What is Steward?

This software provides a unified view of cloud resources across the major providers. It discovers resources, maps their dependencies in a topology graph, and enables safe cleanup by showing what would be affected before any deletion. The software runs as a single executable with an embedded web console and SQLite database, with PostgreSQL as an option. It supports scheduled scans with notifications to several messaging platforms. The self-hosted UI uses token-based authentication, while cloud connections support key-based credentials, browser sign-in, and OIDC workload identity federation. Installation options include Homebrew, Scoop, APT, DNF, or direct binary download for macOS, Windows, and Linux.

Should you self-host Steward?

Steward scores 46/100 on selfhost.directory (how scoring works) and ranks #2 of 2 in Cloud. It has 201 GitHub stars.

It shipped 6 stable releases in the past year. The latest, v0.4.0, came out on 4 October 2026. New versions land roughly every 4 days.

Setup is moderate: expect some configuration beyond a single command. It is Apache-2.0-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is one (64/100, 1 762 stars). It scores higher overall, so compare the two before you pick. See Steward vs one side by side.

Features

Backup and Restore
Browser sign-in for cloud connectionsOnly works when browser and Steward server run on the same machine
Dependency visualization
Encrypted credential storage
Multi-cloud resource inventory
OIDC workload identity
Release update checksCan be disabled via environment variables
Reviewed cleanup
Role-based Access Control
Scheduled Scans
Self-update

How to configure Steward

DO_NOT_TRACKSame as STEWARD_CHECKPOINT_DISABLE
Same as STEWARD_CHECKPOINT_DISABLE
values: Any value other than 0
STEWARD_ADDR127.0.0.1:8585Listen address for the server
Listen address for the server
values: IP:PORT format
STEWARD_AUTH_MODElocal, or token when a token is setAuthentication mode: local (no sign-in, loopback only) or token
Authentication mode: local (no sign-in, loopback only) or token
values: local, token
STEWARD_AUTH_ROLEadminRole granted to the token: viewer, operator, or admin
Role granted to the token: viewer, operator, or admin
values: viewer, operator, admin
STEWARD_AUTH_SUBJECTlocal-adminName recorded in audit events for actions taken with the token
Name recorded in audit events for actions taken with the token
values: String
STEWARD_AUTH_TOKENSign-in token for token mode
Sign-in token for token mode
values: Random hex string
STEWARD_CHECKPOINT_DISABLEDisable release checks
Disable release checks
values: Any value other than 0
STEWARD_CHECKPOINT_SIGNATURE_DISABLEKeep checking but send no signature
Keep checking but send no signature
values: Any value
STEWARD_CHECKPOINT_TIMEOUT3sRequest timeout as a Go duration
Request timeout as a Go duration
values: Go duration string
STEWARD_CHECKPOINT_URLhttps://checkpoint.loomx.aiEndpoint to ask for release checks
Endpoint to ask for release checks
values: HTTPS URL
STEWARD_CREDENTIAL_MASTER_KEYBase64-encoded 32-byte key that encrypts stored cloud credentials
Base64-encoded 32-byte key that encrypts stored cloud credentials
values: Base64-encoded 32-byte key
STEWARD_DB_DRIVERsqliteDatabase driver: sqlite or postgres
Database driver: sqlite or postgres
values: sqlite, postgres
STEWARD_DB_DSNsteward.db in the data directorySQLite file path or PostgreSQL connection string
SQLite file path or PostgreSQL connection string
values: File path or connection string
STEWARD_DB_MAX_CONNS20PostgreSQL connection pool limit
PostgreSQL connection pool limit
values: Positive integer
STEWARD_HOME~/.stewardData directory for SQLite database, credential key, and server status file
Data directory for SQLite database, credential key, and server status file
values: Directory path
STEWARD_OIDC_ISSUER_URLOIDC issuer URL for workload identity federation
OIDC issuer URL for workload identity federation
values: HTTPS URL
STEWARD_OIDC_SIGNING_KEY_FILEPath to RSA signing key file for OIDC
Path to RSA signing key file for OIDC
values: Absolute file path
STEWARD_OIDC_WORKSPACE_IDOIDC workspace identifier
OIDC workspace identifier
values: String
STEWARD_PUBLIC_URLThe address people use to open Steward, used for failure notification links
The address people use to open Steward, used for failure notification links
values: HTTPS URL
STEWARD_SCAN_CONCURRENCY4Number of scan items run at the same time
Number of scan items run at the same time
values: Positive integer