Foxnode ASPM

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

Foxnode ASPM is an open-source platform for managing application security vulnerabilities across a software portfolio. It brings findings from more than 16 scanners together, removes duplicates, and provides dashboard views for severity, scanner breakdown, risk trends, and vulnerable products. Built-in parsers cover tools including Semgrep, Trivy, Snyk, ZAP, Nuclei, Gitleaks, Bandit, Checkov, and SonarQube; imports also accept JSON, CSV, XML, JSONL, and SARIF. Jira integration supports issue creation and status synchronization, while Slack can receive alerts. Analysis features include AI-assisted triage, attack-path analysis, an AI security agent, remediation recommendations, and an LLM/AI scanner for issues such as prompt injection and data poisoning. Findings can be mapped to OWASP Top 10, PCI-DSS, SOC 2, CIS Benchmarks, and ISO 27001 with gap analysis. Its SBOM feature covers component inventory, license tracking, and supply-chain risk scoring. Deployment supports Docker Compose; a REST API enables CI/CD integration. Local development requires Python 3.12+, Node.js 20+, PostgreSQL 16+, and Redis 7+.

Who it is for

Foxnode ASPM suits teams managing security findings across multiple products and scanners, especially those using Docker Compose and CI/CD pipelines. Its roles, compliance mapping, and SBOM features also address access control and supply-chain tracking needs.

What is good

Aggregates findings from 16+ scanners
Hash-based deduplication across scans
REST API supports CI/CD integration
Includes Jira and Slack integrations
MIT-licensed and open source

What to know first

Local development requires Python 3.12+
Requires Node.js 20+, PostgreSQL 16+, and Redis 7+
Recommended deployment uses Docker Compose

Verdict

Foxnode ASPM consolidates scanner results with deduplication, compliance mapping, and security-analysis features in a self-hosted, open-source platform. Check its development prerequisites and deployment approach when assessing fit for your stack.

Compared on application security posture management software

Free plan: Yesgithub.com
Finding correlation: Yesgithub.com
Risk prioritization: Yesgithub.com
Remediation workflows: Yesgithub.com
SBOM management: Yesgithub.com
Deployment options: self_hostedgithub.com

Facts

Product purpose: FoxNode ASPM manages application security vulnerabilities across a software portfolio.github.com · 1 Oct 2026
Scanner aggregation: It aggregates findings from 16+ security scanners and deduplicates them.github.com · 1 Oct 2026
Scanner support: Built-in parsers cover Semgrep, Trivy, Snyk, ZAP, Nuclei, Gitleaks, Bandit, Checkov, SonarQube, Prowler, tfsec, TruffleHog, OWASP Dependency-Check, SARIF, and generic JSON/CSV tools.github.com · 1 Oct 2026
Integrations: The platform integrates with Jira for issue creation and status synchronization and Slack for alerts.github.com · 1 Oct 2026
AI capabilities: Features include AI finding triage, an AI security agent, AI remediation recommendations, and an LLM/AI security scanner.github.com · 1 Oct 2026
Compliance: Compliance mapping covers OWASP Top 10, PCI-DSS, SOC 2, CIS Benchmarks, and ISO 27001.github.com · 1 Oct 2026
Access control: Role-based access control provides Admin, Manager, Analyst, and Viewer roles.github.com · 1 Oct 2026
Deployment: The recommended deployment uses Docker Compose, with nginx and GitHub Actions included in the stack.github.com · 1 Oct 2026
API: A REST API supports CI/CD pipeline integration and scan-result imports.github.com · 1 Oct 2026
Technical requirements: Local development requires Python 3.12+, Node.js 20+, PostgreSQL 16+, and Redis 7+.github.com · 1 Oct 2026
License: FoxNode ASPM is released under the MIT License.github.com · 1 Oct 2026
Contributor support: The project welcomes contributions and provides contribution steps including running backend pytest tests.github.com · 1 Oct 2026
Product: FoxNode ASPM is an open-source platform for managing application security vulnerabilities across a software portfolio.github.com · 2 Oct 2026
Scanner imports: It includes 16 built-in parsers and accepts scan results in JSON, CSV, XML, JSONL, and SARIF formats.github.com · 2 Oct 2026
Deduplication: Hash-based deduplication prevents duplicate findings across scans.github.com · 2 Oct 2026
Dashboards: The dashboard reports severity distribution, scanner breakdown, risk trends, and vulnerable products.github.com · 2 Oct 2026
Deployment and API: The project supports Docker Compose deployment and provides a REST API for CI/CD pipeline integration.github.com · 2 Oct 2026
Security analysis: Features include AI finding triage, attack-path analysis, an AI security agent, and AI remediation recommendations.github.com · 2 Oct 2026
Compliance mapping: Findings can be mapped to OWASP Top 10, PCI-DSS, SOC 2, CIS Benchmarks, and ISO 27001 with gap analysis.github.com · 2 Oct 2026
Supply chain: The SBOM feature provides component inventory, license tracking, and supply-chain risk scoring.github.com · 2 Oct 2026
AI and ML scanning: The LLM/AI scanner detects issues including prompt injection and data poisoning, mapped to the OWASP LLM Top 10.github.com · 2 Oct 2026
Requirements: The listed local-development prerequisites are Python 3.12+, Node.js 20+, PostgreSQL 16+, and Redis 7+.github.com · 2 Oct 2026