Havuz

Codex Security, kod depolarındaki güvenlik açıklarını taramak, doğrulamak ve düzeltme önerileri sunmak için CLI ve TypeScript SDK sağlar.

Neden yükseliyor · 76 günlük yaşına karşın yüksek yıldız sayısı ve son 28 gündeki 188 commit ile 20 farklı yazar, belirgin ilgi ve aktif geliştirme gösteriyor; OpenAI markası da görünürlüğüne katkıda bulunabilir. Bu veriler tek başına tarama kalitesini veya üretim ortamında benimsenmeyi kanıtlamaz.

Mantis, AI coding agents ile kod tabanlarındaki güvenlik açıklarını araştırma, yeniden üretme ve düzeltme iş akışları kurmaya yönelik modüler bir toolkit ve referans harness sunuyor.

Neden yükseliyor · AI agent’lar ile güvenlik açığı bulma ve düzeltme ilgisinin artması projeye görünürlük kazandırmış olabilir; ancak yalnızca verilen ölçümlerden yükselişin nedenini doğrulamak mümkün değil. 104 günlük yaşında 1717 yıldız dikkat çekici ilgi gösterse de son 28 gündeki 5 commit ve 1 farklı yazar, güncel geliştirme hareketliliğinin sınırlı olduğuna işaret ediyor.

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay y

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK,

Open-source antivirus and firewall for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugi

DianXing - AI-Driven End-to-End Code Security Auditing

Catch risky npm dependency changes before they merge.

A CI/CD Red Team Framework for demonstrating Build Pipeline security risks.

Harden your package manager configs against supply chain attacks.

Let AI agents investigate and operate infrastructure through declared actions, bounded by policy and host-side checks. Approvals when requir

Open-source cybersecurity analysis agent for Claude Code. Scans projects for vulnerabilities across all OWASP 2025 Top 10 and CWE Top 25 cat

Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for

Govern: one Decionis verdict before a workflow step runs — a deploy, a migration, an infrastructure change, an agent's action — with a signe

Open-source AI agent framework for security engineering across AWS, GCP, Azure, Kubernetes, GitHub & GitLab: AI-powered security review, fin

Private, self-hosted AI-native software engineering suite — unified identity (GM) plus AI agents, code collaboration, artifact management, t

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, expla

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed,

Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free

Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS,

A Python CLI tool that scans all repositories owned by a GitHub user/org for accidentally committed secrets (API keys, tokens, passwords, pr

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Subagent Verification for Claude AI Code Networks 2026

Automated Proof-of-Carrying Change Management for AIOps 2026

DevSecOps for the AI-era CI/CD pipeline. Catches the bugs your AI coding assistant introduces — before they reach production.

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Turn declarative exercises into reproducible, runnable and verifiable lab environments

Kubernetes security assessment CLI: RBAC, pod-escape, and privilege-escalation path analysis. Cloudsplaining for Kubernetes.

Policy guardrails for coding agents (Claude Code, Codex, Cursor) — every tool call is checked locally, before it runs.

Open-source security skills for AI coding agents. Grounded in OWASP, NIST, MITRE ATT&CK, CIS. Works with Claude Code, Gemini CLI, Cursor, Co

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Offline cyber security agent for your apps and AI coding tools. Open R&D: measured in public, improved every release.

Audit and fix your Mac's security in one command. No agent, no signup, open source.

Let your AI agent use your passwords and API keys - without ever letting it see them

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

Local, evidence-based application security assessment engine and Claude Code plugin

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

Hardening Linux automatisé avec Ansible — conformité ANSSI BP-028 (niveaux M/I/R/E). Durcissement système, réseau, SSH, utilisateurs + audit

A deliberately breakable three-tier platform plus a full DevOps / SRE / DevSecOps training curriculum (handbook, capstone assignment, soluti

The self-hosted token, certificate, license, and secret expiration manager with automated Certificate Lifecycle Management (CertOps) for tea

Open-source security audits for Supabase: a read-only MCP server, a CLI agent and a Claude Skill. Finds RLS misconfigurations, exposed keys

Local-first MCP security scanner for AI-generated apps. Scan → fix → rescan from Claude Code, Cursor, Codex, and other agents.

Application security and governance platform — one check covers code flaws, leaked secrets, and dependency/image vulnerabilities, with merge

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

The AI security agent guards your code.

Git-native AI code provenance: records which AI agent wrote which line, signs each attribution with ed25519, stores it in your git history.

Detect abandoned and end-of-life dependencies that CVE-based scanners don't flag, and rank which ones to remove first.

Measure what a vulnerability is worth to your business, not how severe it is in the abstract. Business Exposure Index scoring over NVD, EPSS

Hands-off supply-chain watchdog for dev machines: orchestrates multiple security scanners (Perplexity bumblebee + osv-scanner, govulncheck,

Evidence-driven production readiness checklist for shipping web applications with confidence