# baidu/openrasp

🔥Open source RASP solution

Repository: https://github.com/baidu/openrasp
Canonical: https://ross.abutalabs.com/products/openrasp
Homepage: https://rasp.baidu.com
Language: C++
License: Apache-2.0
License Family: permissive
Topics: waf, devsecops, security, iast, rasp
Last push: 2025-10-02T11:34:31+00:00

## Health v2 (maintenance only)
Score: 43/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 45, release rhythm 8, longevity 100
- inputs: {"age_days": 3310, "days_push": 335, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2987, forks 623 (observed 2026-08-28T04:07:34.361868+00:00)

## What it is
OpenRASP is Baidu's open-source Runtime Application Self-Protection (RASP) solution that embeds a protection engine directly into the application server via instrumentation (Java agent and PHP extension). It hooks sensitive functions like database queries, file operations, and network requests to detect and block attacks contextually, with detection logic customizable through JavaScript plugins.

## Use cases
- protect web applications from SQL injection and code injection attacks
- detect deserialization vulnerabilities at runtime
- replace or supplement a WAF with context-aware in-app protection
- integrate attack alerts into SIEM/SOC platforms like ELK or Splunk
- run IAST gray-box vulnerability scanning during security testing
- block OWASP Top 10 attacks on Tomcat, JBoss, WebLogic, or PHP servers

## When to choose
- you need runtime protection that only alerts on successful attacks, reducing false positives
- your WAF is being bypassed due to protocol quirks or backend-specific behavior
- you want detailed stack traces for forensic analysis of exploitation attempts
- you need customizable detection logic via JavaScript plugins across platforms
- you run Java or PHP application servers on Linux and want free, self-hosted RASP

## When to avoid
- your stack is Node.js, Python, Ruby, Go, or .NET, which are not yet supported
- you need a perimeter defense filtering requests before they reach the app rather than in-process protection
- you cannot tolerate any performance overhead or application restarts during installation
- you require a managed cloud service rather than self-hosted components

## Facets
- artifact type: library
- maturity: stable
- function: security, monitoring, alerting, logging, plugin-system
- domain: security, web-development, backend, self-hosted
- platform: windows, jvm, php, self-hosted
- tags: rasp, runtime-application-self-protection, waf-alternative, iast, devsecops, java-agent, php-extension, intrusion-detection, siem-integration, vulnerability-protection, devops, linux, macos, docker

## Member repositories
- baidu/openrasp (main) score 43

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:34.361868+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:31:24.512045+00:00, confidence not recorded.
  - readme: https://github.com/baidu/openrasp (fetched 2026-08-28T04:07:34.361868+00:00, sha 9ae716bbc58f)
  - homepage: https://rasp.baidu.com (fetched 2026-08-29T09:47:04.533337+00:00, sha ac62eb2e63a8)
  - site_page: https://rasp.baidu.com/doc/install/software.html (fetched 2026-08-29T09:47:04.536075+00:00, sha f0ee8d42972d)
  - site_page: https://rasp.baidu.com/doc/install/compat.html (fetched 2026-08-29T09:47:04.538640+00:00, sha cea73d23a87a)
- Data as of 2026-08-30T08:39:29.467469+00:00.