Skip to content
SPECIFICTION
Get listed

SQLTriage

github.com

Free plan WebWindowsSelf-hosted
Visit github.com
Spec score 7.3 #13 of 27 in Database Vulnerability Scanners

What it is

SQLTriage audits SQL Server and maps findings to compliance controls, with cited evidence and a PDF for board-level review. It describes more than 576 checks across security, performance, configuration, high availability, backup, and recovery. Mappings cover NIST 800-53, CIS Benchmarks, DISA STIG, ISO 27001, SOC 2, PCI-DSS, and HIPAA. Its read-only assessment queries SQL Server DMVs without installing an agent or changing the schema; separate opt-in deployment and remediation pages can make changes. Companion monitoring views include live sessions, blocking chains, query plans, wait statistics, dashboards, and alerts. The repository says the app is local-only by default, without telemetry, phone-home behavior, or a cloud dependency, and supports optional Azure Blob export. SQL passwords are encrypted at rest with AES-256-GCM and DPAPI. It supports Windows authentication, SQL authentication, and Azure AD. Azure SQL Managed Instance is fully supported; Azure SQL Database has partial support, and checks needing server-level DMV access are skipped automatically. SQLTriage is free under GNU GPL v3, allowing commercial use while requiring modifications to remain open.

Spec sheet

Purpose
SQLTriage audits SQL Server and maps findings to compliance controls with cited evidence and a board-ready PDF.Read 5 Oct 2026 · sqladrian.github.io
Intended users
The site names senior DBAs, database consultants, InfoSec and compliance teams, and CIOs as intended users.Read 5 Oct 2026 · sqladrian.github.io
Deployment
The site offers a Windows desktop app and Windows Service mode, with service dashboards available from a browser via Kestrel HTTPS.Read 5 Oct 2026 · sqladrian.github.io
Integrations
The site says users can connect with Windows Auth, SQL Auth, or Azure AD, and that SQLWATCH is useful for long-term historical dashboards.Read 5 Oct 2026 · sqladrian.github.io
Security
The repository says the app is local-only by default with no telemetry, phone-home, or cloud dependency, and supports optional Azure Blob export.Read 5 Oct 2026 · github.com
Support
The repository directs bug reports and feature requests to GitHub Issues and community questions to GitHub Discussions.Read 5 Oct 2026 · github.com
License
SQLTriage is offered under GNU GPL v3, with free commercial use and modifications required to remain open.Read 5 Oct 2026 · github.com
Azure SQL support
Azure SQL Managed Instance is fully supported; Azure SQL Database has partial support, with checks requiring server-level DMV access skipped automatically.Read 5 Oct 2026 · sqladrian.github.io
Checks
The site describes 576+ checks covering security, performance, configuration, and high availability, backup, and recovery.Read 5 Oct 2026 · sqladrian.github.io
Credentials
The repository says SQL passwords are encrypted at rest with AES-256-GCM and DPAPI.Read 5 Oct 2026 · github.com
Frameworks
The site lists mappings for NIST 800-53, CIS Benchmarks, DISA STIG, ISO 27001, SOC 2, PCI-DSS, and HIPAA.Read 5 Oct 2026 · sqladrian.github.io
Limits
The repository describes SQL Server as the supported database and says hosted SaaS dashboards are not offered.Read 5 Oct 2026 · github.com
Monitoring
Companion views include live sessions, blocking chains, query plans, wait stats, dashboards, and alerting.Read 5 Oct 2026 · sqladrian.github.io
Read-only assessment
Assessment checks query DMVs without installing an agent or changing SQL Server schema; separate opt-in deployment and remediation pages can write changes.Read 5 Oct 2026 · sqladrian.github.io

Plans and prices

Free Free All features · no per-server fees · no subscription · no feature tiers Read 5 Oct 2026 · sqladrian.github.io

Every SQLTriage plan and price →

Strong points and limits

Strong points

  • Describes more than 576 checks.
  • Maps findings to listed compliance frameworks.
  • Read-only assessment does not install an agent.
  • Local-only by default with no telemetry.
  • Free commercial use under GNU GPL v3.

Limits

  • SQL Server is the supported database.
  • Azure SQL Database support is partial.
  • Hosted SaaS dashboards are not offered.
  • Modifications must remain open under the license.

Who it suits

SQLTriage is aimed at senior DBAs, database consultants, InfoSec and compliance teams, and CIOs working with SQL Server. It may suit organizations that want local assessments and control-mapped evidence rather than hosted SaaS dashboards.

Verdict

SQLTriage combines SQL Server assessment, monitoring views, and compliance mappings in a free tool. Its local-first approach and opt-in changes may suit teams that want control, while database support is limited to SQL Server and partial Azure SQL Database coverage.

Where Specifiction places it

Alternatives to SQLTriageAll alternatives →