j3ssie/osmedeus is a Go project with 6.6k stars in the Security space. A Modern Orchestration Engine for Security
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
Osmedeus - A Modern Orchestration Engine for Security
What is Osmedeus?
Osmedeus is a security focused declarative orchestration engine that simplifies complex workflow automation into auditable YAML definitions, complete with encrypted data handling, secure credential management, and sandboxed execution.
Built for both beginners and experts, it delivers powerful, composable automation without sacrificing the integrity and safety of your infrastructure.
Key Features
Declarative YAML Workflows - Define pipelines with hooks, decision routing, module exclusion, and conditional branching across multiple runners (host, Docker, SSH)
Distributed Execution - Redis-based master-worker pattern with queue system, webhook triggers, and file sync across workers
Rich Function Library - 80+ utility functions including nmap integration, tmux sessions, SSH execution, TypeScript/Python scripting, SARIF parsing, and CDN/WAF classification
Event-Driven Scheduling - Cron, file-watch, and event triggers with filtering, deduplication, and delayed task queues
Agentic LLM Steps - Tool-calling agent loops with sub-agent orchestration, memory management, and structured output; plus ACP subprocess agents (Claude Code, Codex, OpenCode, Gemini)
Cloud Infrastructure - Provision and run scans across DigitalOcean, AWS, GCP, Linode, and Azure with cost controls and automatic cleanup
Rich CLI Interface - Interactive database queries, bulk function evaluation, workflow linting, progress bars, and comprehensive usage examples
REST API & Web UI - Full API server with webhook triggers, database queries, and embedded dashboard for visualization
Ships prebuilt binaries for linux and macOS on x64/arm64.
See Quickstart for quick setup and Installation for advanced configurations.
CLI Usage
Web UI Assets
Workflow Visualization
Vulnerabilities
☁️ Sponsor — Bloome
Automating recon with Osmedeus? Bloome brings that same team-of-agents mindset to the rest of your workflow: multiple AI agents (Claude, ChatGPT, DeepSeek and more) in one shared chat that split the work, hand off tasks, cross-check each other, and refine the output until it's right — triage findings, draft reports, and run scheduled checks together. Zero setup, in the cloud, on web and mobile, and shareable with your team. 👉 Try Bloome
Quick Start
# Run a module workflow
osmedeus run -m recon -t example.com
# Run a flow workflow
osmedeus run -f general -t example.com
# Multiple targets with concurrency
osmedeus run -m recon -T targets.txt -c 5
# Dry-run mode (preview)
osmedeus run -f general -t example.com --dry-run
# Start API server
osmedeus serve
# List available workflows
osmedeus workflow list
# Query discovered assets
osmedeus assets -w example.com # List assets for workspace
osmedeus assets --stats # Show unique technologies, sources, types
osmedeus assets --source httpx --type web --json # Filter and output as JSON
# Query vulnerabilities, runs, and steps
osmedeus query vulns --severity high --workspace example.com
osmedeus query runs --status running
osmedeus query steps --run <run-uuid>
# Query database tables
osmedeus db list --table runs
osmedeus db list --table event_logs --search "nuclei"
# Evaluate utility functions
osmedeus func eval 'log_info("hello")'
osmedeus func eval -e 'http_get("https://example.com")' -T targets.txt -c 10
# Platform variables available in eval
osmedeus func eval 'log_info("OS: " + PlatformOS + ", Arch: " + PlatformArch)'
# Install from preset repositories
osmedeus install base --preset
osmedeus install base --preset --keep-setting # preserve existing osm-settings.yaml
osmedeus install workflow --preset
# Exclude modules from flow execution
osmedeus run -f general -t example.com -x portscan
osmedeus run -f general -t example.com -X vuln # Fuzzy exclude by substring
# Worker queue system
osmedeus worker queue new -f general -t example.com # Queue for later
osmedeus worker queue run --concurrency 5 # Process queue
# Worker management
osmedeus worker status # Show workers
osmedeus worker eval -e 'ssh_exec("host", "whoami")' # Eval with distributed hooks
# Run an ACP agent interactively
osmedeus agent "analyze this codebase"
osmedeus agent --agent codex "explain main.go"
osmedeus agent --list
# Cloud infrastructure management
osmedeus cloud create --instances 3 # Provision cloud machines
osmedeus cloud setup 1.2.3.4 5.6.7.8 # Setup existing machines
osmedeus cloud list # List active infrastructure
osmedeus cloud run -f general -t example.com --instances 3
# Show all usage examples
osmedeus --usage-example
Docker
# Show help
docker run --rm j3ssie/osmedeus:latest --help
# Run a scan
docker run --rm -v $(pwd)/output:/root/workspaces-osmedeus \
j3ssie/osmedeus:latest run -f general -t example.com
For more CLI usage and example commands, refer to the CLI Reference.
