Skip to content
Deepak Gupta markRecon Atlas

Recon frameworks

Osmedeus

Go workflow engine that runs security scans defined in YAML, with distributed workers, a web UI and a queryable asset database.

ActiveScope a pentestAudit your own exposure

6.6k stars · last push November 6, 2026 · v5.1.2 · MIT

GitHub repositoryOfficial docs

What it finds

Osmedeus is an orchestration engine: the scanning steps live in YAML workflows, installed from a preset or a Git repository. The reference workflow covers subdomain enumeration, DNS and HTTP probing, fingerprinting, screenshots, port scanning, content discovery and vulnerability scanning. It adds Redis-based distributed workers, cloud provisioning, scheduling, LLM agent steps and a REST API with web UI.

  • subdomains
  • live hosts
  • web technologies
  • screenshots
  • archived URLs
  • IP space
  • open ports
  • directories and content
  • vulnerabilities

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

The reference workflow (osmedeus/osmedeus-workflow README) runs DNS and HTTP probing, port scanning, content bruteforcing and vulnerability scanning; modules can be dropped with "osmedeus run -f general -t example.com -x portscan". No passive-only flow is documented.

API keys: Docs (Extra Configuration) show GitHub, Shodan, Censys, SecurityTrails and VirusTotal keys set under global_vars in osm-settings.yaml to improve scan quality.

Install

Install with package
npm install -g @j3ssie/osmedeus

From the project's documentation

Install with package
brew install osmedeus/tap/osmedeus

From the project's documentation

Install with docker
docker run --rm -v $(pwd)/output:/root/workspaces-osmedeus \
    j3ssie/osmedeus:latest run -f general -t example.com

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Install the default preset workflows
osmedeus install base --preset

From the project's documentation

Run the full general flow
osmedeus run -f general -t example.com

From the project's documentation

Skip the port scan module
osmedeus run -f general -t example.com -x portscan

From the project's documentation

Preview steps without running them
osmedeus run -f general -t example.com --dry-run

From the project's documentation

Output formats: json, sqlite, postgresql

Runs these tools under the hood: subfinder, findomain, assetfinder, amass, puredns, massdns, httpx, dnsx, nmap, nuclei, Vigolium, Semgrep, Trivy

Limits the project documents

  • Docs: "Osmedeus only supports Linux and macOS natively." Windows users need WSL or Docker.
  • README disclaimer: the engine is designed to execute arbitrary code and commands from user-supplied input, so third-party workflows should be reviewed before running.
  • The engine ships no scanning logic by itself; default workflows must be installed separately (osmedeus install base --preset).
  • Roadmap lists diff reports of new and removed assets between runs as not yet done.
  • Docs list webhook triggers via unauthenticated webhook URLs as a feature.

Deepak's take

Analysis, not documentation

Use it when
Use it when you want to codify your own recon pipeline in YAML and run it on schedules, across workers or on cloud VMs.
Skip it when
Skip it if you want a fixed tool you can run without writing or reviewing workflows; reconFTW or BBOT presets need less setup.
What it will miss
Coverage depends entirely on the installed workflows, so anything those YAML files do not call is never checked.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: MIT. Osmedeus is a trademark or project name of its owners; this library is not affiliated with it.