opentrap/opentrap is a web security testing suite centered on an intercepting proxy that captures traffic between the browser and web applications and intercepts requests and responses. It is presented as a free open-source alternative to Burp Suite, written in Java and licensed under AGPL-3.0. The latest release is 20261019-231601.
It bundles Repeater, Intruder, Collaborator, Decoder and a site map, so requests can be replayed and tampered with before the results are explored, and it supports both manual and automated testing. Its detection engine crawls applications and audits vulnerabilities, external scan engines can be connected, and the OWASP ZAP scanner is built in. Because crawling, intercepting, replaying and scanning run as one bundle, it gathers the web vulnerability verification procedure into a single tool. Modules are separated by function — proxy, spider, intrusion tester and scanner — so the feature scope and structure can be confirmed. The release ships as a single Linux AppImage that includes the Java runtime and the scan engine, so only Linux is supported.
That said, the basis for judgment is still thin. The repository was created on October 19, 2026 and has 104 stars. The evaluation recorded for this repository is freshness 6.0, technology 7.0, quality 6.0 and momentum 7.6, with technology and momentum higher than freshness and quality. No release changelog and no verification records from real environments are presented. For now it is more accurate to treat this as an early-stage project for internal audits and tool comparison rather than something to adopt as a Burp Suite replacement.