# oasm-platform/open-asm architecture

> Architecture diagram of the GitHub repository oasm-platform/open-asm, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/oasm-platform/open-asm
- Repository: https://github.com/oasm-platform/open-asm

## Overview

OASM is a self-hosted attack-surface management platform. Teams use the console to manage targets and asset groups, trigger or schedule scans, and review discovered assets and vulnerabilities. The core API coordinates workspace data and jobs; distributed workers execute scans through isolated connector containers, with results returned for inventory and downstream reporting. The README also documents integrations, AI-assisted analysis, notifications, and storage. Several connections below are README-documented because the corresponding implementation was not sampled; those limits are reflected in the evidence citations.

Main entry points: [`core-api/src/app.module.ts`](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/app.module.ts) (Business API), [`core-api/src/modules/jobs-registry/jobs-registry.controller.ts`](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/jobs-registry/jobs-registry.controller.ts) (Job orchestration), [`worker/internal/worker/client.go`](https://github.com/oasm-platform/open-asm/blob/main/worker/internal/worker/client.go) (Go worker), [`core-api/src/modules/agents/agents.controller.ts`](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/agents/agents.controller.ts) (Agent runtime)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_console["Web console"]
  node_consoleapp["Console<br/>[main.tsx]"]
  node_targets["Target discovery"]
  node_groupsui["Asset groups"]
  node_vulnui["Vulnerability review"]
  node_jobsui["Job registry"]
  node_agentsui["Agent chat"]
end

subgraph group_api["Core API"]
  node_api["Business API<br/>[app.module.ts]"]
end

subgraph group_scan["Scan execution"]
  node_jobs["Job orchestration"]
  node_assetgroups["Group workflows"]
  node_workersapi["Worker coordination"]
  node_worker["Go worker<br/>[client.go]"]
  node_execution["Execution manager<br/>[manager.go]"]
  node_connectors["Connector containers"]
end

subgraph group_data["Data and integrations"]
  node_inventory[("Asset inventory")]
  node_vuln[("Vulnerability tracking")]
  node_integrations["Cloud integrations"]
  node_storage["Artifact storage<br/>[storage.service.ts]"]
  node_workspaces["Workspace access"]
  node_audit["Audit events<br/>[audit.service.ts]"]
  node_eventbridge["Event bridge<br/>[event-catalog.ts]"]
end

subgraph group_agent["Security agent"]
  node_agentapi["Agent runtime"]
  node_agenttools["Agent tools and skills<br/>[agents.tools.ts]"]
  node_approvals["Action approvals"]
end

node_user(("Security team"))
node_internet(("Attack surface"))
node_objectstore[("S3-compatible storage")]
node_externaltools["Connected tools"]

node_user -->|"operates"| node_consoleapp
node_consoleapp -->|"REST requests"| node_api
node_targets -.->|"manages targets"| node_api
node_groupsui -.->|"configures scans"| node_api
node_vulnui -.->|"reviews findings"| node_api
node_jobsui -.->|"monitors runs"| node_api
node_agentsui -.->|"sends chat"| node_agentapi
node_assetgroups -->|"triggers workflows"| node_jobs
node_jobs -->|"dispatches jobs"| node_workersapi
node_workersapi -->|"gRPC jobs"| node_worker
node_worker -->|"runs jobs"| node_execution
node_execution -->|"spawns containers"| node_connectors
node_connectors -->|"scans"| node_internet
node_worker -->|"submits results"| node_jobs
node_jobs -->|"merges results"| node_inventory
node_jobs -->|"records findings"| node_vuln
node_integrations -->|"queues sync"| node_jobs
node_api -.->|"enforces access"| node_workspaces
node_api -->|"manages artifacts"| node_storage
node_storage -->|"stores objects"| node_objectstore
node_api -.->|"publishes events"| node_eventbridge
node_api -->|"records actions"| node_audit
node_agentapi -->|"invokes tools"| node_agenttools
node_agentapi -->|"checks approvals"| node_approvals
node_agenttools -->|"queries workspace data"| node_inventory
node_agenttools -->|"calls connected tools"| node_externaltools
node_approvals -->|"delegates commands"| node_worker

