TopoTrace

TopoTrace is a self-hosted inventory and compliance platform for teams that need a current picture of the machines they manage. Lightweight agents collect hardware, software, operating system, configuration, disk, network, service, user, and security facts from hosts, then send those snapshots to a Go server. The server parses the reports into structured records, preserves changes, and serves both a browser dashboard and a REST API. That makes it useful when a spreadsheet or a collection of shell scripts can no longer answer basic fleet questions with confidence. Operators can see what exists, what has changed, which devices have stopped reporting, and where policy or vulnerability findings need attention.

The product is designed to run inside an organization’s own environment. A default installation can use an in-memory store that writes snapshots to JSON, while production deployments can use Postgres. The same server process handles ingestion, the API, and the embedded web interface, so a small trial doesn’t require a stack of separate services. Published container images are available for amd64 and arm64, and the repository includes Docker Compose, a Helm chart, and a systemd deployment path. Linux, Windows, and macOS collectors report through the same ingestion model. There are also paths for mobile reports, air-gapped imports, and cloud inventory from AWS, Azure, and Google Cloud, which helps teams bring less conventional assets into the same inventory.

The workspace turns those reports into operational views rather than leaving them as raw files. A Today view highlights fleet coverage, reporting gaps, open findings, recent discoveries, and the latest items that need attention. Teams can search evidence across the fleet, save device collections, compare systems, group hosts on a board, add tags, and inspect a host’s change history. A fleet summary rolls up stale hosts, platform distribution, posture, vulnerabilities, policy status, and audit activity. TopoTrace also records score history, so operators can look at trends instead of seeing only a current pass or fail state. Public status endpoints can expose aggregate health without revealing host names or individual findings.

Compliance and security work sit on top of the inventory. Teams can define policy rules, evaluate them on a schedule, track compliance frameworks, maintain software allow and deny lists, import findings from Nessus or Qualys exports, and correlate installed software with vulnerability data. Browser extension inventory can flag broad permissions, sideloading, old manifest versions, or entries on a deny list. Role-scoped API keys separate readonly, remediation, and administrative access, while the audit trail records privileged activity and can forward events to several SIEM styles. Optional webhooks report policy events. An optional question interface can answer natural-language questions from a compact fleet snapshot, and its model backend can point to Anthropic or an OpenAI-compatible service, including a model hosted by the operator.

TopoTrace fits infrastructure, security, platform, and IT teams that want the transparency of a self-hosted system and are comfortable operating it. It’s especially relevant for mixed fleets where asset records, compliance checks, vulnerability findings, and remediation history otherwise live in separate products. The agents and API make it possible to automate collection and connect the data to existing workflows, while the web dashboard gives less API-oriented teammates a usable view. The tradeoff is that this isn’t a hosted service that removes operational work. Someone still has to deploy the server, protect the ingestion and API endpoints, enroll agents, configure storage, and decide which policies are appropriate. Some backends and deployment paths are also described as experimental or require local validation.

The Community edition is open source under Apache 2.0, and the code, deployment files, documentation, and published container images are available publicly. There isn’t a metered hosted tier or a per-seat checkout presented as the main way to use it. Teams can start with the local Go process or a container, load the included synthetic fleet, and evaluate the dashboard before enrolling real systems. That access model is attractive for organizations that need to inspect the implementation, keep inventory data under their control, or work in restricted networks. It also means the real cost is operational time, particularly once a team adds Postgres, Kubernetes, identity integration, external vulnerability feeds, SIEM forwarding, or managed agent rollout.