Ogma

Your lightweight toolkit for web security testing.

Find and validate vulnerabilities in web applications and APIs. Inspect live traffic, test application behavior, and automate repetitive work in one focused workspace.

Download OgmaView features
Opening Ogma...

From first capture to final evidence.

Intercept traffic. Test your targets. Build your workflow.

  1. Traffic interception & inspection

    See what an application sends and how its server responds. Inspect HTTP and WebSocket traffic, pause exchanges to make changes, and narrow your investigation to relevant hosts, paths, or content.

    • HTTP History
    • Intercept
    • Sitemap
    View features

  2. Request replay & payload testing

    Take a captured request into Replay and test how the application behaves when you change it. Compare attempts, keep related tests together, and use Automate when a test needs multiple payloads.

    • Replay
    • WebSocket Replay
    • Automate
    View features

  3. Scanning, findings & evidence

    Combine manual investigation with passive analysis and targeted active checks. Record the behavior you find, link supporting traffic, and keep your notes with the assessment.

    • Findings
    • Projects
    • Exports
    View features

API testing starts with the definition.

  • OpenAPI
  • Postman
  • GraphQL
  • WSDL

Import OpenAPI, Postman, GraphQL introspection, or WSDL into Replay. Review generated requests, add your credentials, and test the behavior that matters.

Explore API testing in Replay

Explore Ogma

All features

Traffic inspection

Capture HTTP and WebSocket traffic. Pause exchanges and search requests, headers, and responses with HTTPQL.

Explore traffic inspection

Request replay

Edit and resend requests, compare attempts, and test WebSocket conversations.

Explore request replay

Workflows & MCP

Automate repeated tasks with workflows. Connect AI agents to your traffic and integrated browser.

Explore workflows & mcp

Projects & plugins

Keep assessments, findings, and notes organized. Add your own tools with the JavaScript SDK.

Explore projects & plugins

Make the toolkit work your way.

Workflows

Turn repeated processing steps into a workflow you can run again. Transform content, process selected history entries, or run logic as traffic is captured, without repeating each step by hand.

  1. Convert workflows transform input into output
  2. Active workflows run on traffic you select
  3. Passive workflows process captured traffic

Browser interaction & MCP

Give your AI agent access to the same traffic and testing tools you use. Connect through the integrated MCP server to inspect requests, replay tests, and interact with pages in Ogma's browser. The built-in Ask Bob assistant works with your configured AI provider.

Connect an AI agent

Projects & plugins

Keep each assessment in its own project and extend the toolkit around the way you work. Install existing plugins or build your own with the JavaScript SDK.

Plugins & SDK

Built for efficiency.

  • Rust
  • Vue.js
  • Electron

A Rust-powered proxy handles traffic with asynchronous I/O. Vue.js powers the reactive interface, and Electron brings the desktop app to Windows, macOS, and Linux.

History renders the rows in view, loads captures in pages, and fetches request and response bodies on demand. Less unnecessary work as your assessment grows.

Guides & resources

Set up your first project or extend an existing workflow.

Installation & first captureSet up Ogma, your browser proxy, and certificates.Connect an AI agentPut your testing tools within reach through MCP.Create a pluginExtend Ogma with your own JavaScript tools.Read the blogArticles and perspectives from the Ogma project.

Download for your platform.

Windows · macOS · Linux

Download Ogma