Havuz

LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and L

Open-source practical cybersecurity learning platform with structured lessons, guided labs, progress tracking, and a custom Lab Engine.

🛡️ A modern, AI-powered WAF with visual forensic playback via rrweb. Protect your web apps with LLM-driven threat detection, real-time visua

28 OSINT Agent Skills that turn Cursor, Claude & AI coding agents into a full open-source intelligence platform — reconnaissance, attributio

Elevate your AI assistants (like Claude & Cursor) into autonomous cybersecurity experts. Pentester-MCP integrates 200+ pentesting tools via

Local-first credential manager & validator for red teams / pentest：致力于 ALL IN ONE 的本地凭据管理与验证平台。 允许将红队渗透测试中获取的散落在各处的 API Key、云厂商 AK/SK、机器人 To

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

Embedded Device Security Assessment Framework — 700 modules, 350 CVEs, 55 vendors, APT Group Engine. Covers routers, IP cameras, GPON ONTs,

Get Claude Code and other AI agents approved for use at work — deterministic guardrails on every tool call, tamper-evident audit logs, and a

A golang-written credential harvesting framework leveraging eBPF for kernel-level monitoring with anti-detection capabilities.

AI agent browser for web reverse engineering

Open-source benchmark of 5 intentionally vulnerable web apps with 100 baseline vulnerabilities for evaluating AI penetration testing agents.

企业暴露面收集与持续监控（ASM）自托管系统：多源采集、存活与指纹富化、风险线索与变更对照。支持 Linux/Docker 一键部署。

Protecting digital communications against audio deepfakes with real-time AI. This system analyzes audio streams to detect synthesized voices

High-assurance, artifact-agnostic prompt for authorized security labs, exploit-chain research, PoC validation, and evidence-led reporting.

The AI security agent guards your code.

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态

AI Firewall & LLM security toolkit - protect your AI applications from prompt injection, jailbreaks, PII leakage, and adversarial attacks

Outside-in replication of Anthropic's Mythos Preview / Project Glasswing — open-source agentic vulnerability-discovery scaffold on Claude Op

Open source browser lab to build a simulated infrastructure, watch an attack move through it, and check whether your defense works.

Open Source Firewall IP List Publishing

Scan, fuzz, and assess OT protocols from one CLI.

reconnaissance for agent attack surfaces

High-fidelity Claude Fable 5 (Mythos) environment emulation and automated multi-agent jailbreak (Pack Hunt) research laboratory.

Nutcracker is a powerful, modular and extensible framework designed for mobile security analysis and offensive threat intelligence. Detects

Local-first privacy toolkit. Map yourself against 400+ data brokers, send CCPA/GDPR deletion mail, and check password dumps. The vault never

SafeSurf AI is a fast and privacy-first browser extension that helps users browse safely by detecting and blocking adult or unsafe content i

Secrets scanner with a twist... this is for getting threat actor credentials from MALWARE. Acquire TA creds from FLOSS exports, memdumps, B

Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities (KEV) catalog into production-ready Sigma

C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel

LingXi: multi-agent CTF and pentest framework originated from Tencent Security Hackathon

Open-source local AI Agent desktop app for authorized security assessment — Electron + Mastra-powered runtime, visual pentest workflow, Kali

Grepleaks — your AI pentest environment. An AI pentest agent that lives in your terminal.

🛡️Self-hosted security analytics & threat detection for Discord servers. Real-time phishing, raids, spam detection. Privacy-first with GDPR

An open-source Linux terminal course from zero to Linux Power User.

A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening (gM

Evidence-first AI OSINT casefile with 40 passive modules, live recon streaming, provenance-led reports, and an entity graph.

基于Agent驱动的网络安全流量监控与分析平台，下一代AI驱动的安全运营协作平台 — 智能告警研判、资产关联、协同处置与自动化报告生成，为护网行动增添一把利器。

A lightweight network security tool that verifies IP location, validates network safety, and prevents access to protected links when unexpec

One verdict per IP, in plain words — evidence, confidence, geo & ASN fused from 60 public intel sources. 53/60 need no API key. One command,

Verifiable and free cloud compute for AI agents. webMCP + MCP native. Check out our sandboxed Beta + research in the README

Cyber Threat Intelligence Skills for each stage of the CTI Lifecycle.

Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, cove

MCP server with 55 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), dom

Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation

BGNexa AI — Evidence intelligence for cybersecurity, privacy and regulatory readiness.

A retro textmode blog theme for purists.

基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。

AI-powered deepfake detector that classifies uploaded face images and videos as Real or Fake with confidence scores. Full-stack app built wi