Skip to content
SPECIFICTION
Get listed

Foxnode ASPM

github.com

WebLinuxAPISelf-hosted
Visit github.com
Spec score 7.6 #9 of 17 in Application Security Posture Management Software

What it is

Foxnode ASPM is an open-source platform for managing application security vulnerabilities across a software portfolio. It aggregates findings from more than 16 scanners, deduplicates repeats, and provides dashboard views of severity, scanner distribution, risk trends, and vulnerable products. Built-in parsers cover tools including Semgrep, Trivy, Snyk, ZAP, Nuclei, Gitleaks, Bandit, Checkov, SonarQube, and Prowler; imports also accept JSON, CSV, XML, JSONL, and SARIF. Jira integration supports issue creation and status synchronization, while Slack can receive alerts. Analysis features include AI finding triage, attack-path analysis, an AI security agent, remediation recommendations, and an LLM/AI scanner for issues such as prompt injection and data poisoning. Findings can be mapped to OWASP Top 10, PCI-DSS, SOC 2, CIS Benchmarks, and ISO 27001, with gap analysis. Its SBOM tools cover component inventory, license tracking, and supply-chain risk scoring. Foxnode supports Docker Compose deployment and a REST API for CI/CD integration. Local development requires Python 3.12+, Node.js 20+, PostgreSQL 16+, and Redis 7+; the project is released under the MIT License.

Spec sheet

Product
FoxNode ASPM is an open-source platform for managing application security vulnerabilities across a software portfolio.Read 2 Oct 2026 · github.com
Deployment
The recommended deployment uses Docker Compose, with nginx and GitHub Actions included in the stack.Read 1 Oct 2026 · github.com
API
A REST API supports CI/CD pipeline integration and scan-result imports.Read 1 Oct 2026 · github.com
Integrations
Jira integration can create issues from findings with mapped severity, labels, and bidirectional status sync; Slack sends configurable alerts for findings and scan completions.Read 2 Oct 2026 · github.com
Compliance
Compliance mapping covers OWASP Top 10, PCI-DSS, SOC 2, CIS Benchmarks, and ISO 27001.Read 1 Oct 2026 · github.com
License
The repository states that FoxNode ASPM is released under the MIT License.Read 2 Oct 2026 · github.com
Access control
Role-based access control provides Admin, Manager, Analyst, and Viewer roles with granular permissions.Read 2 Oct 2026 · github.com
AI and ML scanning
The LLM/AI scanner detects issues including prompt injection and data poisoning, mapped to the OWASP LLM Top 10.Read 2 Oct 2026 · github.com
AI capabilities
Features include AI finding triage, an AI security agent, AI remediation recommendations, and an LLM/AI security scanner.Read 1 Oct 2026 · github.com
Compliance mapping
Findings can be mapped to OWASP Top 10, PCI-DSS, SOC 2, CIS Benchmarks, and ISO 27001 with gap analysis.Read 2 Oct 2026 · github.com
Contributor support
The project welcomes contributions and provides contribution steps including running backend pytest tests.Read 1 Oct 2026 · github.com
Dashboards
The dashboard reports severity distribution, scanner breakdown, risk trends, and vulnerable products.Read 2 Oct 2026 · github.com
Deduplication
Hash-based deduplication prevents duplicate findings across scans.Read 2 Oct 2026 · github.com
Deployment and API
The project supports Docker Compose deployment and provides a REST API for CI/CD pipeline integration.Read 2 Oct 2026 · github.com
Product purpose
FoxNode ASPM manages application security vulnerabilities across a software portfolio.Read 1 Oct 2026 · github.com
Requirements
The listed local-development prerequisites are Python 3.12+, Node.js 20+, PostgreSQL 16+, and Redis 7+.Read 2 Oct 2026 · github.com
Scanner aggregation
It aggregates findings from 16+ security scanners and deduplicates them.Read 1 Oct 2026 · github.com
Scanner imports
It includes 16 built-in parsers and accepts scan results in JSON, CSV, XML, JSONL, and SARIF formats.Read 2 Oct 2026 · github.com
Scanner support
Built-in parsers cover Semgrep, Trivy, Snyk, ZAP, Nuclei, Gitleaks, Bandit, Checkov, SonarQube, Prowler, tfsec, TruffleHog, OWASP Dependency-Check, SARIF, and generic JSON/CSV tools.Read 1 Oct 2026 · github.com
Security analysis
Features include AI finding triage, attack-path analysis, an AI security agent, and AI remediation recommendations.Read 2 Oct 2026 · github.com
Supply chain
The SBOM feature provides component inventory, license tracking, and supply-chain risk scoring.Read 2 Oct 2026 · github.com
Technical requirements
Local development requires Python 3.12+, Node.js 20+, PostgreSQL 16+, and Redis 7+.Read 1 Oct 2026 · github.com

Strong points and limits

Strong points

  • Aggregates findings from more than 16 scanners.
  • Hash-based deduplication prevents repeated findings across scans.
  • Jira and Slack integrations support workflows and alerts.
  • SBOM tools cover components, licenses, and supply-chain risk.

Limits

  • Local development requires Python 3.12+ and Node.js 20+.
  • Local development also requires PostgreSQL 16+ and Redis 7+.
  • Deployment is listed as self-hosted.

Who it suits

Foxnode ASPM suits teams managing security findings across a software portfolio, especially those seeking scanner aggregation, compliance mapping, and CI/CD integration. It supports self-hosted deployment through Docker Compose.

Verdict

Foxnode ASPM brings scanner results, risk views, compliance mapping, and remediation workflows together in a free, MIT-licensed project. Teams should account for its listed development prerequisites and self-hosted deployment approach.

Where Specifiction places it

Alternatives to Foxnode ASPMAll alternatives →