Havuz

Claude Code ve uyumlu agent harness'leri için web güvenliği ve red-team çalışmalarına yönelik beceriler, komutlar ve iş akışları sunan bir skill bundle'dır.

Neden yükseliyor · 145 günlük yaşına göre 4.671 yıldız ve son 28 günde 37 commit dikkat çekiyor; bu, güncel geliştirme ve görünürlük sinyali. Ancak 3 farklı yazarla katkı tabanı dar ve README'deki 'battle-tested' iddiası bağımsız kullanım verisiyle doğrulanmıyor.

🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomo

Cairn, hedef ve başlangıç durumu verildiğinde ortak bir durum grafiği üzerinden keşif görevleri yürüten, ilk olarak otonom penetration testing alanında denenmiş bir AI search engine’dir.

Neden yükseliyor · 162 günlük bir repoda 3.082 yıldız dikkat çekiyor; README, Tencent Cloud Hackathon’daki 54/54 başarı iddiasını ve 610 takım arasındaki sonucunu öne çıkarıyor. Bu sonuç proje tarafından raporlanmış; bağımsız doğrulaması verilen bilgilerde yok. Son 28 günde 1 commit ve 1 farklı yazar bulunması, yıldız ilgisinin güncel geliştirme temposuyla aynı ölçüde desteklenmediğini gösteriyor.

Fush Vue MCP —— Vue 前端逆向 + Web 安全测试工具（Chrome 扩展 + MCP 服务端，91 个工具）

Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.

pentest-ai-agents, Claude Code içinde yetkili penetration testing iş akışlarına yönelik uzmanlaşmış subagent’lar sunan bir koleksiyondur.

Neden yükseliyor · 188 günde 2301 yıldız, Claude Code için doğrudan kurulabilen 50 uzman agent ve geniş güvenlik kapsamına yönelik belirgin ilgi gösteriyor. Bunun benimsenme veya çıktı kalitesi kanıtı olmadığını; son 28 günde commit ve farklı yazar bulunmadığını not etmek gerekir. Yükselişin özel nedenini mevcut verilerle doğrulamak mümkün değil.

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay y

🔓 An AI web-pentest skill for Claude Code. Point it at a site you're authorized to test — it maps the attack surface, works through the OWAS

The agentic pentesting environment that lives on your machine. AI agent teams, visual workflows and your own tools, 100% local.

Pentest Harness, yetkili güvenlik testleri için farklı LLM sağlayıcılarını ve pentest araçlarını yerel bir arayüzde birleştiren self-hosted bir agent çalışma alanıdır.

Neden yükseliyor · 33 günlük bir repoda 398 yıldız dikkat çekiyor; ancak README dışındaki benimseme verisi bilinmiyor ve son 28 günde 2 commit ile 2 farklı yazar görülmesi geliştirme temposu hakkında güçlü kanıt sunmuyor.

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, de

Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2

DodoGuard: Take AI Agents to Production. Test, validate, and operate AI Agents before and after deployment.for Dify, Coze, FastGPT, n8n, Ten

AI red-team platform. Autonomous LLM agents run a penetration test end to end inside a Kali container and write the report. LangGraph plan/a

Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS E

Fast, self-contained vulnerability scanner (single Go binary) for web apps, APKs and binaries - extensible with JSON and nuclei YAML templat

all round pentest skill

Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysi

Local-first AI red team for web, API, and LLM application security. Attacker-style reasoning, evidence-backed findings, and skills for AI co

MCP server that connects AI assistants to HackerOne for bug bounty hunting

AI-powered MCP server for Burp Suite Professional — 149 tools across proxy, scanner, inline fuzzer, race conditions, guided injection, JWT/I

A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening (gM

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, expla

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态

MCP server for Frida.

Self-hosted pentest engagement management and report.

A fast, keyboard-driven HTTP intercepting proxy and pentesting toolkit for the terminal built for humans and AI agents alike.

Security checklist for vibe coded apps. AI rules file + automated audit + manual verification.

28 OSINT Agent Skills that turn Cursor, Claude & AI coding agents into a full open-source intelligence platform — reconnaissance, attributio

Autonomous Bug Bounty Hunting Framework powered by Claude Code. 20 AI agents, state-machine orchestration, Burp Suite MCP, credential vault,

27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code pl

A local MCP runtime that attacks what you own and only reports what it proved. 17 CVEs across 9 projects came out of this repo. Install: npx

TCP-enhanced fork of Cheat Engine MCP Bridge. Connect Cursor, Copilot and Claude AI directly to local or remote Cheat Engine via TCP. Automa

Local-first offensive security engagement platform for mapping assets, credentials, sessions, pivots, findings, evidence, and attack paths.

reconnaissance for agent attack surfaces

Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, cove

A secure, production-ready Python CLI wrapper for Nmap that makes powerful scans easy and repeatable. Includes 12 built-in profiles (SYN, ag

Fast, cross-platform CLI for finding secrets and sensitive data across filesystems, SMB, Active Directory, Microsoft 365, Slack, Jira and Co

open-source pentest management built to be operated by an AI agent

Zero trace. Full answer. — Transparent Claude API proxy that anonymizes PII and sensitive data before it leaves your environment. From pente

👻 AI-Powered Pentesting Command Center — Autonomous security testing with real-time streaming, self-improving AI, unlimited tool iterations,

Jadart is a fast Flutter decompiler designed for Agents/Mobile Security Researchers.

a lightweight, fast, and fully portable reimplementation of Impacket in TypeScript and JavaScript.

⚔️ Suite de hacking ético 100% client-side: +100 herramientas de ciberseguridad, forense, ingeniería inversa y anti-phishing que corren en t

MCP server bridging Claude/any LLM client to a persistent Kali Linux VM over SSH — scope-gated nmap, gobuster, nuclei & nikto with structure

OSINT tool for precise version fingerprinting of open-source web software

Offline pentest workflow tracker — turns nmap output into a port-aware, KB-matched recon checklist in under 30 seconds. Self-hosted, single

AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy,

An open library of 206 security skills for AI agents — pentest, bug bounty, CTF, reversing & defense across 23 domains, with CI-verified rou

Embedded Device Security Assessment Framework — 700 modules, 350 CVEs, 55 vendors, APT Group Engine. Covers routers, IP cameras, GPON ONTs,