · ap-seoul-1 · sa-vinhedo-1

---

Tech Stack

Component	Technology
Backend	Python 3.12, FastAPI 0.115, Uvicorn
Frontend	Vanilla JS SPA, Oracle Cloud UI theme
Auth	JWT + TOTP MFA + RBAC
Database	SQLite (WAL mode)
OCI SDK	oci 2.133.0, oci-cli
ADB	python-oracledb 2.4.1 (Thin mode)
GenAI	oci.generative_ai_inference
Container	Docker Compose, Nginx reverse proxy
MCP	Model Context Protocol SDK (stdio/SSE) with tool discovery + execution
CIS Scanner	Oracle CIS Foundations Benchmark 3.0 checker (cis_reports.py)

---

Versioning

Version	Date	Changes
v1.8	2026-03	CIS Engine auto-update from Oracle GitHub with automatic patch reapplication, version check UI card (admin), new /api/cis-engine/* endpoints, report file listing and individual download endpoints
v1.7	2026-03	Oracle official CIS report engine (replaces lightweight checker), granular report parameters (Level, OBP, Raw Data, Redact), per-report file storage with category browser, tenancy filter in Downloads, individual file download
v1.6	2026-03	Granular CIS MCP server (12 per-section scan tools: IAM, Networking, Compute, Logging/Monitoring, Storage, Asset Management), chat memory compaction with LLM-based summarization, GenAI tool use loop fix (accumulated conversation), chat thinking indicator, auto-registered CIS MCP server
v1.5	2026-03	MCP Tool Use in Chat (GenAI function calling with auto tool discovery + execution via MCP SDK), multi-table ADB vector search, preview chunks before embedding, enriched embeddings with tenancy/regions/compartments, searchable dropdowns, editable vector tables, orphaned report cleanup on restart
v1.4	2026-03	In-place config editing, 69 chat + 11 embedding models with OCID resolution (OpenAI GPT-5.3/5.2/5.1/5/4.1/4o/Codex/Image/Audio, xAI, Google, Meta, ProtectAI), OpenAI Text Embedding 3, custom OCID support, wallet auto-parse with DSN extraction
v1.3	2026-03	Persistent config logs per tab, GenAI auto-fill from OCI credentials, inline UX feedback with loading spinners, MCP type-switch fix, encrypted key passphrase support, Docker stdin hang fix
v1.2	2026-03	RAG pipeline (OCI GenAI embeddings + ADB vector search), dedicated Embeddings tab, CIS report chunking, file upload embedding
v1.1	2025-02	OCI SDK GenAI (exact pattern), OCI Account Explorer, MCP↔ADB linking, full chat parameters
v1.0	2025-02	Initial release: OCI theme, GenAI integration, MCP servers, ADB vector, JWT+MFA+RBAC

---

Development

Run Backend Locally

cd backend
pip install -r requirements.txt
DATA_DIR=./data uvicorn app:app --reload --port 8000

Run with Docker

docker compose up -d --build
docker compose logs -f backend

Rebuild After Changes

docker compose down
docker compose up -d --build

---

Troubleshooting

OCI CLI test fails with timeout: Check that your API key is correctly configured and the tenancy OCID is valid. Ensure outbound HTTPS (443) is allowed.

GenAI returns 401/403: Verify the IAM policy Allow group ... to use generative-ai-family in compartment ... exists. Check that the compartment OCID in the GenAI config matches the policy.

OCI CLI test hangs with passphrase prompt (Docker): If your private key is encrypted (ENCRYPTED in the PEM header), provide the passphrase in the Key Passphrase field when saving the credential. Unencrypted keys work without a passphrase. The app automatically detects encrypted keys and blocks upload if no passphrase is provided.

ADB connection fails: Ensure the wallet ZIP contains tnsnames.ora and ewallet.pem. The DSN must match a service name in tnsnames.ora (e.g., myatp_high).

Container won't start:

docker compose logs backend

---

License

MIT

---

_{Built with ❤️ for Oracle Cloud Infrastructure security compliance}