Cutsheet watches your device configs, keeps a git-backed history, and turns every change into a risk-analyzed report a human can read. Built for the team that finds out about config changes the hard way.
Open source. Apache-2.0. Single binary. Read-only by design.
How it works
Agentless SSH and API collectors pull running configs on a schedule. Credentials encrypted at rest. Nothing is ever written to your devices.
Every real change becomes a commit. Full history, blame, and diffs for every device, mirrorable anywhere git goes.
Deterministic analysis flags broadened ACLs, trunk changes, AAA edits, lost monitoring. Reports written for operators, reviewers, and the change board.
What you get
Routes, ACLs, VLANs, trunks, NAT, VPN, AAA, management plane, and monitoring changes ranked low to high with evidence lines.
Every change ships with before-state facts and rollback guidance, plus a validation checklist for the maintenance window.
A plain-language impact summary your manager can read. Bring evidence to the CAB meeting instead of a screenshot of PuTTY.
An embedded web UI with an org-wide change feed, device inventory, and full HTML reports. One binary, no app server.
Severity-filtered webhooks and Discord alerts the moment a change lands. Quiet on no-ops, loud on any/any.
The same analysis engine works standalone: feed it a before and after config, get the full report bundle. No server required.
Vendor support
Deterministic parsers, not regex roulette. Auto-detection with vendor-exclusive structural tokens, and a generic fallback for everything else.
Read-only collectors, full stop. No config push, no remediation scripts run against your gear, no "just let us fix it for you". Cutsheet observes and explains; your hands stay on the keyboard. That is a design decision, not a missing feature.
Quickstart
$ docker compose up -d $ docker compose exec cutsheet cutsheet token create --data-dir /data --name admin token: cst_... (shown once) $ cutsheet device add --id core-sw --collector ssh --vendor cisco-ios ... # no hardware handy? seed a demo timeline: $ cutsheet demo --data-dir ./data && cutsheet serve --data-dir ./data
v0.1 source and binaries land soon. Until then the build is happening in the open on GitHub.