For more information about the architecture, refer to the Architecture Documentation.
Roadmap and Status
The high-level ambitious plan for the project, in order:
#
Step
Status
1
Osmedeus Engine reforged with a next-generation architecture
✅
2
Flexible workflows and step types
✅
3
Event-driven architectural model and the different trigger event categories
✅
4
Beautiful UI for visualize results and workflow diagram
✅
5
Rewriting the workflow to adapt to new architecture and syntax
✅
6
Testing more utility functions like notifications
✅
7
SAST integration with SARIF parsing (Semgrep, Trivy, etc.)
✅
8
Cloud integration, which supports running the scan on the cloud provider.
✅
9
Generate diff reports showing new/removed/unchanged assets between runs.
❌
10
Adding step type from cloud provider that can be run via serverless
❌
N
Fancy features (to be discussed later)
❌
Documentation
Topic
Link
Getting Started
docs.osmedeus.org/getting-started
CLI Usage & Examples
docs.osmedeus.org/getting-started/cli
Writing Workflows
docs.osmedeus.org/workflows/overview
Event-Driven Triggers
docs.osmedeus.org/advanced/event-driven
Deployment
docs.osmedeus.org/deployment
Architecture
docs.osmedeus.org/concepts/architecture
Development
docs.osmedeus.org/development and HACKING.md
Extending Osmedeus
docs.osmedeus.org/development/extending-osmedeus
Security Model
SECURITY.md and docs.osmedeus.org/others/security-warning
Full Documentation
docs.osmedeus.org
Disclaimer
Osmedeus is designed to execute arbitrary code and commands from user supplied input via CLI, API, and workflow definitions. This flexibility is intentional and central to how the engine operates.
Please refer to the ⚠️ Security Warning page for more information on how to stay safe. SECURITY.md draws the line between the code execution that is intentional and what counts as a vulnerability, and is where to start if you want to report one.
Think twice before you:
Run workflows downloaded from untrusted sources
Execute commands or scans against targets you don't own or have permission to test
Use workflows without reviewing their contents first
You are responsible for what you run. Always review workflow YAML files before execution, especially those obtained from third parties.
License
Osmedeus is made with ♥ by @j3ssie and it is released under the MIT license.
The most recent commit recorded on j3ssie/osmedeus was 3 months ago, based on the GitHub push timestamp. The repository has 1.0k forks — one of the better signals of community interest.
How many stars does j3ssie/osmedeus have?
j3ssie/osmedeus has 6.6k GitHub stars — refresh the page for the live number, or check github.com/j3ssie/osmedeus. TopGit mirrors GitHub's count but does not claim minute-by-minute accuracy.
Is j3ssie/osmedeus open source?
Yes — j3ssie/osmedeus ships under the MIT license, which makes its source code freely readable (and, depending on license terms, forkable and reusable). Source: github.com/j3ssie/osmedeus.
What else is in the Security space?
j3ssie/osmedeus is tracked by TopGit under the Security category, alongside 16 GitHub-tagged topics. Trending and Topics pages list peer repositories of comparable stars and language.
What is j3ssie/osmedeus?
j3ssie/osmedeus (j3ssie/osmedeus) is a Go project on GitHub. From the project's own README: A Modern Orchestration Engine for Security
What language is j3ssie/osmedeus written in?
j3ssie/osmedeus is written primarily in Go. GitHub's language field is based on the largest share of bytes in the default branch.
What license does j3ssie/osmedeus use?
j3ssie/osmedeus is released under the MIT license. Always verify the LICENSE file directly on GitHub for the authoritative terms — license strings can be edited out of sync with a project's actual stance.
Where do I read more about j3ssie/osmedeus?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/j3ssie/osmedeus is the definitive source.
Read full README in the tab above.
Want a second opinion on osmedeus?
Ask an AI that can read this page — one click and you get its take on osmedeus.
/osmedeus
