ZAGROS v0.1.0Install Zagros with Docker Compose.
The supported path for a local or shared team deployment. No local Rust toolchain required — every Zagros command below runs inside the Compose cli profile container. Prefer an agent to do this for you? Use the AI install prompt →
What you need first.
Git
To clone the repository.
Docker + Compose v2
Docker Desktop, Docker Engine, or WSL2 with Docker integration. Linux, macOS, and Windows are supported; Linux is recommended for production.
Network access
Required during image builds and source ingestion so Zagros can retrieve its configured authoritative upstream data.
Loopback ports
127.0.0.1:47474 (HelixDB), 127.0.0.1:8789 (MCP), 127.0.0.1:8788 (UI). No ports are exposed beyond loopback by default.
Clone the repo, start the stack.
Clone
git clone https://github.com/siamakhaz/Zagros.git cd Zagros
Configure environment (optional)
Copy the example file only if you need to customize settings. Defaults work out of the box. On Linux, if your account UID or GID is not 1000, set ZAGROS_HOST_UID and ZAGROS_HOST_GID in .env to the values reported by id -u and id -g. This keeps the bind-mounted HelixDB data owned by your host account.
cp .env.example .env
Start the stack
Starts HelixDB, the MCP server, and the web UI — all bound to loopback only.
docker compose -f docker/compose.yml up -d --build
Confirm the services are up.
The MCP health endpoint verifies HelixDB is reachable, so it is the primary stack readiness check.
Health checks
curl -fsS http://127.0.0.1:8789/health curl -fsS http://127.0.0.1:8788/api/status
A fresh database is empty — seed it.
Seeding is idempotent; re-running is safe. These commands use the Compose cli profile, so no local Rust build is needed.
Backfill CVEs
Loads up to 500 CVE records from deltaLog history. Raise --limit (max 10000) for a larger baseline.
docker compose -f docker/compose.yml --profile cli run --rm cli backfill --limit 500
Load knowledge sources
Loads CWE, ASVS, CAPEC, and ATT&CK. Individual sources can be loaded with source cwe, source asvs, source capec, or source attack.
docker compose -f docker/compose.yml --profile cli run --rm cli source all
Check counts and run a search.
Status
docker compose -f docker/compose.yml --profile cli run --rm cli status
Search CVEs
docker compose -f docker/compose.yml --profile cli run --rm cli search "remote code execution" --top-k 5
Search knowledge
docker compose -f docker/compose.yml --profile cli run --rm cli know "out-of-bounds write" --top-k 5
Daily refresh is automatic.
The persistent MCP container runs a scheduler (default 03:00 UTC daily) that pulls the latest CVE delta and refreshes all configured knowledge sources. Operational history is written to /data/refresh-status.json and /data/refresh-history.jsonl. Set ZAGROS_AUTO_REFRESH=false to disable it or ZAGROS_REFRESH_CRON to change the schedule.