ClosedSSPM

Spec sheet

Purpose

ClosedSSPM is an open source tool that audits SaaS platforms for security misconfigurations and provides remediation guidance.Read 7 Oct 2026 · closedsspm.com

AI analysis

An MCP server lets AI agents analyze scan results and suggest fixes.Read 7 Oct 2026 · closedsspm.com

CI/CD integration

The project provides a GitHub Action and a --fail-on threshold for automated security gates.Read 7 Oct 2026 · closedsspm.com

Credential handling

The security policy says credentials are read from environment variables and are not persisted to disk or config files.Read 7 Oct 2026 · github.com

DefectDojo integration

SARIF reports can be imported into DefectDojo for centralized vulnerability management.Read 7 Oct 2026 · github.com

Downloads

Installation options include Homebrew, platform binaries, Debian and RPM packages, Docker, and building from source.Read 7 Oct 2026 · github.com

Installation

The README lists Homebrew, downloadable binaries, Debian/Ubuntu packages, Red Hat/Fedora packages, Docker, and source builds.Read 7 Oct 2026 · github.com

License and maintainer

The project is licensed under Apache 2.0 and its documentation credits Piotr Mackowski.Read 7 Oct 2026 · closedsspm.com

Offline analysis

Users can save platform snapshots and analyze them later without live access.Read 7 Oct 2026 · closedsspm.com

Policy engine

Security checks use a YAML policy engine that users can customize.Read 7 Oct 2026 · closedsspm.com

Project status

The GitHub repository was archived on September 28, 2026 and is read-only.Read 7 Oct 2026 · github.com

Read-only operation

The tool is read-only and does not write to audited SaaS platforms.Read 7 Oct 2026 · github.com

Reports

It generates reports in HTML, JSON, CSV, and SARIF formats.Read 7 Oct 2026 · closedsspm.com

Security checks

The project lists 166 checks across four platforms: 86 for ServiceNow, 55 for Snowflake, 15 for Entra ID, and 10 for Google Workspace.Read 7 Oct 2026 · closedsspm.com

Security design

The security policy says the tool is read-only, does not persist credentials, and uses stdio-only transport for its MCP server.Read 7 Oct 2026 · github.com

ServiceNow checks

ServiceNow audits include 86 checks covering ACLs, roles, scripts, integrations, configuration, users, and static analysis.Read 7 Oct 2026 · closedsspm.com

Snapshot handling

The project warns that collected snapshots may contain sensitive configuration data and should be treated as confidential.Read 7 Oct 2026 · github.com

Snapshot sensitivity

Snapshots may contain sensitive SaaS configuration data and should be treated as confidential.Read 7 Oct 2026 · github.com

Supported platforms

It audits ServiceNow, Snowflake, Google Workspace, and Microsoft Entra ID.Read 7 Oct 2026 · closedsspm.com

Supported services

It audits ServiceNow, Snowflake, Google Workspace, and Microsoft Entra ID.Read 7 Oct 2026 · closedsspm.com

Where Specifiction places it

• SaaS Security Posture Management Software#11 of 307.7