Open Security for Connected Care.

API-first security platform for healthcare infrastructure. BlueFlow asset management, Tapirx passive device discovery, and VulnFWRD™ AI risk orchestration — MIT-licensed open core you can inspect, extend, and deploy on your own terms.

MIT Open Core

FDA SBOM Ready

NIST CSF Aligned

Self-hosted option

blueflow — api explorer

list assets in ICU network

$ curl -s /api/v1/assets/ \
 -H "Authorization: Token sk-bf-••••" \
 -G -d "network=ICU-Floor-3"

HTTP/1.1 200 OK
{
  "count": 1847,
  "results": [
    {
      "name": "Infuse-O-Matic Peach B+",
      "mac": "00:03:b1:b5:b6:48",
      "last_seen": "2026-03-18T09:14Z"
    }
  ]
}

Platform

Four tools. One platform.

Use independently or together. Each component exposes a versioned REST API and connects via the pluggable connector framework — designed for maximum flexibility with no vendor lock-in.

BlueFlow™

Open-core asset platform

Open Source MIT Python / Django

Now free and open source. Django REST API for healthcare IT asset management. Versioned API at /api/v1/ with full OpenAPI 3 schema, pluggable connector framework, SBOM generation, and role-based access control. Deploy with Docker Compose or install as a Python package.

  • Connector plugin framework — discovery, vuln, CMMS, SIEM, webhooks
  • SBOM generation in SPDX and CycloneDX formats for FDA compliance
  • Built-in RBAC: viewer, editor, biomed, security admin
  • Full Docker Compose stack — web, worker, beat, Postgres, Redis
  • Audit trail via django-simple-history on every model
GET /api/v1/assets/
POST /api/v1/assets/<id>/sbom/
POST /api/v1/webhooks/
POST /api/v1/connectors/<id>/sync/
GET /api/v1/schema/ → OpenAPI 3

Tapirx™

Passive device discovery

GPL-3.0 Go

Free, open-source medical device discovery written in Go. Passively identifies devices from HL7 and DICOM network traffic via SPAN port, live interface, or pcap file — with zero impact on clinical operations. Plugs into BlueFlow as a discovery-type connector.

  • Protocols: HL7 ADT/PRT (UDI extraction) and DICOM
  • Runs on Linux, macOS, Windows — no network disruption
  • SPAN port, live capture, or pcap file input with BPF filtering
  • MAC-keyed asset upsert with provenance and last-seen timestamps
  • CSV output or direct POST to BlueFlow discovery connector
$ tapirx -iface eth0 \
 -apiurl http://bf:8000/api/v1/assets/

Gurney

Clinical testbed scanner

Open Source Python

Reproducible, self-contained test environment that exercises BlueFlow's passive (pcap/protocol observation) and active (Nessus/Tenable-backed) scanning pipelines — topology- and scenario-driven, runs via Docker Compose.

  • Topology-based environments: networks, nodes, healthchecks, dependencies
  • Scenario-driven runs — one topology can back many test scenarios
  • Exercises both passive pcap/protocol observation and active scanning
  • NDJSON machine-readable output for CI integration
$ gurney list
$ gurney run blueflow-local/smoke-docker

VulnFWRD™

AI risk orchestration

Proprietary

AI-powered risk orchestration with bidirectional BlueFlow integration. BlueFlow emits structured risk events when vulnerabilities map to assets or Pulse feed items match tracked devices. VulnFWRD returns scored remediation intents — the full closed-loop for healthcare vulnerability management.

  • Bidirectional integration via connector plugin framework
  • AI risk scoring with NVD, EPSS, CISA KEV, and asset criticality
  • Remediation intents returned as actionable BlueFlow alerts
  • Custom stakeholder dashboards per role
  • Policy engine and workflow automation via webhooks
POST /api/v1/intents/ ← risk event in
GET /api/v1/pulse/ ← threat feed

{ "event_type": "vulnerability_mapped", "cve_id": "CVE-2024-1234", "epss_score": 0.87 }

API Reference

Versioned. Documented. Complete.

Every endpoint lives at /api/v1/ with full OpenAPI 3 schema auto-generated by drf-spectacular. Swagger UI served at /api/v1/schema/ui/.

Assets & SBOM

  • Inventory, MAC-keyed upsert, FDA SBOM generation

Risk & Vulnerabilities

  • CVE tracking, Pulse feed, VulnFWRD intents

Connectors & Webhooks

  • Plugin sync, generalized webhook jobs

Schema & Discovery

  • OpenAPI 3, Swagger UI, autocomplete

Deployment Guide

From zero to secure in three steps.

01 Deploy the platform

Full Docker Compose stack — web, Celery worker, Celery Beat, PostgreSQL, Redis. Auto-migration on container boot. Running in minutes.

# Clone and start the full stack
$ git clone github.com/virtalabs/blueflow
$ cp .env.example .env
$ docker compose up -d

02 Discover your devices

Register connectors, deploy Tapirx on a SPAN port, trigger syncs via API.

# Start passive discovery
$ tapirx -iface eth0 \
 -apiurl http://bf:8000/api/v1/assets/

03 Orchestrate your defenses

Connect vulnerability scanners, configure the VulnFWRD bridge, enable webhook subscribers.

# Trigger Nessus connector sync
$ curl -X POST \
/api/v1/connectors/nessus/sync/

Access Control

Every role. Every team.

Built-in RBAC with scoped API tokens. Permissions enforced at the ViewSet level on every endpoint.

Roles

  • Viewer: Read-only access for leadership and auditors. Export reports in JSON, CSV, SPDX, and CycloneDX formats.
  • Editor: Create and update assets, groups, and tags.
  • Biomed: Clinical engineering access. Manages scans, SBOM generation, and ePHI tracking.
  • Security Admin: Full platform control. Connector management and issuance of scoped API tokens.

Active Research

Built on a decade of pioneering security research.

Virta Labs cofounders co-authored the world's first research on cardiac implant cybersecurity in 2008. They shaped FDA medical device security guidance and introduced PowerGuard™ in 2015 — a malware detection system.

Get Access

Take control of your security stack.

Deploy locally. Own your data. Export anytime. We'll align VulnFWRD™ capabilities to your environment and share documentation.