Cupcake Catalog

Cupcake Catalog

The official registry of rulebooks for [Cupcake](https://github.com/eqtylab/cupcake), the policy engine for AI coding agents.

What is Cupcake Catalog?

Cupcake Catalog is a centralized registry for discovering, sharing, and installing policy rulebooks. Instead of writing Rego policies from scratch, you can install battle-tested rulebooks with a single command.

**Key Benefits:**

• For Users: Instantly adopt security policies without Rego expertise
• For Organizations: Share rulebooks across teams and projects
• For the Community: Contribute and collaborate on open-source policies

Quick Start

Prerequisites

• Cupcake v0.5.0 or later
• A project with .cupcake/ initialized

Browse Available Rulebooks

# Search all rulebooks
cupcake catalog search

# Filter by harness
cupcake catalog search --harness claude

# Show details of a specific rulebook
cupcake catalog show security-hardened

Install a Rulebook

# Install the latest version
cupcake catalog install security-hardened

# Install a specific version
cupcake catalog install security-hardened@1.0.0

# List installed rulebooks
cupcake catalog list

Upgrade and Manage

# Upgrade a rulebook to latest
cupcake catalog upgrade security-hardened

# Upgrade all installed rulebooks
cupcake catalog upgrade

# Remove a rulebook
cupcake catalog uninstall security-hardened

How It Works

Catalog rulebooks are installed as **overlays** in `.cupcake/catalog/`. They never modify your existing configuration:

.cupcake/
├── rulebook.yml           # Your config (untouched)
├── policies/              # Your policies (untouched)
├── catalog/               # Installed catalog rulebooks
│   └── security-hardened/
│       ├── manifest.yaml
│       ├── rulebook.yml
│       ├── system/
│       │   └── evaluate.rego   # Shared entrypoint
│       ├── helpers/
│       │   └── commands.rego   # Shared helpers