Havuz

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed,

AgentGuard: Zero-Trust Security Foundation for AI Agents

An AI that administers Linux through typed, approval-gated, Ed25519-audited actions. The model selects the action; the daemon builds the com

Security checklist for vibe coded apps. AI rules file + automated audit + manual verification.

AI 应用合规网关 · 一行命令体检 AI 项目的「数据出境 / 硬编码密钥 / 个人信息暴露」（网安法·PIPL·等保2.0·数据出境·AI标识），并给出境内模型替代建议；可作运行时防护拦截注入与数据外泄 · 中文优先 · 零依赖 · 开源

A Python CLI tool that scans all repositories owned by a GitHub user/org for accidentally committed secrets (API keys, tokens, passwords, pr

Agent-assisted maintainership and development framework for Apache projects — Triage, Mentoring, Drafting (agent-authored fixes with human r

被动JS分析 + 框架识别 + 主动Fuzz + 响应指纹 — 红队API挖掘利器

Free, MIT-licensed MCP security testing from ClearFrame. Scan, audit, compare, and review locally; continue in the ClearFrame CLI or Mac app

A fast, keyboard-driven HTTP intercepting proxy and pentesting toolkit for the terminal built for humans and AI agents alike.

Alignment-research scaffold (autoresearch-style) for LLM guardrails: search over a single policy.md surface

macOS companion toolkit for power users

All-in-one Docker/Podman image: hermes-agent + hermes-webui + hermes-dashboard in a single container

"ULTRASHIP" Claude Code plugin — 39 skills, 33 tools, 11 agents for ship-ready workflows: planning, review, pentesting, safety guardrails, c

Claude Code skill that enables Claude to extract, analyze, reverse engineer iOS apps

DevSecOps for the AI-era CI/CD pipeline. Catches the bugs your AI coding assistant introduces — before they reach production.

An open taxonomy and scoring framework for evaluating AI agent sandboxes: 7 defense layers, 7 threat categories, 3 evaluation dimensions, 27

Android APK 加固工具（DEX 加密 + 壳保护 + 反调试） · Android APK hardening — DEX encryption, stub loader & anti-debug

Reusable JWT authentication starter for Spring Boot featuring auto-configuration, Spring Security integration, JWT authentication filters, p

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

Kubernetes security assessment CLI: RBAC, pod-escape, and privilege-escalation path analysis. Cloudsplaining for Kubernetes.

Policy guardrails for coding agents (Claude Code, Codex, Cursor) — every tool call is checked locally, before it runs.

A local MCP runtime that attacks what you own and only reports what it proved. 17 CVEs across 9 projects came out of this repo. Install: npx

The AI-friendly binary analysis & decompilation engine — 1:1 lift, built on LLVM [WIP]

Universal Zero-Refusal Agent Framework - 40+ jailbreak templates (T1-T119), 1128 curated skills, executable framework-core, installer untuk

The AI-friendly C23 compiler for security research, built on LLVM [WIP]

Open-source security skills for AI coding agents. Grounded in OWASP, NIST, MITRE ATT&CK, CIS. Works with Claude Code, Gemini CLI, Cursor, Co

Dependency-free preflight checks for repositories before making them public

Tiny filesystem honeypot for macOS. Mounts fake secret files (.env, id_rsa, credentials.json) via WebDAV (no root) or NFS (root) — any acces

Autonomous Bug Bounty Hunting Framework powered by Claude Code. 20 AI agents, state-machine orchestration, Burp Suite MCP, credential vault,

Free, open-source tool to build a NIST CSF 2.0 Current Profile and gap analysis from an organization's documents (AI-assisted, human-validat

Predict the silent integration traps an AI agent would ship (zero-revenue configs, auth bypasses, immutable wrong choices) — then enforce, i

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

MCP server for AI agent for cybersecurity: automate assessment of documents, questionnaires & reports. Multi-format parsing, RAG knowledge b

Offline cyber security agent for your apps and AI coding tools. Open R&D: measured in public, improved every release.

Find and redact secrets in AI coding agent histories (Claude Code, and more).

Per-entry-point, navigable call-graph visualizations of Solidity repositories — for Web3 security auditors.

Tamper-evident audit trails for AI agents: hash-chained Runtime Records, dependency-free, verifiable by anyone.

Self-hosted personal AI agent with a WebUI, memory, tools, MCP, sub-agents and automations. Connect local or cloud LLMs.

Sandbox for AI coding agents (Claude Code, opencode, pi): runs each project in an isolated microVM with host-side secret injection. Linux/KV

OAuth 2.1 Authorization Server for the Model Context Protocol (MCP)

Audit and fix your Mac's security in one command. No agent, no signup, open source.

Agent Canary 3.0: open-source MCP, SDK, and CLI security toolkit with a guarded execution gateway, decoy signals, local tests, and public ac

Server-grade gateway that turns DeepSeek Harness into a multi-tenant platform: remote access + auto HTTPS, subuser permissions & quotas, san

Prompt-injection guardrail for LLM applications. Compact model that outperforms larger open-source guards. No regex, no signatures. Demo: an

Automated detection and tracking of fake engagement on GitHub — daily CI, zero infrastructure

Offline password, identity, and secret vault. Argon2id + AES-256-GCM, zero servers, zero telemetry.

Sandbox for running AI coding agents autonomously: isolated, network-restricted, host-safe

One command. 29 battle-tested security checks built into every AI coding assistant you already use without leaving your IDE.