Havuz

Local, evidence-based application security assessment engine and Claude Code plugin

Catch .env secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked

MCP security scanner & config linter for AI coding agents. Finds leaked secrets, risky commands, broad permissions and invalid MCP servers i

Catch risky npm dependency changes before they merge.

Deterministic security analysis for Stellar Soroban smart contracts and Rust projects.

Adversarial security testing for AI agents — prompt injection, tool misuse, memory poisoning, and MCP scanning, with CI-ready regression tes

Coding-agent tools on TypeSafe's Jev, measured in public. review-router: caught 13 of 13 CVE fixes a filename rule sent to a quick review. j

Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, ne

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Keep your sensitive credintials out of the agents you build and the coding agent you use. Test any agent with planted fake keys, or see whic

Evidence-driven production readiness checklist for shipping web applications with confidence

Evidence-first Codex, Claude plugin for bugs, security, and 10k-to-1M-user scale readiness.

NEXUS REDFOX — Local-first code intelligence and security analysis platform for developers and security researchers.

A deliberately breakable three-tier platform plus a full DevOps / SRE / DevSecOps training curriculum (handbook, capstone assignment, soluti

Guardrails para desenvolver com agentes de IA: gate de CI bloqueante, hooks determinísticos, supply chain travada e fluxo de task com evidên

Catch EU regulatory violations at PR time — GDPR, EU AI Act, NIS2, DORA, CRA, DSA, DMA and the Data Act. Runs entirely on your machine or CI

Application security and governance platform — one check covers code flaws, leaked secrets, and dependency/image vulnerabilities, with merge

Let your AI agent use your passwords and API keys - without ever letting it see them

Git-aware secret & .env leak guard for TypeScript/Node — sub-second pre-commit scanning with the lowest false-positive rate.

Turn declarative exercises into reproducible, runnable and verifiable lab environments

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

Codex Security, kod depolarındaki güvenlik açıklarını taramak, doğrulamak ve düzeltme önerileri sunmak için CLI ve TypeScript SDK sağlar.

Neden yükseliyor · 76 günlük yaşına karşın yüksek yıldız sayısı ve son 28 gündeki 188 commit ile 20 farklı yazar, belirgin ilgi ve aktif geliştirme gösteriyor; OpenAI markası da görünürlüğüne katkıda bulunabilir. Bu veriler tek başına tarama kalitesini veya üretim ortamında benimsenmeyi kanıtlamaz.

Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free

Nephilex is an open-source AI Security Engineer that analyzes repositories, detects vulnerabilities, validates risks, explains findings, gen

Open-source security for AI coding agents: record, detect and block at the tool boundary, with a verifiable audit trail in the SIEM you alre

Local-first MCP security scanner for AI-generated apps. Scan → fix → rescan from Claude Code, Cursor, Codex, and other agents.

gitghost — find secrets in a GitHub account's public repos, including ones 'deleted' but still recoverable from git history. Exposure score

Offline cyber security agent for your apps and AI coding tools. Open R&D: measured in public, improved every release.

Automated Proof-of-Carrying Change Management for AIOps 2026

Red-team your RAG pipeline for prompt injection, source-document leakage, and cross-document smuggling, in CI. The gap between RAG eval (RAG

GSC — verified remediation engine: SAST that proves exploits (PoC), verifies fixes (Proof-of-Fix), and self-heals CI. Apache 2.0 + Commercia

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, an

Static secret scanner for source trees — regex rules, entropy scoring, and SARIF output for CI pipelines.

DianXing - AI-Driven End-to-End Code Security Auditing

Engineering best practices that AI coding agents actually apply — 40+ skills, from secure coding and cloud to compliance and UX writing. BUI

Mantis, AI coding agents ile kod tabanlarındaki güvenlik açıklarını araştırma, yeniden üretme ve düzeltme iş akışları kurmaya yönelik modüler bir toolkit ve referans harness sunuyor.

Neden yükseliyor · AI agent’lar ile güvenlik açığı bulma ve düzeltme ilgisinin artması projeye görünürlük kazandırmış olabilir; ancak yalnızca verilen ölçümlerden yükselişin nedenini doğrulamak mümkün değil. 104 günlük yaşında 1717 yıldız dikkat çekici ilgi gösterse de son 28 gündeki 5 commit ve 1 farklı yazar, güncel geliştirme hareketliliğinin sınırlı olduğuna işaret ediyor.

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, expla

See which external pull requests need context before code review. Deterministic, no login, no AI.

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

An AI-powered Git pre-commit/pre-push security gate

Automated CLI security auditor for web configuration vulnerabilities.

Govern: one Decionis verdict before a workflow step runs — a deploy, a migration, an infrastructure change, an agent's action — with a signe

Enterprise-ready CI/CD reference for Microsoft Foundry AI agents, with parallel GitHub Actions and Azure DevOps pipelines, evaluation-driven

GitFlic is a GitLab and GitHub alternative for Git repository hosting, code review, issues, CI/CD, package registry, SAST/DAST/SCA, availabl