Skip to main content
Version: 1.6

What's new

Product version​

1.6

Release date​

July 1, 2026

Brief description​

The TRON.ASOC v1.6 Release focuses on automating AppSec processes, expanding integration scenarios, and increasing platform flexibility.

This version adds policy and integration builders for external tools, automatic Git repository discovery, support for MCP (Model Context Protocol), TruffleHog integration, and significant improvements to Reports, dashboards, data storage security, and check management.

Summary​

  • Added a policy builder to automate actions based on events, conditions, and schedules
  • Added an integration builder for external Security tools
  • Added automatic discovery and synchronization of repositories from GitHub, GitLab, and Bitbucket
  • Added the ability to bulk-add repositories from GitHub, GitLab, and Bitbucket
  • Added support for MCP (Model Context Protocol)
  • Added incremental comparison Reports for Vulnerabilities across Scans
  • Added a new report format—HTML
  • Expanded CLI tool capabilities

What's new​

Policy builder​

TRON.ASOC now includes a policy builder to automate event-based actions. Policies support triggers, CEL (Common Expression Language) conditions, action sequences, prioritization, and enabling or disabling policies without deleting them.

What changed for users: You can now configure automatic responses to system events, including changing status and severity, starting and stopping security checks, assigning owners, creating tasks, sending notifications, and performing other actions. This Release provides project policies. Global policies are temporarily hidden from the interface because of performance limitations.

Integration builder for external security tools​

The product now includes a builder for connecting external Security tools through a configurable runtime. You can describe an external tool integration and configure endpoints, parameters, and behavior without modifying the product core.

What changed for users: You can now create Custom (External) Tool tools, use them with different source types, and test integrations through the interface.

Automatic repository discovery and synchronization​

The system can discover repositories within a GitHub, GitLab, or Bitbucket workspace, resynchronize them, and display the status of discovered repositories.

What changed for users: When you connect a version control system, you can select the “Full workspace with automatic synchronization” integration type. The system then creates and updates the current repository list.

Bulk repository addition from GitHub, GitLab, and Bitbucket​

You can now add one or more repositories when you connect GitHub, GitLab, or Bitbucket as a scan source.

What changed for users: When you connect a version control system as a scan source, you can select one or more repositories. The system adds them as separate sources.

MCP (Model Context Protocol) support​

TRON.ASOC now supports Model Context Protocol and can act as an MCP server with OAuth 2.1, RBAC (Role-Based Access Control), and auditing.

What changed for users: MCP-compatible agents can use the TRON.ASOC context through a standard interface to analyze data and retrieve information about security issues, projects, Metrics, and other entities.

Incremental comparison of Vulnerabilities across Scans​

You can now incrementally compare scan results within layers.

What changed for users: You can compare scan results in the following ways: compare each scan with the previous one, compare all scans with a selected scan, or compare 2 selected scans.

New report format—HTML​

HTML is now available as a new project report format.

What changed for users: You can now export both summary and detailed Reports in this format.

Expanded CLI tool capabilities​

You can now use CLI tools with any source type, including Custom Source, App URL, and Harbor.

What changed for users: You can now scan sources of any type with CLI tools such as Trivy, Grype, KICS, Semgrep, and others.

Improvements

  • You can now add comments to Jira tasks from a security issue in TRON.ASOC, mention Jira users in issue comments, and use custom labels for entities created in Jira
  • When you view security issues in a layer, you now see Vulnerabilities from all layers nested within it
  • Added a nested layer filter to the Security issues section. You can also use this filter when generating Reports and in response rules
  • Added a Cumulative graph to dashboards that displays security issues by tool name and supports filtering
  • Expanded the role model with separate permissions to access and edit dashboards. Previously, both actions required a single administrative permission
  • You can now select multiple projects when creating a tool or source with the “Project” access type
  • Each project dashboard can now have its own widget settings independent of the general settings
  • Cumulative graphs and Metrics for the current day now update almost in real time. The system recalculates them more than once a day
  • The Security tools widget in projects no longer automatically displays all active tools. You can now select which tools to display, including tools that aren't present in the project
  • Added information about the TRON.ASOC component migration status to the About section
  • You can now test an integration connection without permission to view credentials. The connection test button is available outside integration edit mode
  • Redesigned the comments section in Reports to support user mentions, comment deletion, and other actions

Fixes​

  • Fixed the display of zero values on logarithmic graphs. Graphs now show 0 instead of the incorrect value 0.1, and the duplicate zero point was removed from the axis
  • Fixed an issue that forced graphs to display zeros when no data was available. The behavior now matches Cumulative graphs: when there's no data, the system doesn't return zeros
  • Added horizontal scrolling to the layers page for monitors with nonstandard aspect ratios, such as 16:10. This keeps all controls and columns accessible without zooming out

New integrations​

IntegrationDescription
TruffleHogAdded integration with TruffleHog for finding, verifying, and analyzing leaked secrets, such as API tokens, passwords, and other credentials, in code repositories, commit history, and other sources (Secrets Scanning)

REST API changes​

New endpoints​

  • GET /master-sources/—retrieves master source data
  • PUT /master-source/{id}—updates master source settings
  • DELETE /master-source/{id}—deletes a master source and supports deleting or unlinking child sources
  • POST /master-source/{id}/sync—manually starts Git repository synchronization
  • GET /sources-list-with-masters—returns a combined list of regular and master sources
  • GET /master-source/{master_id}/children—returns the child sources of a master source
  • GET /stats/tool-name—retrieves a graph by tool name
  • GET /stats/tool-name-list—retrieves the list of tools used for graphs by tool name
  • GET /api/v1/trackers/users?tracker_ids=...—retrieves task tracker users for assigning owners and mentioning users
  • GET /trackers/labels?tracker_id={TrackerId}—retrieves task tracker labels
  • PUT /tracker/{TrackerId}/task/{TrackerTaskID}—manually starts task synchronization from the task tracker

Updated endpoints​

Updated endpointDescription of changes
GET /check/{check_id}Replaced the GroupedBranches field with GroupedChecks
POST /checkAutomatically creates a group when you provide more than one tag and removes the check_group_id parameter from the request
PUT /check/{check_id}Supports group creation and editing through the GroupedChecks parameter
GET /issue/{id}Also returns the layers list in nesting order
GET /issuesAdded the layer_id and layer_type fields and implemented sorting and filtering by these fields
GET /issues/fieldsAdded the layer_id and layer_type fields
DELETE /source and DELETE /toolsAdded the delete_checks parameter for cascading deletion of related security checks

Removed endpoints​

  • POST /check-group
  • GET /check-group/{group_id}
  • PUT /checks-group/{group_id}
  • POST /check/{check_id}/secure
  • POST /notifier/{id}/secure
  • POST /source/{id}/secure
  • POST /sso/settings/secure
  • POST /tool/{id}/secure
  • POST /tracker/{id}/secure

Upgrade instructions​

Feedback and support​

Conclusion​

TRON.ASOC 1.6 takes a significant step toward more flexible DevSecOps automation.

The TRON.ASOC v1.6 Release strengthens the system in several areas: AppSec process automation, AI integrations, data storage security, easier source and tool connections, and analytics and reporting. This update lays the foundation for further development of Policy-as-Code scenarios, custom integrations, and AI-assisted workflows.