Havuz

Local-first code audit workbench for Opengrep. Scan locally, track findings across versions, verify fixes, and produce reproducible security

Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for

Lint, search, and install Agent Skills (SKILL.md) — CLI + MCP server + lint engine

EvalForge, AI evaluation sonuçlarını baseline karşılaştırmaları ve CI quality gate’leriyle değerlendirip standart rapor formatlarında yayımlar.

Neden yükseliyor · RAG evaluation sonuçlarını CI’da denetlenebilir kanıta ve release gate’lerine bağlama ihtiyacına odaklanıyor; repo 34 günde 211 yıldız almış. Ancak README bağımsız doğrulanmış downstream benimsemenin henüz bulunmadığını belirtiyor ve son 28 günde katkı tek yazardan gelmiş; ilginin gerçek kullanımın kanıtı olduğu söylenemez.

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum au

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Evidence-grounded cryptographic inventory and post-quantum migration planning for software repositories. Local static analysis, zero mandato

Modern offline-first Application Security Intelligence Platform for Android, iOS, Flutter and React Native with attack-chain analysis, expla

Global-readiness toolkit for international forms across HTML, JSX, Vue, Svelte, and CI.

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed,

Free, MIT-licensed MCP security testing from ClearFrame. Scan, audit, compare, and review locally; continue in the ClearFrame CLI or Mac app

Independent security verification for code written by humans and AI agents. Scan, repair, then prove it — Dvalin runs your project's own che

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

The deterministic merge gate for AI-generated agent capability changes — a local-first, static Tool-Use Readiness review for MCP, OpenAPI, a

Offline prompt-contract auditor for Hermes, Claude Code, Codex, OpenCode & OpenClaw. Pre-write guard before agents ship vague code. Zero dep

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

ImpactGuard — Lightweight multi-language API impact analyzer

Help your agents find the smoking gun they're looking for. Optimization evidence for agents: find complexity hotspots.

Agent Reliability Analyzer for AWS CodePipeline and CodeCatalyst: find agent reliability issues

Scan agents and auto-remediate agent reliability issues in GitHub Actions

phpcpd-next is a token-based copy/paste (clone) detector for PHP 8.4+, a modernized, openly-licensed successor to Sebastian Bergmann's phpc

Local-first security scanner, MCP protocol inspector, dynamic fuzzer, Docker sandbox, and report generator for Model Context Protocol server

Static Ansible linting in Go: the 38 ansible-lint rules decidable from YAML alone, byte-for-byte pep8 output, no Ansible runtime.

CLI-first AI code review — BYOK, diff/scan/branch, pre-commit hooks. 100% open source (MIT).

Agent Reliability Analyzer MCP server for Cursor: find agent reliability issues in MCP servers

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Local, deterministic review of Git changes: weakened tests and CI gates, security boundaries, blast radius. CLI, GitHub Action, MCP server,

NSAuditor AI Community — open-source network security scanner. 27 discovery plugins, structured findings, SARIF/CSV output, MCP integration,

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS. Runs in CI and

Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled

An architectural audit where a finding is admissible only once its cost is measured from git history. A doctrine for coding agents plus a st

Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or d

Evidence-first Codex, Claude plugin for bugs, security, and 10k-to-1M-user scale readiness.

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Deterministic security analysis for Stellar Soroban smart contracts and Rust projects.

FSharp refactoring tool - The tool clarifies the (agent-generated or old) code's intent, reduces non-alphanumeric noise, and uses built-in .

Static, no-execution security checks for Hermes Agent plugins

What a PDF says out loud. The PDF accessibility checker that runs anywhere: PDF/UA-1 + WCAG 2.2 in your terminal, CI and browser, plus the s

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

Deterministic security analysis for agent skill files.

Catch EU regulatory violations at PR time — GDPR, EU AI Act, NIS2, DORA, CRA, DSA, DMA and the Data Act. Runs entirely on your machine or CI

CI-friendly CLI and API that fails builds when deployed URLs are missing or misconfigure HTTP security headers (HSTS, CSP, COOP, cookies...)