TPT Security Platform

An open-source security assessment and compliance audit platform. Scan targets, audit your infrastructure via APIs, browse results in the built-in web UI, and generate HTML/PDF/JSON reports mapped to SOC 2, ISO 27001, and HIPAA controls.

# Start the web UI + API server
tpt serve

# Run a scan (web UI updates live)
tpt scan example.com --framework soc2,iso27001

# Audit your AWS account
tpt audit --provider aws --framework soc2,hipaa

# Generate a shareable PDF report
tpt report <job-id> --format html,pdf

Web UI

tpt serve starts a browser dashboard at http://localhost:4242 — dark-mode, no build step required.

| Dashboard | Job detail | Finding detail | |-----------|-----------|----------------| | All scan/audit jobs, open finding counts, framework coverage | Severity breakdown, filter by status, full findings table | Expandable evidence, remediation advice, compliance controls, inline status update |

The web UI uses HTMX for live updates (finding details expand inline, status changes save immediately) with Tailwind CSS + DaisyUI for styling.

Features

Scanning (tpt scan)

Nuclei (embedded SDK) — template-based vulnerability detection
Naabu — port scanning with compliance-aware severity
OWASP ZAP — web app scanning via REST API (--zap-url)
TLS inspector — cert expiry, weak ciphers, legacy protocol detection (--scope tls)
Email security — SPF, DKIM, DMARC DNS checks (--scope email)
Gitleaks — hardcoded secrets in source trees (--secrets-dir)
govulncheck / osv-scanner — dependency CVEs (--deps-dir)
Dalfox — active XSS and open redirect detection

File import (tpt import)

Nessus (.nessus), Burp Suite XML, OpenVAS/GVM XML

Internal audit (tpt audit)

| Category | Providers | |----------|-----------| | Cloud | AWS · GCP · Azure · DigitalOcean · Hetzner · Cloudflare · Vercel · Supabase · Wasabi · Backblaze | | Identity | Okta · Azure AD / Entra · Google Workspace · Auth0 · Keycloak · Active Directory / LDAP | | VCS | GitHub · GitLab · Bitbucket · Gitea / Forgejo | | Infrastructure | Linux (SSH) · Kubernetes |

Compliance frameworks

SOC 2 Type II (Trust Services Criteria)
ISO/IEC 27001:2022 (Annex A)
HIPAA Security Rule (45 CFR §164.308 / §164.312)

Reporting (tpt report)

HTML — self-contained, executive summary + control coverage matrix + findings detail
PDF — go-pdf/fpdf, severity grid, tables
JSON — machine-readable for compliance platform integrations
AI-enhanced remediation advice (Anthropic / OpenAI / Grok / OpenRouter) with static fallback

REST API (tpt serve)

GET /api/jobs · GET /api/jobs/{id}/findings · GET /api/jobs/{id}/report
PATCH /api/findings/{id}/status — retest tracking

Installation

From source

git clone https://github.com/tpt-security/tpt.git
cd tpt
go build -o tpt ./cmd/tpt
./tpt --help

Requires Go 1.22+. No CGO — builds on all platforms.

Docker

docker compose up -d
# API available at http://localhost:4242

Quick start

# Scan a target and map to SOC 2 + ISO 27001
tpt scan example.com --framework soc2,iso27001 --scope web,network,tls

# Import an existing Nessus export
tpt import scan.nessus --framework soc2 --target "Internal network Q1"

# Audit your AWS account
tpt audit --provider aws --aws-profile prod --framework soc2,hipaa

# Audit a self-hosted Keycloak instance
tpt audit --provider keycloak \
  --keycloak-url http://keycloak.internal:8080 \
  --keycloak-realm master \
  --keycloak-token <admin-token>

# Audit Linux server over SSH
tpt audit --provider linux \
  --linux-host 10.0.0.5:22 \
  --linux-user ubuntu \
  --linux-key ~/.ssh/id_rsa \
  --framework iso27001

# Generate reports (HTML + PDF, with AI enhancement if key is set)
tpt report <job-id> --format html,pdf --output reports/

# Start the REST API server
tpt serve --port 4242

AI-enhanced reports

Set any of the following environment variables to enable AI-generated executive summaries and per-finding remediation advice:

export ANTHROPIC_API_KEY=sk-ant-...   # Claude Haiku (recommended)
export OPENAI_API_KEY=sk-...          # GPT-4o mini
export GROK_API_KEY=...               # Grok 3 mini
export OPENROUTER_API_KEY=...         # Any model via OpenRouter

Use --no-ai to disable even when a key is set. Static remediation templates are always used as a fallback.

