Havuz

Local, evidence-based application security assessment engine and Claude Code plugin

Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own mo

Threat modeling for AI coding agents: point Claude Code, Codex or any agent at your repo and get an evidence-traced threat model. 36 archite

🔓 An AI web-pentest skill for Claude Code. Point it at a site you're authorized to test — it maps the attack surface, works through the OWAS

Local-first AI red team for web, API, and LLM application security. Attacker-style reasoning, evidence-backed findings, and skills for AI co

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay y

CWE-602 客户端鉴权脆弱性白盒审计方法论与纵深防御加固研究框架

Security testing that runs inside the coding agent you already use. Source-available, not open source.

DianXing - AI-Driven End-to-End Code Security Auditing

Security checklist for vibe coded apps. AI rules file + automated audit + manual verification.

Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS,

A local MCP runtime that attacks what you own and only reports what it proved. 17 CVEs across 9 projects came out of this repo. Install: npx

Open-source security skills for AI coding agents. Grounded in OWASP, NIST, MITRE ATT&CK, CIS. Works with Claude Code, Gemini CLI, Cursor, Co

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Secure PHP Development — lab-driven study notes: modern PHP 8.2/8.3 through a full OWASP-mapped catalogue of PHP vulnerabilities with exploi

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.

Executable security regression testing for agentic applications and MCP-integrated systems.

Local-first MCP security scanner for AI-generated apps. Scan → fix → rescan from Claude Code, Cursor, Codex, and other agents.

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

The AI security agent guards your code.

Runtime visibility for Python MCP servers. Captures tool calls, session lifecycle, module imports (SHA-256), and subprocess execution as str

Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, cove

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Find vulnerabilities. Ship secure. — Senior security-engineer skill for AI coding agents. OWASP Top 10, CWE Top 25, secrets detection, IaC +

Soup Wall: open-source security for AI agents and model traffic. Local Agent, Gateway, self-hosted Console. Apache-2.0.

Official CrowdSec skill for Claude Code & Codex: install, configure, operate and debug the engine, bouncers and WAF/AppSec.

See why a web vulnerability works, not just how to trigger it — a single-file, zero-dependency security lab that renders a vulnerable app as

Open-source AI security tool to scan and fix vulnerabilities in your vibe-coded projects before you ship. AXguard by AwareXone.

Agent-assisted vulnerability research across Rust, Android APKs, and AI agents: independent discovery, skeptical triage, verification, and p

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

Security-testing methodology as portable, tool-agnostic agent skills for Claude Code and any agent runtime: white-box bug hunting, AI-agent

A Claude / AI security review prompt for shipping safe apps. TRAP (True Readiness Audit Prompt) turns Claude Code, Cursor, or Copilot into a

Claude Code skill + 18 AI agents for Android & iOS mobile app security audits. OWASP MASVS/MASTG-aligned, with adversarial exploitation conf

A SKILL that turns a code diff into an evidence-backed ledger of hidden assumptions, failure modes, and falsification tests.

An open-source AppSec agent that reasons like an analyst: real scanners, your org's context, and a conversation instead of 400 findings.

Installable Codex/AgentSkills workflow pack for dev, Agent/RAG, API/data, Office artifacts, research diagrams, and authorized security revie

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

A BOLA/IDOR access-control confirmation engine — code adjudicates every verdict, not just the model, with a reproducible evidence chain.

Pre-production checklists for solo founders. 4,685 items, 88% portable to any stack, 26 stack supplements — plus AI/agent security and the b

Fast, self-contained vulnerability scanner (single Go binary) for web apps, APKs and binaries - extensible with JSON and nuclei YAML templat

Autonomous web-app pentest engine — a multi-agent pipeline wielding 30+ offensive-security tools as skills, PoC-validated findings. Built on

AI-powered vulnerability triage platform for Python projects. KIRTA combines SBOM, SCA, static code analysis, call maps, and AI explanations