click node_consoleapp "https://github.com/oasm-platform/open-asm/blob/main/console/src/main.tsx"
click node_targets "https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/targets"
click node_groupsui "https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/asset-group"
click node_vulnui "https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/vulnerabilities"
click node_jobsui "https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/jobs-registry"
click node_agentsui "https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/agents"
click node_api "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/app.module.ts"
click node_jobs "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/jobs-registry/jobs-registry.controller.ts"
click node_assetgroups "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/asset-group/asset-group.controller.ts"
click node_workersapi "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/workers/workers.controller.ts"
click node_worker "https://github.com/oasm-platform/open-asm/blob/main/worker/internal/worker/client.go"
click node_execution "https://github.com/oasm-platform/open-asm/blob/main/worker/internal/execution/manager.go"
click node_inventory "https://github.com/oasm-platform/open-asm/tree/main/core-api/src/modules/assets"
click node_vuln "https://github.com/oasm-platform/open-asm/tree/main/core-api/src/modules/vulnerabilities"
click node_integrations "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/integrations/integrations.service.ts"
click node_storage "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/storage/storage.service.ts"
click node_workspaces "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/workspaces/workspaces.service.ts"
click node_audit "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/audit/audit.service.ts"
click node_eventbridge "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/event-bridge/contracts/event-catalog.ts"
click node_agentapi "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/agents/agents.controller.ts"
click node_agenttools "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/agents/agents.tools.ts"
click node_approvals "https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/agents/agents.approvals.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_consoleapp,node_targets,node_groupsui,node_vulnui,node_jobsui,node_agentsui toneBlue
class node_api,node_objectstore toneAmber
class node_jobs,node_assetgroups,node_workersapi,node_worker,node_execution,node_connectors toneMint
class node_inventory,node_vuln,node_integrations,node_storage,node_workspaces,node_audit,node_eventbridge toneRose
class node_agentapi,node_agenttools,node_approvals,node_user,node_internet,node_externaltools toneIndigo
```

## Components

### Web console

- [Console](https://github.com/oasm-platform/open-asm/blob/main/console/src/main.tsx): `console/src/main.tsx`
- [Target discovery](https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/targets): `console/src/pages/targets`
- [Asset groups](https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/asset-group): `console/src/pages/asset-group`
- [Vulnerability review](https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/vulnerabilities): `console/src/pages/vulnerabilities`
- [Job registry](https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/jobs-registry): `console/src/pages/jobs-registry`
- [Agent chat](https://github.com/oasm-platform/open-asm/tree/main/console/src/pages/agents): `console/src/pages/agents`

### Core API

- [Business API](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/app.module.ts): `core-api/src/app.module.ts`

### Scan execution

- [Job orchestration](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/jobs-registry/jobs-registry.controller.ts): `core-api/src/modules/jobs-registry/jobs-registry.controller.ts`
- [Group workflows](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/asset-group/asset-group.controller.ts): `core-api/src/modules/asset-group/asset-group.controller.ts`
- [Worker coordination](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/workers/workers.controller.ts): `core-api/src/modules/workers/workers.controller.ts`
- [Go worker](https://github.com/oasm-platform/open-asm/blob/main/worker/internal/worker/client.go): `worker/internal/worker/client.go`
- [Execution manager](https://github.com/oasm-platform/open-asm/blob/main/worker/internal/execution/manager.go): `worker/internal/execution/manager.go`
- **Connector containers**

### Data and integrations

- [Asset inventory](https://github.com/oasm-platform/open-asm/tree/main/core-api/src/modules/assets): `core-api/src/modules/assets`
- [Vulnerability tracking](https://github.com/oasm-platform/open-asm/tree/main/core-api/src/modules/vulnerabilities): `core-api/src/modules/vulnerabilities`
- [Cloud integrations](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/integrations/integrations.service.ts): `core-api/src/modules/integrations/integrations.service.ts`
- [Artifact storage](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/storage/storage.service.ts): `core-api/src/modules/storage/storage.service.ts`
- [Workspace access](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/workspaces/workspaces.service.ts): `core-api/src/modules/workspaces/workspaces.service.ts`
- [Audit events](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/audit/audit.service.ts): `core-api/src/modules/audit/audit.service.ts`
- [Event bridge](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/event-bridge/contracts/event-catalog.ts): `core-api/src/modules/event-bridge/contracts/event-catalog.ts`

### Security agent

- [Agent runtime](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/agents/agents.controller.ts): `core-api/src/modules/agents/agents.controller.ts`
- [Agent tools and skills](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/agents/agents.tools.ts): `core-api/src/modules/agents/agents.tools.ts`
- [Action approvals](https://github.com/oasm-platform/open-asm/blob/main/core-api/src/modules/agents/agents.approvals.ts): `core-api/src/modules/agents/agents.approvals.ts`

### Other components

- **Security team**
- **Attack surface**
- **S3-compatible storage**
- **Connected tools**

## Connections

- Security team → Console: operates
- Console → Business API: REST requests
- Target discovery → Business API: manages targets
- Asset groups → Business API: configures scans
- Vulnerability review → Business API: reviews findings
- Job registry → Business API: monitors runs
- Agent chat → Agent runtime: sends chat
- Group workflows → Job orchestration: triggers workflows (evidence: `core-api/src/modules/asset-group/asset-group.controller.ts`)
- Job orchestration → Worker coordination: dispatches jobs
- Worker coordination → Go worker: gRPC jobs
- Go worker → Execution manager: runs jobs (evidence: `worker/internal/worker/client.go`)
- Execution manager → Connector containers: spawns containers
- Connector containers → Attack surface: scans
- Go worker → Job orchestration: submits results (evidence: `core-api/src/modules/jobs-registry/jobs-registry.controller.ts`)
- Job orchestration → Asset inventory: merges results (evidence: `core-api/src/modules/jobs-registry/jobs-registry.controller.ts`)
- Job orchestration → Vulnerability tracking: records findings (evidence: `core-api/src/modules/jobs-registry/jobs-registry.controller.ts`)
- Cloud integrations → Job orchestration: queues sync (evidence: `core-api/src/modules/jobs-registry/jobs-registry.controller.ts`)
- Business API → Workspace access: enforces access
- Business API → Artifact storage: manages artifacts
- Artifact storage → S3-compatible storage: stores objects
- Business API → Event bridge: publishes events
- Business API → Audit events: records actions
- Agent runtime → Agent tools and skills: invokes tools (evidence: `core-api/src/modules/agents/agents.controller.ts`)
- Agent runtime → Action approvals: checks approvals (evidence: `core-api/src/modules/agents/agents.controller.ts`)
- Agent tools and skills → Asset inventory: queries workspace data
- Agent tools and skills → Connected tools: calls connected tools
- Action approvals → Go worker: delegates commands