The audit your CIO can actually defend. Free, open-source, agentless-by-default SQL Server audit and compliance assessment — 500+ checks, every one of them free, most of them mapped to 30+ compliance frameworks including NIST SP 800-53, CIS, DISA STIG, ISO 27001, SOC 2, PCI-DSS and HIPAA.
The open alternative to Microsoft SQL Vulnerability Assessment, with deeper coverage. Every check names where its rule comes from. Every control is traceable.
Request the Windows build → · Live docs → · Security whitepaper →
A board-ready governance score (Bronze → Silver → Gold → Platinum), a 5-category breakdown, and licensing-cost visibility — generated from real DMV reads on real servers — the assessment installs no agent and nothing on the target.
| Compliance Roadmap | Audit Assessment |
|---|---|
 |
 |
| Maturity roadmap mapping most findings to the framework controls auditors care about. Per-server progress tracking + multi-server comparison strip. | 195 sp_BLITZ findings imported and grouped in a single grid with priority/category badges. No key, no signup. |
Everything in the download is free. The complete check corpus — 500+ checks, most of them framework-mapped — the maturity roadmap, governance scoring, and first-class sp_BLITZ CSV import. No key, no signup, no paywalled checks, use it indefinitely.
Beyond the tool: estate consolidation modelling, peer-benchmarked CIO reports, and diagnostic roadmap engagements are services offered by the author — the tool's report ends with an export you can send if you want that depth. Want the graded report done for you? Book a free SQL check →
The audit is the headline. While you wait, two SentryOne-replacement surfaces give you the operational visibility most teams pay $$$ for:
| Delta view (since last snapshot) | Cumulative view (since plan cache) |
|---|---|
 |
 |
Drill-down treemap (DB → object → statement) of sys.dm_exec_query_stats. Background snapshot loop (5-min interval, 24h retention, encrypted SQLite cache) gives you "what just got busy" without waiting for the plan cache to clear. |
Same surface in cumulative mode for the long-tail "what's been hot for days" view. Toggle in the toolbar; both modes share the same drill and treemap rendering. |
Samples sys.dm_io_virtual_file_stats twice and shows the delta — current IO pressure, not since-startup cumulatives. Drive lanes group files per physical drive; HSL hue groups files by database; log files get diagonal striping; tempdb gets dashed outlines; live IOPS get a pulse animation on the heat dot. Hottest file + stalls surfaced as numbers below.
Audit Assessment · Compliance Roadmap · CIO Dashboard · Compliance Map · Code Hotspots · Disk IO · Live Sessions · Wait Stats · Query Plan viewer · Server Health · Server Comparison · Index Analysis · Blocking Forensics · Memory Profile · Scheduled Tasks · Alerting · Audit Log · Report Bundles · Remediation Playbooks · and more.
| Capability | SQLTriage | sp_BLITZ | MS Vulnerability Assessment | SolarWinds DPA / Redgate |
|---|---|---|---|---|
| Cost | Free (GPL v3) | Free | Free (SSMS only) | $$$ per server |
| Agentless (assessment) | ✅ | ✅ | ✅ | ❌ |
| Audit-grade checks | 500+ (all free) | 331 (measured 2026-09) | 87 (measured 2026-09) | - |
| Framework mapping (NIST / CIS / STIG / ISO / SOC 2 / PCI / HIPAA) | ✅ | ❌ | partial | ❌ |
| Maturity scoring (Bronze → Platinum) | ✅ | ❌ | ❌ | ❌ |
| Named source per check | ✅ | partial | ❌ | ❌ |
| Code hotspot delta (last-5-min view) | ✅ | ❌ | ❌ | ✅ |
| Drive-lane disk IO view | ✅ | ❌ | ❌ | ✅ |
| Board-ready PDF | ✅ | ❌ | ❌ | ✅ |
| Single self-contained EXE | ✅ | n/a | n/a | ❌ |
Positioning: SQLTriage = audit-first compliance evidence with live monitoring built in. sp_BLITZ = one-time health check. MS VA = basic vulnerability scan. Enterprise tools = full observability at $$$.
