Skip to main content
Tools are the extensible scanning framework of OASM. A tool performs one discrete security action — subdomain discovery, URL discovery, website probing, port scanning, vulnerability scanning, or screenshots — and is executed by workers as part of a job. OASM ships with two kinds of tools:
  • Built-in tools — packaged inside the worker itself. They are available to every workspace automatically and cannot be removed.
  • Connectors — an external security tool packaged as a self-contained container image. When a job uses a connector, the worker starts the container for the run and the connector streams its findings back. Connectors add scanners the platform does not bundle — for example port scanners and third-party vulnerability scanners — without changing the platform.
A connector here means a scanning-tool container. It is unrelated to the integrations that connect Slack, Telegram, or Cloudflare to your workspace.

​
Key concepts

​
Categories

Each tool belongs to a category that describes the kind of security action it performs. The category decides what a run adds to your inventory.

​
How a connector runs

Connectors are executed by workers, which act as container supervisors:
  1. The platform resolves the connector’s container image and the configuration to use, then hands the run to a worker.
  2. The worker pulls the image (if not already cached) and starts the container.
  3. The container dials back to the worker over a private connection — it never opens an inbound port — registers, and receives the job.
  4. The connector runs the scan and streams findings back to the worker, which merges them into your workspace inventory.
  5. When the run finishes, the outcome is recorded in the job registry.
After a run the worker may keep the container warm and reuse it for the next job of the same connector, so image pulls and start-up are paid once. See Worker for the runtime details.

​
Browse the catalog

1

Open the Tools page

In the console sidebar, open Tools (under the Management section).
2

Choose a tab

The page has three tabs: All shows every tool, Built-in shows the tools that ship with OASM, and Connector shows the connectors published to the platform.
3

Filter the list

Use the Search tools… box to find a tool by name, and the category dropdown to narrow the list to a single category.
4

Open a tool

Select a card to open its detail page. Built-in tools are always ready; connectors show their metadata and, once added, a Configuration tab.
Each card shows the tool’s category and, for connectors authored by OASM, an official badge. The Added or Built-in state appears as the action button on the tool’s detail page.

​
Connector detail page

Open a connector to see everything the platform knows about it:
  • Overview — the connector’s Version, Author, Image, and links to its Homepage, Repository, and Support page. Connectors authored by OASM carry an official-support badge, and the pricing tier (for example Free or Paid) is shown as a badge.
  • Configuration — the connector’s configuration profiles. This tab appears only after the connector is added to the workspace.

​
Add and configure a connector

The connector catalog is shared across the platform, but you make a connector usable one workspace at a time. Adding it makes it visible in that workspace’s scans; a connector that needs settings is not ready until you also give it a configuration profile. The whole sequence runs from the connector’s detail page.
1

Select the target workspace

Choose the workspace in the workspace menu at the top of the sidebar. The Tools page — and its Add action — always apply to the selected workspace.
2

Open the connector and Add it

Go to Tools in the sidebar (under Management), switch to the Connector tab, and open the connector you want. Click Add. Adding a connector has no confirmation dialog. The button changes to Added and the Configuration tab appears on the detail page.
3

Open the Configuration tab

Select Configuration. If the connector declares no configuration schema, it is already ready and you can skip the next two steps.
4

Create a profile

Click Config, enter a Profile name, and fill in the settings. Click Use default presets to pre-fill the connector’s recommended values, then adjust what you need. The form is generated from the connector’s published configuration schema.
5

Confirm the connector is ready

Click Create. The connector now has a profile and can be used in a scan.
Most connectors need settings before they can run — a scanner’s endpoint, an API key, or scan thresholds. You supply them as a configuration profile: a named bundle of values stored in the workspace. You can keep several profiles for one connector (for example, one per environment) and choose which profile a scan uses.
To remove a connector from a workspace, click the Added button and confirm the Remove Tool dialog. Removing a connector also deletes its configuration profiles in that workspace. Built-in tools cannot be removed.

​
Manage profiles

From the Configuration tab you can:
  • Set Default — mark one profile as the default. Scans that don’t choose a profile use the default.
  • Edit — click the gear icon, change the name or values, and update.
  • Delete — click the trash icon and confirm. A profile that is referenced by a job or a workflow cannot be deleted until you detach it.
The first profile you create becomes the default automatically. Additional profiles are never default unless you set them to be.
Configuration fields the schema marks as sensitive — API keys, tokens, passwords — are encrypted at rest and displayed masked (for example apiKey: ****1234). When editing, leave a masked field untouched to keep the stored secret, or type a new value to replace it. Only the workspace can decrypt a value, and values are never written to job logs.
Some connectors have no configuration schema. For those, the form shows a message that the tool doesn’t require configuration, and the connector is ready as soon as it is added. You can still create an empty profile if you want one as the default.

​
Use a connector in a scan

Connectors appear alongside built-in tools wherever you choose the tools for a scan — in an asset group’s scanning pipeline or in a workflow. For each connector in the pipeline you can:
  • Use a configuration profile — pick one from the dropdown. Choosing No profile (use defaults) falls back to the connector’s default profile.
  • Set an inline configuration — supply or override values for that scan only, without saving a profile.
Tools run in the order shown in the pipeline.
A connector that needs configuration is blocked in the pipeline until it has a default profile, a selected profile, or an inline configuration. Hovering the blocked connector shows a prompt to configure it first.

​
Troubleshooting

The connector is added but not ready — it needs a configuration profile. Open its Configuration tab, click Config, and create one, then add it to the scan again.
The profile is referenced by a job or a workflow. Detach it from those scans first, or set a different default, then delete it.
This is by design: sensitive values are masked after saving. Leave the masked value to keep the stored secret, or enter a new value to replace it.
Connector jobs need a worker with access to a container runtime. Check that a worker is connected on the Workers page, then review the worker logs — most connector failures are an unreachable image registry or a container that could not start. See Worker and Jobs.

​
Best practices

  • Add only the connectors you will use. Each added connector adds execution surface and potential findings to process.
  • Configure with profiles, not inline values, for anything you reuse. Profiles keep credentials out of individual scans and make configuration auditable.
  • Name profiles after their scope — production, staging, internal — so a run’s configuration is obvious at a glance.
  • Keep credentials rotated. Treat connector API keys like the workspace API key: rotate them on a schedule and after personnel changes.
  • Prefer the default profile over inline overrides. Inline configuration is best reserved for one-off experiments.

Worker

How workers run built-in tools and connector containers

Jobs

Watch connector runs move from waiting to finished

Targets

Define the scan targets that connectors run against

Assets

See the assets and services that tool findings feed