Havuz

Secure WebView for React Native auth, checkout, OAuth, and other controlled web flows.

All-in-one Docker/Podman image: hermes-agent + hermes-webui + hermes-dashboard in a single container

Autonomous multi-agent pentest framework — plans, exploits, verifies (proof-required), CVSS-scores and writes client-ready reports. 104/104

A free, public vulnerability feed: CVE, GHSA, OSV, CISA KEV and EPSS merged into one entry per vulnerability. RSS, JSON API and MCP. Docs an

"ULTRASHIP" Claude Code plugin — 39 skills, 33 tools, 11 agents for ship-ready workflows: planning, review, pentesting, safety guardrails, c

Claude Code skill that enables Claude to extract, analyze, reverse engineer iOS apps

Reusable JWT authentication starter for Spring Boot featuring auto-configuration, Spring Security integration, JWT authentication filters, p

DevSecOps for the AI-era CI/CD pipeline. Catches the bugs your AI coding assistant introduces — before they reach production.

Android APK 加固工具（DEX 加密 + 壳保护 + 反调试） · Android APK hardening — DEX encryption, stub loader & anti-debug

An open taxonomy and scoring framework for evaluating AI agent sandboxes: 7 defense layers, 7 threat categories, 3 evaluation dimensions, 27

Lightweight, stateless privacy gateway for LLM APIs — redact secrets before OpenAI/Anthropic upstreams and restore them transparently in SSE

🔓 An AI web-pentest skill for Claude Code. Point it at a site you're authorized to test — it maps the attack surface, works through the OWAS

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

A local MCP runtime that attacks what you own and only reports what it proved. 17 CVEs across 9 projects came out of this repo. Install: npx

Kubernetes security assessment CLI: RBAC, pod-escape, and privilege-escalation path analysis. Cloudsplaining for Kubernetes.

Policy guardrails for coding agents (Claude Code, Codex, Cursor) — every tool call is checked locally, before it runs.

The AI-friendly binary analysis & decompilation engine — 1:1 lift, built on LLVM [WIP]

Universal Zero-Refusal Agent Framework - 40+ jailbreak templates (T1-T119), 1128 curated skills, executable framework-core, installer untuk

The AI-friendly C23 compiler for security research, built on LLVM [WIP]

Local, evidence-based application security assessment engine and Claude Code plugin

Open-source security skills for AI coding agents. Grounded in OWASP, NIST, MITRE ATT&CK, CIS. Works with Claude Code, Gemini CLI, Cursor, Co

Dependency-free preflight checks for repositories before making them public

Tiny filesystem honeypot for macOS. Mounts fake secret files (.env, id_rsa, credentials.json) via WebDAV (no root) or NFS (root) — any acces

nas: a zero-dependency Python CLI + MCP server for Synology DSM 7. One-command audit and fix for the C3RB3R / .L0CK3D ransomware campaign; h

Autonomous Bug Bounty Hunting Framework powered by Claude Code. 20 AI agents, state-machine orchestration, Burp Suite MCP, credential vault,

Free, open-source tool to build a NIST CSF 2.0 Current Profile and gap analysis from an organization's documents (AI-assisted, human-validat

Agent Canary 3.0: open-source MCP, SDK, and CLI security toolkit with a guarded execution gateway, decoy signals, local tests, and public ac

MCP server for AI agent for cybersecurity: automate assessment of documents, questionnaires & reports. Multi-format parsing, RAG knowledge b

Offline cyber security agent for your apps and AI coding tools. Open R&D: measured in public, improved every release.

Predict the silent integration traps an AI agent would ship (zero-revenue configs, auth bypasses, immutable wrong choices) — then enforce, i

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Find and redact secrets in AI coding agent histories (Claude Code, and more).

Per-entry-point, navigable call-graph visualizations of Solidity repositories — for Web3 security auditors.

Tamper-evident audit trails for AI agents: hash-chained Runtime Records, dependency-free, verifiable by anyone.

Self-hosted personal AI agent with a WebUI, memory, tools, MCP, sub-agents and automations. Connect local or cloud LLMs.

Sandbox for AI coding agents (Claude Code, opencode, pi): runs each project in an isolated microVM with host-side secret injection. Linux/KV

Server-grade gateway that turns DeepSeek Harness into a multi-tenant platform: remote access + auto HTTPS, subuser permissions & quotas, san

OAuth 2.1 Authorization Server for the Model Context Protocol (MCP)

Audit and fix your Mac's security in one command. No agent, no signup, open source.

Prompt-injection guardrail for LLM applications. Compact model that outperforms larger open-source guards. No regex, no signatures. Demo: an

Agent skills from StarSling

Automated detection and tracking of fake engagement on GitHub — daily CI, zero infrastructure

Offline password, identity, and secret vault. Argon2id + AES-256-GCM, zero servers, zero telemetry.

One command. 29 battle-tested security checks built into every AI coding assistant you already use without leaving your IDE.

Sandbox for running AI coding agents autonomously: isolated, network-restricted, host-safe

Feature-rich all-in-one self-hosted server & server fleet management (Web UI): patching, monitoring (agent + agentless/SNMP), CVE scanning,

Lightweight open-core SIEM in Rust — S3-compatible for logs, Postgres for state.

The Rails audit skill for AI coding agents, ranked by blast radius. 🚂☢️

Passive Bluetooth neighbourhood monitor for Raspberry Pi and Linux: a live radar, device triage, categories and alerts for new devices.

Hermes Agent (NousResearch) sandboxed by NVIDIA OpenShell — hardware-enforced network/filesystem/syscall policy, full memory + gateway stack