Osmedeus

Osmedeus is built around a single, unusually clear idea: a security pipeline should be a file you can read, diff, and version. You write a workflow.yaml with a kind and a name, declare params with defaults (the homepage example uses threads defaulting to "5" and mode defaulting to "full"), then wire modules together with depends_on, condition, and on_success actions. That last part matters more than it sounds. In the demo flow on the site, a docker-module depends on bash-module and only runs when mode == 'full'; when it succeeds it exports scan_status as "complete"; a switch then routes on that value to ssh-module or jumps to _end. That is real control flow — conditional execution, dependency ordering, and decision routing — not a shell script with a scheduler bolted on. The execution layer is where Osmedeus separates itself from single-purpose scanners. The same definition runs locally, inside Docker, over SSH, or distributed across Redis workers. One target or a hundred, the workflow file doesn't change; only the runner does. The homepage illustrates the fan-out pattern concretely: one target, four modules (subdomain probing, portscan, vuln-scan, and the surrounding chain), one workspace. For a bug bounty hunter with a wide scope, that is the whole value proposition in a diagram. Where it fits: teams already comfortable in the terminal who keep re-running the same recon-to-scan chain and want it reproducible. The web UI is a visualisation surface for workflows, assets, and execution state — you inspect results there, you don't author in it. Asset management and export flows mean findings can leave Osmedeus and land in whatever stack owns your reporting, rather than becoming yet another island. Where it doesn't fit: anyone who wants a template library they can point at a domain and forget. Osmedeus gives you templates, utilities, plugins, and HTTP steps as building blocks, but assembling them into a pipeline is your job, and that means writing YAML. The distributed modes are also not self-configuring — Docker, SSH, and Redis infrastructure are yours to stand up and maintain. It's community-supported open source; the GitHub repo shows 6.2k stars, and the project is backed by the claim of finding real vulnerabilities at Fortune 500 companies, but there is no vendor SLA behind it. Compared with Nuclei, Osmedeus is a layer above rather than a competitor — Nuclei is a scanner you'd invoke as a module inside an Osmedeus workflow. Compared with Burp Suite, the split is even cleaner: Burp is interactive and human-driven, Osmedeus is automated and declarative. The interesting middle ground is its built-in AI agents and LLM-powered actions, which let a run make decisions partway through instead of following a fixed script. Treat that as a capability to evaluate against your own threat model, not a substitute for understanding every step your pipeline takes. The v5.0 release in January 2026 reset the architecture with what the project describes as