TopoTrace

TopoTrace is an open-source system for collecting hardware, software, and configuration facts from a managed fleet, then turning those reports into searchable inventory and compliance evidence. Lightweight agents send snapshots from hosts to a Go server, which parses the raw data into a shared model that can be explored through a web dashboard or REST API. It is designed for infrastructure and security teams that need to answer practical questions about what they operate, which systems have stopped reporting, what changed, and where risk needs attention. The Community edition is self-hosted, so the organization running it controls the server, storage, credentials, and the inventory data produced by its endpoints.

The collection pipeline supports Linux, Windows, and macOS agents, along with additional reporting paths for mobile, ChromeOS, air-gapped systems, cloud inventory, and discovered network assets. A framed TCP ingest service receives compressed snapshots, while platform-specific parsers turn commands and system files into structured facts. TopoTrace can start with an in-memory store that saves a JSON snapshot, or use PostgreSQL for a durable deployment. The default dashboard and API are served by the same application. Operators can run it from a Go toolchain, a container image, Docker Compose, a standalone systemd deployment, or the supplied Helm chart, depending on the environment they already maintain.

The web workspace is organized around fleet operations rather than a static asset table. A Today view summarizes coverage, reporting gaps, open findings, discoveries, and recent items that need attention. Search can match host metadata, IP addresses, installed software, reported facts, current findings, and documentation while respecting the caller's scope. Saved collections keep selected devices together for investigation or reporting, dynamic groups handle rule-based membership, and comparison shows differences between two current device records. An inbox brings together findings, stale agents, new discoveries, and failed or uncertain deployment jobs. Host pages preserve change history so a team can move from a fleet-wide signal back to its underlying evidence.

Compliance and risk features sit on top of that inventory. TopoTrace can calculate host posture from observable signals, evaluate group-scoped policies, track known vulnerabilities against installed software, record configuration baselines, and show drift from an approved state. Software allow and deny lists, lifecycle checks, certificate expiry, browser extension risk, imported scanner findings, and compliance framework checks broaden the evidence available to reviewers. Role-based access separates readonly, remediation, and administrative actions, and named API keys can be scoped to a fleet group. Audit records, outbound webhooks, metrics, CSV exports, an executive summary, and a public aggregate status page give teams several ways to connect the system to an existing security and reporting process.

TopoTrace is a good fit for technical teams that are comfortable operating their own infrastructure and want an auditable alternative to a hosted asset database. The server can expose its REST API to internal tools, while the dashboard gives operators a more immediate view of stale systems, risk scores, policy results, and recent changes. It also offers an optional natural-language question surface with Anthropic or an OpenAI-compatible backend. A locally hosted model can keep fleet context inside the operator's network, while every question and response is recorded in the audit trail. That AI feature is optional, and the inventory, search, compliance, reports, and APIs remain useful without configuring a model provider.

The project is available under the Apache 2.0 license and doesn't publish a paid requirement for the Community edition. The cost is therefore mainly the infrastructure and staff time needed to deploy it, enroll hosts, protect credentials, review policies, and maintain the service. Its breadth also comes with signs of a young product. The official repository notes that some newer fact categories still use generic dashboard layouts, several cluster and platform paths have more testing than others, and some advanced integrations need an operator to validate them in the target environment. For teams that accept that operational ownership, TopoTrace offers an unusually broad inventory, compliance, and reporting stack in one inspectable self-hosted codebase.