OpenSCM — Open Security Compliance Manager
A self-hosted, privacy-first security compliance platform built in Rust.
Unlike traditional compliance tools, OpenSCM agents execute tests locally and only report PASS, FAIL, or NA — your configuration files, user data, and system details never leave your network.
For full documentation, installation guides, and user manual visit openscm.io.
Documentation
To check out docs, visit openscm.io.
🚀 Key Features
- Privacy-First — agents report results only, no raw system data leaves your network
- Mutual Ed25519 Signing — every payload is cryptographically signed in both directions
- UI-Driven Policy Builder — define compliance tests visually, no scripting required
- Evidence-Grade Reports — archive compliance results as formal audit evidence (PDF)
- Universal Platform Support — Linux, Windows, FreeBSD and macOS on x86_64, ARM64 (including Windows on ARM), 32-bit ARM (ARMv6 and up, Raspberry Pi Zero included), i686, RISC-V, PowerPC64, s390x and LoongArch64
- Single Binary Deployment — server ships with all assets embedded, no setup required
- Scheduled Scanning — automate compliance scans on any schedule
- Role-Based Access Control — Administrator, Editor, Runner, Viewer
Supported Platforms
| Platform | Architecture | Server | Client | Package Format |
|---|
| Linux | x86_64 | ✅ | ✅ | deb, rpm, pkg.tar.zst |
| Linux | ARM64 (aarch64) | ✅ | ✅ | deb, rpm, pkg.tar.zst |
| Linux | 32-bit ARM, ARMv6 and up (armhf; Raspberry Pi Zero / 1 and newer) | ❌ | ✅ | deb, rpm, pkg.tar.zst |
| Linux | i686 (32-bit x86) | ❌ | ✅ | deb, rpm |
| Linux | RISC-V 64 | ❌ | ✅ | deb, rpm, pkg.tar.zst |
| Linux | PowerPC64LE | ❌ | ✅ | deb, rpm, pkg.tar.zst |
| Linux | s390x (IBM Z) | ❌ | ✅ | deb, rpm |
| Linux | LoongArch64 | ❌ | ✅ | deb, rpm |
| Windows | x86_64 | ✅ | ✅ | exe (NSIS) |
| Windows | ARM64 (Windows on ARM) | ✅ | ✅ | exe (NSIS) |
| macOS | Universal (ARM64 + x86_64) | ❌ | ✅ | pkg |
| FreeBSD | x86_64 | ❌ | ✅ |
⚡ Installation
Agent — one command
Run this on every machine you want to monitor. It detects the OS and CPU,
installs the right package, points the agent at your server and starts it:
curl -fsSL https://repo.openscm.io/install.sh | sh -s -- \
--server https://your-openscm-server
Debian, Ubuntu, RHEL, Fedora, CentOS, Rocky, Alma, openSUSE, Arch, FreeBSD and
macOS, on every architecture the repository publishes. Add --dry-run to see
what it would do first, or --help for all options.
The machine then appears in OpenSCM under Systems as pending — approve it
there and it starts receiving compliance tests.
On Windows, download the installer from
openscm.io/start/downloads and run
the setup wizard; the agent is registered as a Windows Service.
To remove the agent again:
curl -fsSL https://repo.openscm.io/install.sh | sh -s -- --uninstall
Add --purge to also drop its config, logs and the package repository.
Server
Ubuntu / Debian
curl -sS https://repo.openscm.io/openscm.gpg | sudo gpg --dearmor -o /usr/share/keyrings/openscm.gpg
echo "deb [signed-by=/usr/share/keyrings/openscm.gpg] https://repo.openscm.io/stable/debian stable main" | sudo tee /etc/apt/sources.list.d/openscm.list
sudo apt update
sudo apt install scmserver
RedHat / CentOS / Fedora
sudo tee /etc/yum.repos.d/openscm.repo <<EOF
[openscm]
name=OpenSCM Stable
baseurl=https://repo.openscm.io/stable/redhat/
enabled=1
gpgcheck=1
gpgkey=https://repo.openscm.io/openscm.gpg
EOF
sudo yum install scmserver
Windows installers and every other platform are on
openscm.io/start/downloads.
Then browse to the server and the first-run setup will create your admin
account. Full instructions, including manual and air-gapped agent installs, are
in the installation guide.
⚖️ Licensing
| Component | License |
|---|
| Server & Dashboard | FSL-1.1-ALv2 — converts to Apache 2.0 after 2 years |
| Client Agent | Apache 2.0 — no restrictions |
🤝 Contributing
- Fork the repository
- Create a feature branch (
git checkout -b feature/my-feature)
- Commit your changes (
git commit -m 'Add my feature')
- Push to the branch (
git push origin feature/my-feature)
- Open a Pull Request
For major changes please open an issue first to discuss what you'd like to change.
🔒 Security Disclosure
Please do not open public issues for security vulnerabilities.
Report them responsibly to [email protected] — we respond within 48 hours.
🛡️ Support
