opentrap/opentrap

OpenTRAP is worth a look if you already think in Burp's proxy-first terms and want an open-licence option for web app testing on Linux; it is not yet a drop-in replacement for a mature commercial suite, and the roadmap openly lists what is still missing.

The problem

A tester wants to intercept browser traffic, poke at a request in a repeater, fuzz a parameter, and then run an automated scan on the same target. In a Burp-centric practice, the scanner and the whole toolset sit behind a paid licence; in OWASP ZAP, the engine is free but the workspace does not match a proxy-first, Burp-shaped workflow. OpenTRAP's stated goal is to close that gap: you capture and tamper through the familiar Proxy, Repeater, Intruder and Collaborator panes, then point the ZAP engine at the same target from the same window. The result the author promises is a single workspace covering manual traffic work and automated auditing, without a feature gate.

What's different

The mechanism is an interface and workflow layer over OWASP ZAP's crawl-and-audit engine, delivered as one self-contained Linux AppImage with its own runtime and the engine inside. That packaging matters: there is no separate Java or ZAP install to manage, and the project says the engine's detection is the same ZAP detection, so findings are not a new homemade scanner. The trade-off is that the scanning depth and rule behaviour follow ZAP, including its scan tiers, and the UI is a re-creation rather than the ZAP interface — users who know ZAP's own UI will be relearning a layout.

The README is also unusually explicit about incompleteness: features laid out in the interface but not yet implemented are listed in a public roadmap file with stable codes such as OT-INTRUDER-RESPOOL, and clicking them in the app explains how to contribute. That is honest, but it means the toolset table describes intended surface area, not necessarily finished behaviour in every pane. The author's claim that reported findings "hold up" rests on ZAP's engine; it is a claim, not independent validation.

Who should try it

A good fit is a Linux-based pentester, bug bounty hunter or AppSec learner who already works comfortably in a Burp-style proxy and wants a free, AGPL-licensed workspace for daily manual testing plus ZAP-powered scanning. A poor fit is someone on macOS or Windows, since the README states a single self-contained Linux AppImage is what ships today, or a team that needs a fully implemented Intruder and other panes immediately — check the roadmap against the feature table before committing a workflow. Students who want the professional proxy workflow without a licence cost are the audience the author names, and the AppImage path supports that without a separate runtime install.

Requirements and limitations

Platform is the first constraint: today the release is Linux-only and self-contained, so portability to other operating systems is not documented. Features are another: some items presented in the interface are placeholders tracked in the roadmap, so validate the specific tools your workflow depends on before adopting. The AGPL-3.0 licence is a real obligation — if you modify and distribute OpenTRAP, or run a modified version as a network service, you must release your changes under the same terms; check that this fits your organisation. Ongoing upkeep is a single file to re-download rather than a dependency stack, but a five-day-old project with active development will move quickly, so expect interface and behaviour changes between releases.

HotRepo's take

HotRepo's only dated observation is a NEW-REPOSITORY board (新项目榜, Java) placing it #7 with 416 total stars on 2026-10-25; that is a snapshot, not a growth measurement, and the stored coverage from 2026-10-24 to 2026-10-25 is too thin to judge whether interest persists. Check the roadmap for whether the tools you need are implemented before making it your daily proxy.