Reconmap is an open-source, collaboration-first security operations platform that uses AI to plan, run, triage and report penetration tests and vulnerability scans for authorized teams.
| Tool | reconmap/reconmap — AI-powered vulnerability scanning and reporting platform for teams running many engagements |
| Category | Security operations / engagement management platform |
| Primary Use | Centralizing authorized penetration tests and scans: AI-driven scan planning, command execution via reconmapd runners, automated finding triage, and exportable reporting for Word, Markdown and HTML |
| Safe Use | Designed for authorized assessments, in-house security teams, labs and MSSPs operating under client contracts and defined rules of engagement |
| Telemetry Note | Because runners execute commands from your own catalog against scoped targets, activity appears in target-side logs exactly like the underlying tools (Nmap, Subfinder, Testssl); defenders should expect scan traffic consistent with the cataloged commands and parsers used |
Reconmap positions itself as a collaboration-first security operations platform aimed at infosec teams and managed security service providers running many engagements in parallel. The tagline in the README is blunt about the ambition: AI-powered vulnerability scanning and reporting, where you give it a target and it plans the scan, runs the tools, triages the findings and writes the report. That is a much broader mandate than a single-purpose scanner — it is effectively an engagement lifecycle manager that folds planning, execution, analysis and deliverable generation into one system, with roughly 982 stars on GitHub and an Apache-2.0 license behind it.
The core workflow starts with a target, which can be a URL, domain, IP or repository. From there the AI layer picks tools from your own command catalog, orders them and queues the run. This catalog-driven design is worth pausing on: Reconmap does not ship a fixed scanning stack so much as orchestrate whatever commands your team has already defined and trusted. That keeps the human in charge of what actually gets executed, while the platform handles sequencing, state and bookkeeping — a sensible split for professional work where scope discipline matters.
Execution happens through reconmapd, a Go-based runner component that executes commands on your own machines and ships output back to the central platform. This distributed runner model is what makes the tool viable for teams with multiple workstations or remote execution environments rather than a single laptop. A companion Go CLI called rmap rounds out the client tooling, giving operators scripted access alongside the web dashboard.
Output parsing is where many orchestration platforms fall over, and the README addresses it directly. There are built-in parsers for standard formats and tools — SARIF, CycloneDX, Nmap, Testssl, Subfinder and more — which covers a large slice of typical recon and scanning output. Anything that does not match a built-in parser falls through to an LLM parser, meaning unstructured tool output can still be normalized into findings. For teams with a heterogeneous toolbag, that fallback is arguably the most practically valuable AI feature in the product.
The triage pipeline is the other AI-heavy stage. Every new finding receives a severity check, an exploitability assessment, affected-surface analysis, suggested next steps and a false-positive evaluation. This is exactly the mechanical work that burns junior consultant hours on real engagements, and automating a first-pass triage — with a human reviewing the result — is a defensible productivity claim. The platform also generates remediation steps per vulnerability and can suggest follow-up commands per asset, which feeds directly into report authoring.
Reporting supports export to Word, Markdown or HTML, covering the formats clients typically demand. Combined with the fact that every engagement lives in one place, this is the collaboration pitch: findings, commands, assets and reports accumulate in a shared workspace instead of scattered directories and spreadsheets. Multi-project, multi-person operation is explicitly supported, with SSO through Keycloak handling identity — a signal that the project is targeting organizational adoption rather than solo hobbyist use.
The model layer is refreshingly flexible. Reconmap supports Ollama for fully local inference, alongside Azure OpenAI, OpenRouter and other OpenAI-compatible endpoints. The local option matters for consultancy contexts where sending client-adjacent finding data to a third-party API is a contractual or compliance problem, and the README points to dedicated documentation on AI features and data handling for teams that need to reason about exactly what leaves the perimeter.
Architecturally the README includes a refreshingly concrete component table. The dashboard is React under src/dashboard, the API is C# / .NET 10 under src/server, the reconmapd runner is Go under src/runner, and the rmap CLI is Go under src/cli. Persistence is PostgreSQL, caching is Redis, and authentication is Keycloak. That is a polyglot but conventional microservice-friendly stack, and the split between API, runner and CLI shows deliberate separation between control plane and execution plane.
There is also an MCP server, which lets an external AI assistant query and drive Reconmap. In practice this means an operator working in an agentic assistant can pull engagement state or trigger workflows without switching contexts. It is a forward-looking integration point, and it also raises the usual governance questions about which actions an assistant should be allowed to initiate — something teams deploying it should scope deliberately.
Deployment is a straightforward Docker Compose affair: docker compose up -d, then the dashboard is reachable at http://localhost:5500. There is a hosted offering at netfoe.com and a live demo for evaluation without installing anything, which lowers the barrier for a team kicking the tires before committing engineering time to self-hosting. For most authorized-assessment contexts, the self-hosted route is the one that keeps engagement data under the operator's control.
From a defensive telemetry standpoint, it is important to understand that Reconmap is an orchestrator, not a novel scanner. Whatever it launches against a target — Nmap, Subfinder, Testssl, or cataloged custom commands — shows up in target-side logs as that tool. Blue teams should therefore focus detection on the underlying tool signatures and scan patterns rather than looking for Reconmap itself, while purple teams can use the platform's centralized command history as a clean record of what was run, when and by whom.
For authorized penetration testing teams, bug bounty operations and MSSPs, Reconmap is best read as an engagement backbone: it does not replace your tools or your judgment, but it compresses the coordination overhead between them. The combination of a command catalog you control, distributed Go runners, structured parsing with an LLM fallback, automated first-pass triage and multi-format reporting covers most of the operational plumbing of a busy assessment practice, under an Apache-2.0 license with commercial hosting available if self-managing Docker, PostgreSQL and Keycloak is not your team's idea of a good time.
reconmap/reconmap.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.