JMo Security Audit Tool Suite
A terminal-first security audit toolkit that orchestrates 13 scanners across code repositories, container images, infrastructure-as-code, web apps and Kubernetes, with unified reporting.
JMo Security is an automated security audit framework that orchestrates 13 industry-standard scanners under one CLI to cover secrets, SAST, SBOM, SCA, IaC and DAST checks across six target types: repositories, container images, infrastructure-as-code files, URLs, GitLab repos and Kubernetes clusters. Findings from different tools that describe the same issue are deduplicated into one consensus result.
Output is exported as JSON, SARIF, Markdown or CSV, alongside a dual-mode interactive HTML dashboard. A SQLite store keeps historical scan results so security posture can be tracked over time, with machine-readable diffs between scans and Mann-Kendall trend analysis; policy-as-code checks run through OPA, and mappings are provided against six compliance frameworks including OWASP, CWE, NIST, PCI DSS, CIS and MITRE. It also supports SLSA attestation for supply-chain compliance and can suggest remediation through an MCP integration with Copilot or Claude.
It runs from a Docker image and is written in Python.