Faraday is an open-source vulnerability management platform that aggregates and normalizes security scanner output into a single multiuser workspace, built for security analysts, AppSec teams, and DevOps engineers who need to track findings through to remediation.

What it is

Faraday is a Python application, released under GPL-3.0, that collects the output of community security scanners and turns it into organized, explorable vulnerability data. The README frames security around two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. Faraday targets the second task, letting teams focus on discovery while the platform handles aggregation, normalization, and tracking. It lives in the application security and DevSecOps ecosystem, and it works with the tools teams already run rather than asking them to abandon them.

The concrete problem Faraday solves is the manual, disconnected handling of scanner results. Instead of reading each scanner's report in isolation and tracking findings by hand, teams load results into Faraday, which normalizes them and exposes them through visualizations meant for both managers and analysts. The README describes the goal as taking advantage of the available community tools "in a truly multiuser way." Faraday replaces the ad hoc, single-user consolidation of vulnerability findings with a shared platform where scanning output becomes structured, comparable data.

Key capabilities

• Aggregates and normalizes data loaded from community scanners, with Burp Suite, Nessus, and Nmap named in the topic list and Bandit, OWASP ZAP, and SonarQube referenced in the CI/CD integration guides.
• Provides a multiuser workspace where findings are explored through different visualizations useful to managers and analysts alike, shown in the manage and dashboard documentation images.
• Ships faraday-cli, a command line client installed with pip3 install faraday-cli, that provides access to console tools, supports scan automation, CI/CD integration, and retrieval of metrics from a workspace.
• Supports several deployment paths: a docker-compose.yaml, the Docker image faradaysec/faraday:latest, the PyPI package faradaysec, Debian and RPM binary packages, and a source install.
• Uses faraday-manage initdb to initialize the database and faraday-server to start the server, which is reachable on port 5985 with a default faraday username.
• Carries topic tags for continuous scanning, CVE tracking, AppSec, DevSecOps, and orchestration, reflecting its role in ongoing security workflows.

Who uses it and how

• Multiuser security teams, where managers and analysts share a single workspace rather than separate scanner reports.
• CI/CD pipelines, with documented integrations for GitHub, Jenkins, TravisCI, and GitLab, and pipelines covering Bandit, OWASP ZAP, and SonarQube.
• Command-line users who drive scans, automation, and workspace metrics through faraday-cli instead of the web interface.
• DevOps and DevSecOps groups that need findings from Nmap, Nessus, Burp Suite, and similar tools consolidated in one place.

Getting started

The README recommends the docker-compose path as the easiest: download docker-compose.yaml from the repository and run docker-compose up. Alternatives include the faradaysec/faraday:latest Docker image, pip3 install faradaysec followed by faraday-manage initdb and faraday-server, or the Debian and RPM binary packages.

How it compares

The provided facts name no competing product that Faraday replaces; the tools named, such as Nmap, Nessus, Burp Suite, OWASP ZAP, Bandit, and SonarQube, are scanners whose output Faraday consumes rather than rivals. On that basis, Faraday stands alone in this registry, positioned above the scanning tools it aggregates rather than alongside them.

When to use it — and when not to

A self-hoster must run a PostgreSQL database for the Docker deployment path and operate the Faraday server on port 5985, so some infrastructure work is involved. Teams that want a fully managed or hosted service should look elsewhere, since the facts describe only self-hosted install methods. The platform is a strong fit for organizations already running multiple scanners that need shared, normalized findings; it is a poorer fit for a single analyst who wants a hosted tool with no database to operate.

$ wget https://raw.githubusercontent.com/infobyte/faraday/master/docker-compose.yaml
$ docker-compose up

 $ docker run \
     -v $HOME/.faraday:/home/faraday/.faraday \
     -p 5985:5985 \
     -e PGSQL_USER='postgres_user' \
     -e PGSQL_HOST='postgres_ip' \
     -e PGSQL_PASSWD='postgres_password' \
     -e PGSQL_DBNAME='postgres_db_name' \
     faradaysec/faraday:latest

$ pip3 install faradaysec
$ faraday-manage initdb
$ faraday-server

$ sudo apt install faraday-server_amd64.deb
# Add your user to the faraday group
$ faraday-manage initdb
$ sudo systemctl start faraday-server

$ pip3 install virtualenv
$ virtualenv faraday_venv
$ source faraday_venv/bin/activate
$ git clone [email protected]:infobyte/faraday.git
$ pip3 install .
$ faraday-manage initdb
$ faraday-server

$ pip3 install faraday-cli

$ faraday-cli tool run \"nmap www.exampledomain.com\"
💻 Processing Nmap command
Starting Nmap 7.80 ( https://nmap.org ) at 2021-02-22 14:13 -03
Nmap scan report for www.exampledomain.com (10.196.205.130)
Host is up (0.17s latency).
rDNS record for 10.196.205.130: 10.196.205.130.bc.example.com
Not shown: 996 filtered ports
PORT     STATE  SERVICE
80/tcp   open   http
443/tcp  open   https
2222/tcp open   EtherNetIP-1
3306/tcp closed mysql
Nmap done: 1 IP address (1 host up) scanned in 11.12 seconds
⬆ Sending data to workspace: test
✔ Done

faraday-cli tool report burp.xml