Documentation
Veltrix runs two ways: a hosted SaaS (nothing to install — app.veltrixsecops.com) and a free, self-hostable open-source Community Edition (Apache-2.0). Either way, you work with it through the web app, the CLI for app developers, the App SDK for building integrations, and the REST API for automation and AI agents.
| Surface | Ideal for | Install |
|---|---|---|
| Hosted SaaS (web app) | Security engineers and approvers — authoring, reviewing, deploying, monitoring | None — app.veltrixsecops.com |
| Self-host (Community Edition) | Teams that want to run the whole platform themselves, open-source (Apache-2.0) | Docker Compose — veltrix-community |
| Veltrix CLI | App developers — scaffold, validate, package, sandbox dev loop | npm i -g @veltrixsecops/cli |
| App SDK | App developers — typed pipeline handler contracts and manifest types | npm i @veltrixsecops/app-sdk |
| REST API | Automation, CI/CD, and AI agents — propose and track changes programmatically | None — authenticate with an API key |
The primary interface. Author configuration in the visual Configuration Canvas, review and approve pending changes with field-level diffs, run deployments, watch health checks, and investigate drift — all from the browser at app.veltrixsecops.com. Tool integrations are installed from the in-app marketplace (Apps page), either from the catalog or by release URL.
The whole platform is available as a free, self-hostable open-source Community Edition (Apache-2.0) — the same app model, pipeline, drift detection, and marketplace, run on your own infrastructure. It ships as a Docker Compose stack (frontend, backend API, PostgreSQL 16, Redis 7, RabbitMQ, and the deployment consumers).
git clone https://github.com/captivatortechnologies/veltrix-community.git
cd veltrix-community
docker compose up -dOn a self-hosted instance, apps are installed by the platform administrator — from the in-app marketplace or by release URL — and tenants then enable the ones they need, exactly as on the hosted platform. See the veltrix-community repository for the current setup, configuration, and upgrade instructions.
@veltrixsecops/cli)The CLI is for people building Veltrix apps — the open-source integrations that connect security tools to the change pipeline. It's published to npm with provenance attestation.
npm install -g @veltrixsecops/cli
veltrix --helpKey commands:
veltrix init <app-id> — scaffold a new app in the canonical layoutveltrix login — authenticate against your tenant with an API key (or set VELTRIX_API_KEY)veltrix validate [dir] — validate an app against the platform contract (the same validator CI runs)veltrix package [dir] — build a release-identical ZIP with a SHA-256 checksumveltrix sandbox create|list|delete|run — manage isolated developer sandboxes in your tenantveltrix dev --sandbox <name> — watch your working directory and live-sync it into a sandbox, invoking handlers and streaming logs as you editSandboxes are tenant-isolated, only target sandbox-tagged components, and never receive production credentials. Each developer gets their own sandbox quota (set by the platform operator). Sandbox commands require an API key authorized for sandboxes — either one with the sandbox:read / sandbox:write scopes, or an administrator key.
@veltrixsecops/app-sdk)The SDK provides the typed contracts every app is built against: the six pipeline handlers (validate, deploy, rollback, healthCheck, driftDetect, getStatus), their contexts and result types, manifest types, and optional React hooks for app UI pages.
npm install @veltrixsecops/app-sdkHandlers receive everything through their context — the canvas snapshot, target component, decrypted credential and connectivity, and a tenant-scoped read-only platform data API. Apps never import platform internals; that boundary is enforced in CI.
Start from the template in the public apps repository, or run veltrix init which scaffolds it for you.
Everything the web app does flows through the REST API, and you can drive it from scripts, CI/CD pipelines, or AI agents. Authentication uses per-tenant API keys sent in the X-API-Key header. Keys are scoped, revocable, and can carry expiry dates; usage is rate-limited per tenant and recorded in the audit trail.
curl -H "X-API-Key: $VELTRIX_API_KEY" \
https://app.veltrixsecops.com/api/pipeline/summaryA recommended pattern for AI-driven automation: issue the agent its own dedicated key so its proposals are attributable, and let changes flow through the normal approval workflow — the agent can author and submit, while promotion to production remains a human review. See AI Guardrails for the full model, and the API Reference for endpoints.