Treetop is an open-source authorization stack built on Cedar. It provides tools for building, validating, serving, and operating policy-based authorization.
Run Treetop as a REST service, integrate through an official client, compose deterministic policy bundles, or inspect the service from the command line and browser workbench. The Rust engine can also be embedded for specialized use cases.
These repositories are all maintained parts of Treetop, covering the runtime, policy delivery, client integrations, and operator tooling.
| Project | Purpose | Distribution |
|---|---|---|
| treetop-rest | REST API and standalone server | server archives · container |
| treetop-client | Typed asynchronous Rust client | crate · docs |
| treetop-client-python | Typed synchronous and asynchronous Python client | PyPI |
| treetop-cli | Command-line client and interactive REPL | native archives and checksums |
| treetop-frontend | Browser workbench for policies, requests, and metrics | static archive and checksum · container |
| treetop-bundle | Deterministic, optionally signed Cedar policy bundles | crate · docs · CLI archives |
| treetop-bundle-action | Policy validation and bundle builds in GitHub Actions | @v1 Action · releases |
| treetop-core | Rust engine underlying Treetop REST, also available for in-process deployments | crate · docs |
| Artifact | Published formats |
|---|---|
| Treetop server | Linux x86-64 and ARM64 musl archives; container image |
| Treetop CLI | Linux x86-64 and ARM64 musl, Apple-silicon macOS, and Windows x86-64 archives with SHA-256 checksums |
| Bundle CLI | Linux x86-64 and ARM64 musl, Apple-silicon macOS, and Windows x86-64 archives with SHA256SUMS |
| Workbench | Versioned static-site archive with a SHA-256 checksum; Linux AMD64 and ARM64 container image |
| Libraries and clients | Rust crates on crates.io and the Python client on PyPI |
| Bundle Action | Versioned GitHub Action, available through the moving v1 major tag |
Run the server:
docker run --rm --publish 9999:9999 \
--env TREETOP_LISTEN=0.0.0.0 \
ghcr.io/treetop-policy-engine/treetop-rest:latestThen check process liveness:
curl http://127.0.0.1:9999/livezValidate a policy bundle in GitHub Actions:
- uses: treetop-policy-engine/treetop-bundle-action@v1
with:
manifest: treetop-bundle.toml
deny-warnings: trueProject-specific documentation, examples, compatibility information, and release notes live in each repository.