270+ MCP tools make Probo an automation-heavy GRC system
Probo exposes more than 270 MCP tools alongside a web console, GraphQL API, n8n node, and a CLI with over 44 command groups. The data model covers risks, controls, evidence, vendors, privacy assessments, access reviews, audit programs, documents, and a public compliance page. That breadth is the reason to consider it: one control can sit near its evidence, owner, policy, vendor record, and audit work instead of being copied through several spreadsheets.
The same breadth changes the buying decision. An MCP client can read and write compliance records, draft policies, run risk assessments, and assemble evidence packs. Probo also records immutable audit logs and supports policy-based access control, but an agent connection still needs the same care as any privileged integration. Decide which identities can change records, which actions need review, and how you will inspect agent activity before connecting a general-purpose assistant to the 270+ tool surface.
Four production services turn self-hosting into platform work
The supplied production Compose file defines 4 services: Probo, PostgreSQL, SeaweedFS, and headless Chrome. Probo needs an encryption key, cookie secret, password pepper, trust token secret, base URL, database details, object-storage credentials, and mail settings. Chrome handles PDF generation. The repository includes sensible local defaults, yet those defaults are not a production security plan. Backups, TLS, secret storage, mail delivery, and recovery remain yours.
Kubernetes users get a Helm chart, but the chart assumes Kubernetes 1.23+, Helm 3.8+, external PostgreSQL, and S3-compatible storage. Database startup also depends on citext, pgcrypto, unaccent, and pg_stat_statements. The chart calls out metadata compatibility problems with Azure Blob behind S3 proxies and recommends a native S3-compatible backend. This is deployable software for an existing platform team, not a sidecar an auditor can own alone.
What happened when we ran it
Our sandbox installed commit 1729c6c in 95 seconds, pulling 1,432 npm packages and occupying 1,420 MB on disk. Npm audit reported 0 known vulnerabilities across critical, high, moderate, and low severity. The repository itself was also substantial: 6,638 files, about 912,549 source lines, and 39.3 MB checked out. It contained 17 CI workflow files, a Dockerfile, a Compose file, and npm workspaces.
The build failed after 47 seconds with exit code 2. Its final output named @probo/employee-portal#build; that workspace was running tsc -b && vite build. The n8n node's TypeScript build then showed as canceled. Turbo reported 6 successful tasks out of 10 before ending the run. The log tail does not identify the compiler diagnostic, so it supports one narrow conclusion: this checkout did not complete its full build in our 3-CPU, 8 GB Debian container.
There was no test script or target for our harness to run, and the checkout had no tests directory, so we skipped tests rather than reporting a pass. That matters in a 912,549-line monorepo because a successful dependency install says little about application behavior. Probo does have 17 CI workflow files, which is useful evidence of automation in the repository. It does not change the result of the commands we ran on the supplied commit.
Access-review connectors need per-provider acceptance tests
Open issue 1899 reports a specific 1Password failure in v0.282.0 and v0.286.0. The driver expects user records under a users key, while the reported API response places them under results. Decoding then returns an empty list without an authentication error, so an access review can appear to have zero accounts. If a connector feeds audit evidence, a plausible empty result is more dangerous than a loud request failure.
Open issue 1940 describes another data-quality problem in v0.291.0: double-clicking Create measure submitted two mutations and produced duplicate rows 32 ms apart. Neither report proves every provider or form is unreliable, and the latest release is newer than both cited versions. They do show what an evaluation must include. Seed known accounts, compare source totals, create and edit sample records, and verify that repeated clicks or retries do not multiply compliance data.
Version 0.296.0 shows fast work, with 55 open issues to inspect
GitHub recorded the last push on September 24, 2026, and release probod/v0.296.0 was published the same day. That release added multi-account cloud connectors, task webhook events, page search, and audit filtering for findings. The repository had 1,385 stars, 88 combined issues and pull requests, and 55 open issues when checked. Those numbers describe an active project with a live queue, not a settled appliance.
Probo is worth a controlled trial when your compliance program already has enough moving parts to justify one shared system. Begin with a disposable organization and the exact connectors you need, then make the source build part of the acceptance gate. A team that cannot staff PostgreSQL, object storage, identity, backups, and integration checks will spend less effort with a hosted GRC product or a narrower risk tool.