From first run to your own plugin, start here.
Privateer is a validation framework that runs automated checks, called plugins, against your resources, then writes structured, machine-readable evidence in YAML, JSON, or SARIF. Built to operate at the Evaluation layer of the Gemara GRC engineering model.
Every control in a report ends with one of these results: Passed or Failed when the check could decide, NeedsReview when a person has to look, NotApplicable when the control does not apply, NotRun when the check was skipped, and Unknown when it could not run.
Getting started
From zero to a control-by-control validation report.
Introduction to Privateer
What Privateer is, why it exists, and how a validation run works.
Quickstart (5 minutes)
Run your first validation test in five minutes.
Installation
Install Privateer on Windows, Linux, or macOS, and verify the install.
Your first validation run
Run a validation against a GitHub repository, step by step.
Understanding results
Where output files land, how to control the format, and how to suppress terminal output.
Upgrading Privateer
Keep the pvtr binary and your plugins up to date.
Glossary
Plain-language definitions of the terms used across the Privateer docs.
Developer reference
For plugin authors, contributors, and CI/CD pipeline engineers.
CLI reference
Every pvtr subcommand, its flags, and usage examples.
Configuration reference
Every config key, variable resolution rules, and the policy block.
Output schema
File locations, the Gemara Evaluation Log JSON schema, result values, and SARIF.
Build your first plugin
Generate a scaffold, write a loader and typed assessment steps, test in debug mode, and run under pvtr.
GitHub Actions integration
Run Privateer in CI, inject secrets, and upload SARIF to the Security tab.
Plugin catalog
Where to find community plugins for OSPS Baseline, FINOS CCC, and more.
Troubleshooting
Common failures, PATH issues, plugin discovery, missing output, policy errors.