Open Source MSP Software: 34 Tools, Every Repo Verified

Updated: 8 September, 2026

Open source MSP software has reached the point where a full commercial stack - RMM, PSA, monitoring, SIEM, backup - can be replaced line by line, and the savings run $35,000-160,000 over three years. The problem with every list of open source MSP tools is rot: half the entries are quietly abandoned, and nobody tells you which half. This directory covers 34 tools across 10 categories, and every entry carries a maintained-or-watch status, its latest release date, and its license - all verified against the project's own repository on August 19, 2026.

The data behind it isn't desk research alone. It's backed by MSPs across the US, UK, Ireland, and Australia in the OpenMSP community - many featured on our open-source talent leaderboard - who run these tools under real ticket volume and tell us which ones hold up.

TL;DR

• Open source MSP software. 34 tools across 10 categories below, each with verified status, last release, and license as of August 19, 2026.
• Health check. 32 of 34 are actively maintained; Puppet and Bacula carry watch flags.
• License landmines. TacticalRMM is source-available not OSI; Security Onion's license bars managed-service resale; AGPL applies to hosted use of Zabbix, Zammad, Snipe-IT, and RustDesk.
• The math. A full open stack runs $15K-40K over 3 years against $50K-200K+ commercial.

Jump to a category: RMM and Remote Access · Network Monitoring · PSA and Ticketing · Assets and Documentation · SIEM and Network Security · Endpoint Visibility and Antivirus · Backup and Recovery · Automation and Runbooks · Identity and Access · Password Management

How This Directory Works

Every list of open-source tools eventually becomes a list of dead links. This one commits to three things instead. Status is checked against each project's repository, not its marketing site: Maintained means a release or steady commits inside the last six months, Watch means activity has slowed or ownership changed in a way worth knowing before you build on it. Last-release dates and licenses come from the repos themselves. And every tool that has a full OpenMSP review or vendor profile links to it, so the one-line summary here never has to carry the whole decision.

The OpenMSP vendor directory holds the full catalog beyond these 34; this page is the shortlist that survives contact with production.

RMM and Remote Access

Replaces: ConnectWise Automate, Datto RMM, Kaseya VSA, TeamViewer. The open side of this category is the most production-proven - TacticalRMM alone runs in thousands of MSP shops.

Notes for MSPs: TacticalRMM's license bans reselling it as a hosted service without permission, and code-signed agents need a paid sponsorship - price that in. MeshCentral is community-maintained since Intel stepped back, with steady releases under the new maintainer. RustDesk's China-origin debate is answered mostly by self-hosting the relay. Status verified August 19, 2026. The open source RMM comparison ranks the full field.

Network Monitoring

Replaces: PRTG, SolarWinds NPM, Auvik. Free options here are genuinely competitive with anything commercial - the cost moves to engineering hours.

Notes for MSPs: Zabbix's move to AGPL-3.0 at v7.0 matters if you host it for clients. LibreNMS ships monthly and includes usage-based billing calculations. Prometheus needs Grafana and exporters to be a complete stack. For the commercial side of the field, independent roundups of monitoring solutions cover what these replace. Status verified August 19, 2026.

PSA and Ticketing

Replaces: ConnectWise Manage, Autotask, Zendesk. The PSA gap that sank open stacks for years is closed - covered in depth in the open source PSA breakdown.

Notes for MSPs: ITFlow is the purpose-built option - note its small contributor base for a system holding client credentials, and community PRs are paused per the project README. Zammad's AGPL applies when you host it for clients. The open source ITSM comparison covers the wider service-desk field. Status verified August 19, 2026.

Assets and Documentation

Replaces: Lansweeper, IT Glue (partially), commercial IPAM. The source-of-truth layer commercial stacks charge per-seat for.

Notes for MSPs: Snipe-IT's repo moved to grokability/snipe-it - update your watch lists. GLPI's CVE history makes prompt patching non-negotiable for internet-facing installs. NetBox is the documentation backbone network-heavy MSPs standardize on. Status verified August 19, 2026.

SIEM and Network Security

Replaces: Splunk Enterprise Security, Microsoft Sentinel. The category where open source undercuts five-figure monthly bills hardest.

Notes for MSPs: the Security Onion license is the trap in this table - Elastic License 2.0 bars offering it as a hosted managed service, which is exactly what an MSSP would want to do. Read it before building a service on it. Wazuh remains the multi-tenant SIEM workhorse. Status verified August 19, 2026.

Endpoint Visibility and Antivirus

Replaces: commercial EDR visibility layers and mail-gateway AV. Not a full EDR replacement - pair with the SIEM row above.

Notes for MSPs: Fleet's Premium features live in a proprietary ee/ directory - the open core is MIT. Osquery moved from Facebook to Linux Foundation governance. Status verified August 19, 2026.

Backup and Recovery

Replaces: Veeam, Datto SIRIS (partially). The category where you test restores before trusting anything, open or commercial.

Notes for MSPs: UrBackup is alive but single-maintainer with a slow cadence - fine for what it is, budget accordingly. Bacula's community edition trails the enterprise product by design; the watch flag is for the yearly stable cadence, not abandonment (the 17.0 beta landed this month). Status verified August 19, 2026.

Automation and Runbooks

Replaces: commercial RMM automation engines, ServiceNow Orchestrator. Turn tribal knowledge into repeatable jobs.

Notes for MSPs: the Puppet flag is the sharpest in this directory - Perforce moved development private in early 2025 and the public repo is now a hardened mirror. The maintained free continuation is the community fork OpenVox (Apache-2.0, active as of August 2026); point new deployments there. Rundeck is PagerDuty-owned open-core, and Salt's roadmap now sits with Broadcom. Status verified August 19, 2026.

Identity and Access

Replaces: Okta, Microsoft Entra ID (partially). Self-hosted SSO for client app stacks.

Notes for MSPs: Keycloak is CNCF-governed and the safest long-term bet of the three. Authentik's enterprise directory is proprietary. Status verified August 19, 2026.

Password Management

Replaces: 1Password, LastPass. Client credential vaults you control end to end.

Status verified August 19, 2026.

What the Stack Costs

License costs on everything above: $0. The real 3-year budget: implementation $5,000-15,000 one-time, training $2,000-5,000, ongoing support $2,000-8,000 a year, integration work $3,000-10,000. Total open stack: $15,000-40,000 over three years against $50,000-200,000+ for the commercial equivalent - savings of $35,000-160,000+, which is why MSPs making strategic tool choices report 20%+ margins against the ~14% average. The full stack cost breakdown prices a real TacticalRMM + Wazuh + ITFlow build against a $50K commercial stack, engineering hours included, and the MSP cost calculator runs the math on your own stack.

How to Adopt Without Breaking Production

Run it in three phases. First month: audit vendor costs, identify the highest-cost category, pick one pilot client, and write a rollback plan per tool. Second month: deploy one tool for that pilot - TacticalRMM or LibreNMS is the usual starting point - and document every configuration step while it's fresh. Months three to six: expand what survived the pilot, train the team, migrate data, and measure the actual margin change. Teams that swap the whole stack at once spend the next quarter firefighting; teams that go category by category keep their SLAs.

The pattern that keeps repeating in the community: start where the commercial bill hurts most, prove one tool in production, and let the savings fund the next migration. The stack builds itself from there.