Veltrix integrations are built in the open. Every app that plugs a security tool into the change pipeline is open source, and anyone can contribute one — with a public SDK, a CLI, an isolated sandbox to develop against, and a CI pipeline that publishes checksummed releases.
The Veltrix platform itself is now open source, too — self-host the full change pipeline for free with the Community Edition →
All integration apps live in a public Apache-2.0 repository — browse the source, file issues, and open pull requests.
captivatortechnologies/veltrix-apps →Typed pipeline-handler contracts, manifest types, and React hooks in @veltrixsecops/app-sdk; scaffolding, validation, packaging, and sandbox dev loops in @veltrixsecops/cli — both on npm with provenance attestation.
Want your security tool governed by the Veltrix pipeline? Vote on open app requests or file a new one — requests directly shape the roadmap.
Browse app requests →Run veltrix init <app-id> to generate the canonical app layout: a commented manifest.yaml, per-configuration-type folders with all six pipeline handlers, migrations, lifecycle hooks, and optional UI pages.
Apps ship native UI, too: declare pages, sidebar/tab navigation, and permission gating in the manifest — the platform renders the chrome (breadcrumbs, headers, loading and error states) while your app renders the body. Handlers receive everything through a typed context, including a tenant-scoped read-only platform data API; importing platform internals is rejected by CI.
veltrix dev --sandbox <name> watches your working directory and live-syncs it into an isolated tenant sandbox, where you can invoke individual handlers and stream logs.
Sandboxes are tenant-isolated, only target sandbox-tagged components, and never receive production credentials.
veltrix validate checks your app against the platform contract locally — the same validator CI runs. PRs are gated by manifest validation, TypeScript checks against the SDK, secret scanning, and an enforced semver bump.
Guardrails include a 50 MB package cap, no bundled executables, and namespaced routes and database tables per app.
On merge, CI compiles server handlers, packages the app, publishes an immutable per-app GitHub release with a SHA-256 checksum, and refreshes the public marketplace catalog automatically.
Once your app is published to the marketplace, tenants enable it from the platform UI.
Full developer documentation lives on this site:
96 apps are live today across SIEM, EDR, SOAR, IAM, Network, Cloud Security, Compliance, Endpoint Management, and Threat Intelligence — and the tool your team needs next could come from you.