Open ASM Platform

What it is

Open ASM's tool-integration layer. The scanners (nuclei, subfinder, httpx, naabu, dnsx, and others) are not in the open-asm repository — they live in a companion repo, oasm-connectors, each shipped as an isolated Docker image wrapping a small Go SDK adapter. The platform treats that catalog as data rather than compiled-in dependencies.

How it works

Each connector declares its image, capabilities, inputs schema, and resource defaults in a <category>/<connector>/manifest.yaml. oasm-connectors' combine-manifest command aggregates these into a single manifest.json. The pipeline:

flowchart LR
    MAN["oasm-connectors<br/>manifest.json"] -->|"task sync-connectors"| CORE[Core API]
    CORE -->|"validate inputs vs schema<br/>resolve image"| WK[Worker]
    WK -->|"pull image, run"| CT[Connector container]
    CT -.->|"stream findings"| WK
    WK -.->|"persist"| CORE

• Sync: task sync-connectors pulls the manifest into core-api/resources/connectors/manifest.json, so Core knows which connectors exist and what inputs each accepts.
• Dispatch: for a scan, Core resolves the image from the manifest, validates inputs against the connector's schema, and hands the worker an execution command carrying the image reference and resolved inputs.
• Execution/Findings: the worker pulls the image, runs the container, and the SDK adapter streams findings back through Core into the asset inventory.

Why it matters (for an evaluator)

Because connectors are versioned images referenced by the manifest, adding or upgrading a scanning tool never requires an Open ASM release — you publish the connector in oasm-connectors and re-sync. This is the operational consequence the summary's "pluggable connectors" phrasing hides: tool updates and platform updates are fully decoupled, and workers must have Docker runtime access to pull and run arbitrary connector images.

What to do

Quickstart via Docker:

git clone https://github.com/oasm-platform/open-asm.git
cd open-asm
cp core-api/example.env core-api

For the connector contract, SDK adapter interface, and Dockerfile pattern needed to author a custom tool, consult the oasm-connectors repository README — the open-asm page points there rather than documenting it inline.

Caveats

The fetched page is primarily a feature list and architecture overview; it names no versions, security hardening notes, or authentication model. The AI-assistant integration is an MCP server queried by OpenAI/Anthropic/Google models — treat any exposure of asset/vulnerability data through that channel as a data-egress consideration the page does not address.