Osmedeus
A Modern Orchestration Engine for Security
Last verified:
What is Osmedeus?
Osmedeus is a modern security orchestration engine and workflow engine for offensive security that automates security workflows using declarative YAML definitions. It allows security professionals to build their own reconnaissance system and run it on a large number of targets, handling everything from reconnaissance to vulnerability scanning to reporting in one place.
Key features include declarative YAML workflows for designing readable reconnaissance pipelines, flexible execution across local host/Docker/SSH or distributed via Redis workers, smart orchestration with conditions/events/scheduling/parallel execution, 80+ utility functions including nmap integration and SARIF parsing, LLM-powered agentic steps with tool-calling loops, REST API and beautiful web UI for visualization, cloud infrastructure provisioning across DigitalOcean/AWS/GCP/Linode/Azure, event-driven scheduling with cron and file-watch triggers, and SAST integration with Semgeom/Trivy/Kingfisher/Bearer.
Osmedeus is designed for security professionals, bug bounty hunters, penetration testers, and red teamers who need to automate reconnaissance methodology and vulnerability scanning at scale. It combines commonly used security tools like httpx, nuclei, and ffuf into one automated workflow system, making it suitable for both beginners and experts who want powerful composable automation without sacrificing infrastructure safety.
Osmedeus pricing
Pricing model: Freemium
Osmedeus is open source and free to use. Installation is available via curl install script, Homebrew tap, nightly build, or building from source on GitHub. The core engine is a standalone Golang binary that works on its own. External security tools like httpx, nuclei, and ffuf must be installed separately for YAML workflows to function properly. No paid tiers or subscription plans are mentioned on the website.
Osmedeus pros
- Declarative YAML workflows are readable and auditable
- Supports multiple execution environments: host, Docker, SSH
- Distributed scanning with Redis master-worker pattern
- 80+ utility functions including nmap and SARIF parsing
- Built-in LLM integration with agentic tool-calling loops
- Beautiful modern web UI for workflow visualization
- REST API for programmatic workflow management
- Event-driven scheduling with cron and file-watch triggers
- Cloud infrastructure provisioning across 5 major providers
- SAST integration with Semgrep, Trivy, Kingfisher, Bearer
- Automatic CDN/WAF classification from httpx data
- TypeScript execution via Bun runtime
- Tmux session management for background processes
- Webhook triggers for unauthenticated workflow runs
- Module exclusion by exact name or fuzzy substring matching
- Pre/post scan hooks for setup and cleanup steps
- Snapshot export/import for workspace sharing
Osmedeus cons
- No native proxy support, proxychains makes it extremely slow
- Requires external binary installation for many workflows
- Only supports Linux and macOS natively, not Windows
- Heavy network traffic recommends cloud VM for best performance
- LLM integration incurs additional API costs
- Scans can get stuck on sudo password prompts for tools like nmap
- Vulnerability scanning may not work on intentionally vulnerable apps
- Large targets with thousands of hosts take very long to scan
Frequently asked questions about Osmedeus
What is Osmedeus?
Osmedeus is a workflow engine for security automation. It executes YAML-defined workflows with support for multiple execution environments (host, Docker, SSH), scheduling, and distributed scanning.
What are the system requirements?
The Osmedeus core engine is lightweight and can run anywhere with almost any specs. However, for reconnaissance (the main use case), it is recommended to use a modern Linux, macOS, or Windows system with WSL. Since running reconnaissance generates heavy network traffic, it is also recommended to run Osmedeus in a cloud environment such as a VM, Compute Engine, or EC2 for best performance.
Does Osmedeus support AI/LLM integration?
Yes, Osmedeus has built-in support for LLMs and you can use it in your workflow to generate recon reports, write custom scripts, or build your own agentic workflow. Using LLMs may require API keys for the LLM provider and may incur additional costs based on usage. As an orchestration framework, you can leverage it to coordinate custom AI/LLM tools including Claude Code or OpenCode directly within YAML workflows.
Why do I need to install external binary?
Osmedeus is a standalone Golang binary and works perfectly fine on its own. However, when using Osmedeus to run YAML workflows for security automation, it often needs to call external tools like httpx, nuclei, ffuf, etc. These tools must be installed and available on your system for those workflows to function properly.
How do I run a basic scan?
Run a flow workflow with: osmedeus run -f general -t example.com, or run a module workflow with: osmedeus run -m vulnerability-scan -t example.com
What is the difference between a flow and a module?
Module: A single workflow unit containing steps that execute sequentially. Flow: Orchestrates multiple modules, allowing parallel execution and dependencies between modules.
What runners are available?
Three runners are available: host (execute on local machine, default), docker (execute in Docker containers), and ssh (execute on remote machines via SSH).
How do I set up distributed scanning?
Start the master with: osmedeus server --master. Then join workers with: osmedeus worker join --master http://master:8002
Where are scan results stored?
Results are stored in workspaces at ~/workspaces-osmedeus/<target>/