How oasm-platform/open-asm works
OASM is a self-hosted attack-surface management platform. Teams use the console to manage targets and asset groups, trigger or schedule scans, and review discovered assets and vulnerabilities. The core API coordinates workspace data and jobs; distributed workers execute scans through isolated connector containers, with results returned for inventory and downstream reporting. The README also documents integrations, AI-assisted analysis, notifications, and storage. Several connections below are README-documented because the corresponding implementation was not sampled; those limits are reflected in the evidence citations.
Main entry points: app.module.ts Business API · jobs-registry.controller.ts Job orchestration · client.go Go worker · agents.controller.ts Agent runtime
Components 27
Web console
- Console
console/src/main.tsx - Target discovery
console/src/pages/targets - Asset groups
console/src/pages/asset-group - Vulnerability review
console/src/pages/vulnerabilities - Job registry
console/src/pages/jobs-registry - Agent chat
console/src/pages/agents
Core API
- Business API
core-api/src/app.module.ts
Scan execution
- Job orchestration
core-api/src/modules/jobs-registry/jobs-registry.controller.ts - Group workflows
core-api/src/modules/asset-group/asset-group.controller.ts - Worker coordination
core-api/src/modules/workers/workers.controller.ts - Go worker
worker/internal/worker/client.go - Execution manager
worker/internal/execution/manager.go - Connector containers
Data and integrations
- Asset inventory
core-api/src/modules/assets - Vulnerability tracking
core-api/src/modules/vulnerabilities - Cloud integrations
core-api/src/modules/integrations/integrations.service.ts - Artifact storage
core-api/src/modules/storage/storage.service.ts - Workspace access
core-api/src/modules/workspaces/workspaces.service.ts - Audit events
core-api/src/modules/audit/audit.service.ts - Event bridge
core-api/src/modules/event-bridge/contracts/event-catalog.ts
Security agent
- Agent runtime
core-api/src/modules/agents/agents.controller.ts - Agent tools and skills
core-api/src/modules/agents/agents.tools.ts - Action approvals
core-api/src/modules/agents/agents.approvals.ts
Other components
- Security team
- Attack surface
- S3-compatible storage
- Connected tools
Connections 27
- Security team → Console: operates
- Console → Business API: REST requests
- Target discovery → Business API: manages targets
- Asset groups → Business API: configures scans
- Vulnerability review → Business API: reviews findings
- Job registry → Business API: monitors runs
- Agent chat → Agent runtime: sends chat
- Group workflows → Job orchestration: triggers workflows
core-api/src/modules/asset-group/asset-group.controller.ts - Job orchestration → Worker coordination: dispatches jobs
- Worker coordination → Go worker: gRPC jobs
- Go worker → Execution manager: runs jobs
worker/internal/worker/client.go - Execution manager → Connector containers: spawns containers
- Connector containers → Attack surface: scans
- Go worker → Job orchestration: submits results
core-api/src/modules/jobs-registry/jobs-registry.controller.ts - Job orchestration → Asset inventory: merges results
core-api/src/modules/jobs-registry/jobs-registry.controller.ts - Job orchestration → Vulnerability tracking: records findings
core-api/src/modules/jobs-registry/jobs-registry.controller.ts - Cloud integrations → Job orchestration: queues sync
core-api/src/modules/jobs-registry/jobs-registry.controller.ts - Business API → Workspace access: enforces access
- Business API → Artifact storage: manages artifacts
- Artifact storage → S3-compatible storage: stores objects
- Business API → Event bridge: publishes events
- Business API → Audit events: records actions
- Agent runtime → Agent tools and skills: invokes tools
core-api/src/modules/agents/agents.controller.ts - Agent runtime → Action approvals: checks approvals
core-api/src/modules/agents/agents.controller.ts - Agent tools and skills → Asset inventory: queries workspace data
- Agent tools and skills → Connected tools: calls connected tools
- Action approvals → Go worker: delegates commands