Havuz

ADR, AI agent’ları keşfetmek, etkinliklerini gözlemlemek ve riskli davranışları tespit etmek için araçlar ile benchmark’lar sunan açık kaynaklı bir güvenlik sistemidir.

Neden yükseliyor · AI agent güvenliği güncel ve kurumsal ölçekte büyüyen bir ihtiyaç; Uber’in projeyi açık kaynak olarak yayımlaması, README’de üretimde kullanıldığını ve MLSys 2026’da kabul edilen bir makaleyle desteklendiğini belirtmesi ilgiyi artırıyor. 167 günde 1.620 yıldızın yanı sıra son 28 gündeki 44 commit ve 15 farklı yazar, kayda değer proje etkinliğine işaret ediyor; ancak yıldız geçmişi olmadan yükseliş hızını doğrulamak mümkün değil.

iFixAi, AI agent’ları yapılandırılabilir testler ve model judge’larıyla denetleyip puan kartı ve raporlar üreten bir Python aracıdır.

Neden yükseliyor · 153 günlük bir depoda 15.702 yıldız ve son 28 günde 9 commit ile 5 farklı yazar görünmesi güçlü ilgiye ve devam eden katkıya işaret ediyor. README’de birden fazla kullanım yolu ve agent ekosistemi entegrasyonları öne çıkarılıyor; ancak yıldızlar ürün kalitesini veya değerlendirmelerin doğruluğunu kanıtlamaz.

Local security audit for AI API relays and LLM proxies: detects prompt injection, model substitution, tool-call rewriting, SSE anomalies, er

Self-hosted AI API and MCP gateway for organizations: SSO and RBAC, per-user identity for MCP tool calls, PII redaction and tool-call guards

Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drif

Open-source adversary emulation for AI agents and MCP servers.

Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysi

Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own mo

An intentionally vulnerable OWASP LLM Top 10 training platform for AI Security, Prompt Injection, RAG Security, Agent Security, and GenAI pe

Your AI's guard dog. Doberman sits at runtime, gating every input, output and tool call to stop unsafe or unintended actions before they exe

A deterministic privacy boundary between your data and AI.

Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for

Supervised, Hermes-native penetration testing profile with 35 routed playbooks, guarded target execution, persistent engagement state, evide

Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS,

AI 应用合规网关 · 一行命令体检 AI 项目的「数据出境 / 硬编码密钥 / 个人信息暴露」（网安法·PIPL·等保2.0·数据出境·AI标识），并给出境内模型替代建议；可作运行时防护拦截注入与数据外泄 · 中文优先 · 零依赖 · 开源

OpenKeylet — Local password and credential manager for AI agents via MCP. Use passwords, API keys, SSH, and TOTP while keeping hidden plaint

Composable data security plane for Model Context Protocol. Pluggable layers — collect, analyze, guard — across 50+ enterprise providers. Ope

Open-source security skills for AI coding agents. Grounded in OWASP, NIST, MITRE ATT&CK, CIS. Works with Claude Code, Gemini CLI, Cursor, Co

Curated archive of jailbreak and prompt-injection experiments for AI model robustness research, red-teaming, and defensive evaluation.

Autonomous Bug Bounty Hunting Framework powered by Claude Code. 20 AI agents, state-machine orchestration, Burp Suite MCP, credential vault,

Prompt-injection guardrail for LLM applications. Compact model that outperforms larger open-source guards. No regex, no signatures. Demo: an

Open source authorization engine for AI agents. Confidence-aware gating · Human-in-the-loop review · Policy-as-code · Full audit trail

Let your AI agent use your passwords and API keys - without ever letting it see them

AI red-teaming tool and LLM security framework to evaluate agentic AI applications. Tests prompt injections, handles vulnerability assessmen

Trace-backed Agent Authorization Reviews for tool-using AI agents. Staging-only evidence for payment, record-change, access, and export acti

Self-hosted PII redaction proxy for LLM APIs and agent CLIs. Scrubs names, emails and secrets from Claude Code, Codex and any OpenAI-compati

Security control plane for AI agents — identity and delegation, capability policy, data-flow taint and a live audit trail, enforced over MCP

🦞 Local, read-only security audit for your OpenClaw agent. Finds config, prompt-injection and supply-chain risks, watches for drift, and ve

Executable security regression testing for agentic applications and MCP-integrated systems.

🤖 LLM Engineering Roadmap — Complete Developer Guide

Open-source security gateway & static scanner for AI agents. Enforce role-based access control (RBAC), human-in-the-loop approvals, segreg

Zero-dependency TypeScript secret and PII redaction for any SDK, logs, HTTP, LLM prompts, and scoped MCP tool boundaries.

pytest for AI agents - Autonomous red-teaming, behavioral monitoring & security testing for LLM agents

Defense-in-depth security toolkit for LLM agents — taint tracking, proxy secret guard, policy engine, and red-team benchmarking

Self-hosted AI security proxy. Redact PII, block prompt injection, route to any LLM provider. OpenAI-compatible.

The AI security agent guards your code.

AI Firewall & LLM security toolkit - protect your AI applications from prompt injection, jailbreaks, PII leakage, and adversarial attacks

Open database of system prompts extracted from frontier LLMs using JustAsk

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

RAG pipeline security testing toolkit - 27 techniques across 6 kill chain phases, mapped to MITRE ATLAS

Trust nothing. Ship safely. — Skeptical-reading and prompt-injection defense skill for AI agents. Provenance tagging, red-flag patterns, ref

🛡 The reference playbook for pentesting AI chatbots & LLM-powered apps in one place. Ready-to-use payloads covering the full OWASP LLM Top 1

Local-first policy gateway for coding agents. Allow, review, or block MCP, shell, SQL, GitHub, and HTTP actions with scoped credentials and

Local-first security scanner, MCP protocol inspector, dynamic fuzzer, Docker sandbox, and report generator for Model Context Protocol server

Runtime visibility for Python MCP servers. Captures tool calls, session lifecycle, module imports (SHA-256), and subprocess execution as str

Concurrent Go CLI that detects hidden prompt-injection content in documents — invisible Unicode, homoglyphs, hidden HTML, and known trigger

Document extraction and validation for logistics companies.