XORCISM-AI/XORCISM

What it is

XORCISM's README, beyond the feature catalog already summarized, carries the concrete deployment constraints and licensing status an engineer needs before adopting it. The server runs on port 9292; first boot prints a one-time admin (admin@xorcism.local + random temp password) to the console.

Preconditions / Affected

• Node 20 only. better-sqlite3 is a native module with prebuilt binaries for Node 20; the page states Node 23+/24 break the ABI. Builds run on any Node, but the runtime needs 20. Windows without a system Node can use the bundled tools/nodejs/node.exe.
• SQLite databases must live OUTSIDE OneDrive. The page warns OneDrive "replaces files under open handles and corrupts WAL journals." The code tree can sit under OneDrive; the DBs cannot.

What to do

Fresh setup:

cd xorcism_ts
npm install
npm run build
$env:DB_DIR = "C:\Users\$env:USERNAME\XORCISM_databases"   # outside OneDrive
npm start                                                   # → http://localhost:9292/login

Docker:

docker compose up -d --build

SQLite persists in the xorcism-data volume (DB_DIR=/data); bind-mount existing DBs instead.

Portability to a server DB engine is opt-in via env var, migrated with a script:

$env:XORCISM_DB_ENGINE = "postgresql"   # sqlite (default) | postgresql | mysql | mariadb
python tools/migrate_db.py

Hardening/integration env vars worth knowing: XORCISM_ALLOW_REGISTER=0 disables public self-registration; XOR_CVE_IMPORT=0 / XOR_CVE_MATCH=0 disable the hourly NVD importer/matcher; NVD_API_KEY raises the NVD rate limit. API connectors take credentials only via environment variables, never the UI (e.g. QUALYS_API_URL/_USER/_PASSWORD, CALDERA_URL/_API_KEY).

The REST API (/api/v1, OpenAPI at /api/v1/openapi.json) is read-only, tenant-scoped, keyed with Authorization: Bearer xor_… (keys stored SHA-256, carry scopes + optional expiry). HMAC-signed webhooks (X-XORCISM-Signature) fire on incident.created/updated and asset.updated.

Caveats

• Licensing is not actually established. The page calls it "open-source" but says to "see xorcism.ai for licensing terms" and admits no LICENSE file exists in the repo — "add a LICENSE file to make the terms explicit." For enterprise adoption this is unresolved; absent a license, default copyright applies.
• Not affiliated with or endorsed by MITRE, ANSSI, or OASIS despite integrating their frameworks.
• Provided "as is," no warranty; you are responsible for authorization before running any offensive/scanning connector. Live-scan playbooks are ROE-enforced and capability-gated, but the safe/live distinction is yours to configure.