- Request the Windows build. The public download is paused while the next release is prepared. Ask through GitHub Issues or sqldba.org and we send you the installer or the portable zip.
- Launch — Free tier active immediately
- Settings → Add Server — pick a SQL instance, Windows auth or SQL login
- Audit Assessment → Run Audit — 60-second run on a typical instance
- Review the grid, drill into findings, export to PDF
- Agentless by default — every check is a SELECT against DMVs. Running an assessment installs nothing on the SQL Server and changes no schema.
- Read-only by default — the write paths are separate, opt-in pages an operator has to open and act on; nothing writes during an assessment, on a schedule, or on connect. They are: Server Configuration & Hardening, Best Practice scripts, Remediation, the Extended Events page (creates / starts / stops / drops event sessions), the query plan viewer's index-create button, and a dashboard panel's action cell (no shipped panel defines one). Each states its own gate in the full write-paths table; they are not all the same. The dashboard action cell asks for a per-action confirmation, Remediation asks for its own confirmation on the fixes it marks not reversible, and the index-create button asks for none. No-Pants mode gates the dangerous ones and Experimental Mode gates previews — both are safety interlocks, not authentication.
- Audit-grade - every check names where its rule comes from. 401 of 523 link to the published source. The report your auditor reads is the same report your DBA reads.
- Single self-contained EXE — .NET 10 + WebView2 bundled. No "install runtime first" friction.
- Local-only by default — no telemetry, no phone-home, no cloud dependency. Optional Azure Blob export if you want offsite audit trails.
- Windows Service mode — headless 24/7 for continuous monitoring, dashboards via Kestrel HTTPS.
- DPAPI-wrapped credentials — SQL passwords encrypted at rest with
CredentialProtector(AES-256-GCM + DPAPI). Security whitepaper → - Unsigned today (signing planned) — Windows/AV may warn on first run; here's why it happens and how to verify the download (open source, SHA-256 provenance, VirusTotal-clean, no telemetry).
- Regulated buyers who need audit-grade evidence (SOC 2, HIPAA, FedRAMP, NIS2 prep)
- MSPs / consulting firms who need to walk into an engagement and produce a defensible scorecard in an hour
- DBA teams drowning in sp_BLITZ output that nobody acts on — SQLTriage translates the same findings into the framework language the CIO will fund
- Vulnerability scan teams who outgrew Microsoft SQL VA and don't want to pay enterprise pricing
- Cross-platform monitoring (Oracle / PostgreSQL / MySQL — SQL Server only)
- Long-horizon performance data warehousing (use SQLWATCH or commercial tools for that — SQLTriage focuses on the current state + recent history)
- Hosted SaaS dashboards (single-tenant Windows desktop / service today)
If you saw SQLTriage driving itself in a demo video, that's DevBridge — a local automation bridge used to script the UI for development, testing, and demo recording.
- Debug builds only. Release builds (everything on the Releases page) do not contain it.
- Off by default even in debug builds — it only starts with the explicit
--devbridgeflag. - Loopback only. It binds to
127.0.0.1and is never reachable from another machine.
.NET 10 · Blazor Hybrid (WPF + WebView2) · SQLite · Serilog · ApexCharts · QuestPDF · Azure SDK · BIP39
Standing on the shoulders of: sp_BLITZ (Brent Ozar) · SQLWATCH (Marcin Gminski) · sp_triage (sqldba.org) · PerformanceMonitor (Erik Darling) · MadeiraToolbox (Eitan Blumin) · TigerToolbox (Pedro Lopes) · Ola Hallengren Maintenance Solution.
GPL-3.0 — see LICENSE.txt. Free for commercial use; modifications must remain open.
- Bugs / feature requests: GitHub Issues
- Discussion: GitHub Discussions
- Check corrections: open an issue — accepted corrections are folded into the corpus with credit. (Framework PRs welcome; check content is curated, so check PRs are politely declined.)
- Web: sqldba.org