Havuz

Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Cod

Local, evidence-based application security assessment engine and Claude Code plugin

Mantis, AI coding agents ile kod tabanlarındaki güvenlik açıklarını araştırma, yeniden üretme ve düzeltme iş akışları kurmaya yönelik modüler bir toolkit ve referans harness sunuyor.

Neden yükseliyor · AI agent’lar ile güvenlik açığı bulma ve düzeltme ilgisinin artması projeye görünürlük kazandırmış olabilir; ancak yalnızca verilen ölçümlerden yükselişin nedenini doğrulamak mümkün değil. 104 günlük yaşında 1717 yıldız dikkat çekici ilgi gösterse de son 28 gündeki 5 commit ve 1 farklı yazar, güncel geliştirme hareketliliğinin sınırlı olduğuna işaret ediyor.

Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own mo

Local-first code audit workbench for Opengrep. Scan locally, track findings across versions, verify fixes, and produce reproducible security

DianXing - AI-Driven End-to-End Code Security Auditing

Open Source Agentic Security Scanner

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum au

Open-source cybersecurity analysis agent for Claude Code. Scans projects for vulnerabilities across all OWASP 2025 Top 10 and CWE Top 25 cat

codexqa: 11 local-first Agent Skills for Cursor, Claude Code, Codex & OpenClaw — change impact analysis, AI code review, defect scan, testca

Independent security verification for code written by humans and AI agents. Scan, repair, then prove it — Dvalin runs your project's own che

DevSecOps for the AI-era CI/CD pipeline. Catches the bugs your AI coding assistant introduces — before they reach production.

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Evidence-driven Java security review workbench

LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.

ImpactGuard — Lightweight multi-language API impact analyzer

Local-first MCP security scanner for AI-generated apps. Scan → fix → rescan from Claude Code, Cursor, Codex, and other agents.

Application security and governance platform — one check covers code flaws, leaked secrets, and dependency/image vulnerabilities, with merge

The AI security agent guards your code.

Outside-in replication of Anthropic's Mythos Preview / Project Glasswing — open-source agentic vulnerability-discovery scaffold on Claude Op

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

A fast experimental PHP static analyzer written in Rust, a port of Psalm

Static-analysis-based dataset for training LLMs to detect, explain, and patch security vulnerabilities (Java, Korean/English annotations, ve

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Security gate for AI-generated code - blocks the build until vulnerabilities are fixed

Cybersecurity knowledge graph for code review with evidence-backed answers

AI security agent for the Python supply chain: scans packages, generates exploits, and validates them in Docker, autonomously.

Open-source AI security tool to scan and fix vulnerabilities in your vibe-coded projects before you ship. AXguard by AwareXone.

🥷 Give your codebase a black belt. Local code intelligence, security analysis, and compiler-backed facts for humans and AI.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

GSC — verified remediation engine: SAST that proves exploits (PoC), verifies fixes (Proof-of-Fix), and self-heals CI. Apache 2.0 + Commercia

GitFlic is a GitLab and GitHub alternative for Git repository hosting, code review, issues, CI/CD, package registry, SAST/DAST/SCA, availabl

An open-source AppSec agent that reasons like an analyst: real scanners, your org's context, and a conversation instead of 400 findings.

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

Nephilex is an open-source AI Security Engineer that analyzes repositories, detects vulnerabilities, validates risks, explains findings, gen