Blueprint maps every database.

A read-only census of every managed database your AWS credentials can reach. Runs on your machine, output stays local, zero telemetry. Open source, no account required.

View on GitHub (opens in a new tab)Get started free
install with Homebrew
$ brew install hoophq/tap/blueprint
# then, with AWS credentials in the standard chain:
$ blueprint scan

See the sprawl.

The HTML report mirrors your estate: engine versions checked against end-of-life dates, ownership scored from tags, exposure called out row by row.

What the report flags

Pick a finding to see which rows it catches.

blueprint report · inventoryread-only · computed locally

All 5 example rows.

NameEngineEnvironmentRegionStatus
payments-primaryaurora-postgresql15.4productionus-east-1available
orders-cacheredis7.1productionus-east-1availableunencrypted
legacy-reportsmysql5.7.44end-of-lifeuntaggedeu-west-1available
growth-eventsdynamodbdevelopmentus-west-2active
billing-stagingpostgres16.4stagingsa-east-1stopped

Example rows. A real report adds an attribution score, end-of-life checks against upstream dates, and every scan failure, listed and never hidden.

Three steps, read‑only.

Describe and list calls only. Blueprint never modifies a resource.

  1. Point it at AWS

    The standard credential chain: env vars, profiles, SSO.

    blueprint scan --profile prod

  2. Census every database

    RDS, Aurora, DocumentDB, Neptune, DynamoDB, ElastiCache and Redshift, across every region or your whole AWS Organization.

    blueprint scan --org

  3. Read it locally

    One self-contained HTML file, plus JSON and CSV. Scans archive on your machine, so the next run shows exactly what changed.

Built for DBAs, not dashboards.

One binary on your laptop and the credentials you already have. Every flag narrows or widens what it reads.

blueprint scan
# one profile, or chosen regions
$ blueprint scan --profile prod
$ blueprint scan --regions us-east-1,eu-west-1
# every member account of your AWS Organization
$ blueprint scan --org
# pick the outputs, or diff against an earlier census
$ blueprint scan --formats html,json,csv
$ blueprint scan --compare last.json

  • Nothing deployed in your cloud

    Runs from your laptop against your own credentials. No agents, no CloudFormation, nothing installed in the target account.

  • Local-only, zero telemetry

    Reports are written to disk and scan history stays in ~/.blueprint. No analytics, no crash reporting, no update checks. The only network calls are to AWS.

  • Honest coverage, not magic

    Maps what is reachable from the credentials you give it. Owner and environment come from tags, imported and never inferred, and every scan failure is listed in the report.

More from hoop Labs.

Each tool solves one problem, runs locally and needs no signup to try.

See every labs tool

Turn discovery into control.

Need it mapped, governed and access-controlled centrally? hoop.dev centralizes access to every database Blueprint finds, with policy, data masking and full audit logs.

Get started freeView on GitHub (opens in a new tab)

Ask an assistant what hoop.dev does: Claude, ChatGPT, Grok, Gemini, Perplexity, Copilot.

try it without AWS
$ brew install hoophq/tap/blueprint
# no credentials handy? render the report from fixture data
$ blueprint scan --demo