Supported scan scopes

| Flag value | What it activates | |------------|-------------------| | network | Naabu port scan + TLS inspector | | web | Nuclei + Dalfox | | api | Nuclei + Dalfox | | tls | TLS inspector only | | email | SPF / DKIM / DMARC check |

Nuclei templates

Compliance-focused templates ship with the platform in templates/:

| Template | Framework | What it detects | |----------|-----------|-----------------| | soc2/cc6.1-access-controls.yaml | SOC 2 | Access control misconfigurations | | soc2/cc6.3-broken-auth.yaml | SOC 2 | JWT none-alg, insecure session cookies | | soc2/cc6.6-cors-misconfig.yaml | SOC 2 | Wildcard / reflective CORS | | soc2/cc6.7-crypto-transmission.yaml | SOC 2 | Weak TLS, missing HSTS | | soc2/cc7.1-vulnerability-detection.yaml | SOC 2 | Vulnerability scanning indicators | | soc2/cc9.2-api-exposure.yaml | SOC 2 | Swagger, GraphQL introspection | | iso27001/a.5.17-auth-weakness.yaml | ISO 27001 | Default credentials, HTTP Basic | | iso27001/a.8.8-technical-vulnerabilities.yaml | ISO 27001 | CVE detection | | iso27001/a.8.9-configuration-management.yaml | ISO 27001 | Misconfiguration detection | | iso27001/a.8.20-network-exposure.yaml | ISO 27001 | Exposed MongoDB, Redis, Elasticsearch | | iso27001/a.8.24-cryptography.yaml | ISO 27001 | Crypto weakness | | iso27001/a.8.25-ssdlc.yaml | ISO 27001 | Debug endpoints, stack traces, .env | | iso27001/a.8.29-injection.yaml | ISO 27001 | SQLi indicators, SSTI |

Point --template-dir at any Nuclei templates directory to use your own.

Adding custom control mappings

Control mappings live in mappings/ as plain YAML files. The filename (minus .yaml) becomes the framework name. Add a new file to support any custom framework:

# mappings/pci-dss.yaml
- category: web
  severity: [critical, high]
  controls:
    - id: "6.4"
      name: Protect web-facing applications against known attacks
      relevance: direct

Then use it with --framework pci-dss.

Architecture

cmd/tpt/           CLI entry point (cobra)
internal/
  scan/            Scanner adapters (Nuclei, Naabu, ZAP, TLS, email, secrets, deps, Dalfox)
  audit/           Internal audit providers
    cloud/         AWS, GCP, Azure, DO, Hetzner, Cloudflare, Vercel, Supabase, Wasabi, Backblaze
    idp/           Okta, Azure AD, Google Workspace, Auth0, Keycloak, LDAP
    vcs/           GitHub, GitLab, Bitbucket, Gitea
    infra/         Linux SSH, Kubernetes
  importer/        File importers (.nessus, Burp XML, OpenVAS XML)
  mapping/         YAML-based control mapping engine
  report/          HTML, JSON, PDF report generators + methodology statement
  remediation/     Static remediation template library
  ai/              LLM client (Anthropic, OpenAI, Grok, OpenRouter)
  api/             REST API server (stdlib net/http)
  web/             Web UI — HTMX + Tailwind + DaisyUI, server-rendered templates
  db/              SQLite storage (GORM, no CGO)
mappings/          soc2.yaml · iso27001.yaml · hipaa.yaml
templates/         Nuclei templates (soc2/ · iso27001/)

Documentation

| Doc | Contents | |-----|---------| | docs/architecture.md | System design, component diagram, data flow, extension points | | docs/deployment.md | Binary, Docker, Docker Compose, systemd service, nginx, CI/CD | | docs/configuration.md | All CLI flags for every command, API endpoints | | docs/frameworks.md | SOC 2, ISO 27001, HIPAA control mapping reference, custom framework YAML format |

Contributing

See CONTRIBUTING.md.

License

MIT — see LICENSE.

tpt-security-test

Languages