Havuz

AI 自主渗透测试 · 红队作战平台 | 多 Agent 自主推进 · 漏洞情报运营 · 后渗透与 C2 | LLM 三通道轮询 | 全程证据留痕 | 原百度攻防赛冠军项目独立演进版

Defense-in-depth security toolkit for LLM agents — taint tracking, proxy secret guard, policy engine, and red-team benchmarking

Sandboxed OCI container images for AI coding agents, built reproducibly with Nix.

Every live OMP session. One private page, in any modern browser.

All-in-one open-source framework & middleware for enterprise-grade multi-tenant and multi-tier XaaS Services development

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

go-dev-auth The comprehensive authentication library for Go. One config struct. Batteries included. Own your users.

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

The AI security agent guards your code.

A distributed OpenTelemetry-native columnar datastore whose only backend is object storage.

A collection of public writeups on attacks against AI agents: prompt injection, tool abuse, memory poisoning, and data exfiltration.

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态

Remove metadata from photos, PDFs, Office documents, audio and video. Strips EXIF, GPS location, camera serial numbers, author names and tim

Measure what a vulnerability is worth to your business, not how severe it is in the abstract. Business Exposure Index scoring over NVD, EPSS

One command. Full stack. Zero compromise. — All-in-one Claude Code skill with 33 modes, 6-layer security, 23 hooks, and 75% token savings

Every way an LLM can break one SDK to stop it. Injection. Hallucination. Leakage. Handled.

让你通过浏览器安全地远程使用 DeepSeek Harness：登录、MFA 两步验证、角色权限和远程文件预览。 | Use DeepSeek Harness securely in a remote browser with login, MFA, roles, and rem

Network-wide ad & tracker blocking DNS server. Go backend, React dashboard, 200K+ blocked domains, real-time analytics via WebSocket.

Local-first privacy toolkit. Map yourself against 400+ data brokers, send CCPA/GDPR deletion mail, and check password dumps. The vault never

Fast, zero-dependency access log analyzer, security threat inspector, and TUI dashboard for Caddy v2

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

Build AI agents and LLM workflows visually. Security-maintained continuation of Flowise: security fixes, Apache-2.0 only, drop-in for your e

Docker sandbox for the Claude Code CLI. Runs Claude against one project folder — including with --dangerously-skip-permissions — while your

Hide Your TailwindCSS 👀

Local guardrails for coding agents. Policy, approvals, 86 safety packs, OS sandbox, audit trail — no Docker.

C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel

Luvv-MCP 是一个 AI 原生的前端安全分析引擎，接入 Claude Code 后，你说一句"帮我审计这个网站"，AI 就能自动完成技术栈识别（1.8 万条规则覆盖 CMS/框架/CDN/中间件）、泄露扫描（阿里云 AK、GitHub Token、Webhook、J

Hands-off supply-chain watchdog for dev machines: orchestrates multiple security scanners (Perplexity bumblebee + osv-scanner, govulncheck,

Encrypts folders and files on Linux Mint (Cinnamon/Nemo) using AES-256, making it feel like a native part of the system: double-click on the

Paste a redacted copy of your clipboard with one hotkey. Hides API keys, tokens, passwords and PII (900+ patterns) before they reach AI chat

Confine an AI coding agent to one directory with a BPF-LSM program, and watch every escape it tries.

Modular post-install setup script for Fedora Linux (KDE)

Evidence-driven production readiness checklist for shipping web applications with confidence

Orb44 Watch satellite - inside pulse from your VPS (load, listeners, hardening).

A curated collection of AI SecOps 24 SKILL.md capabilities for security work offensive security, SOC and detection engineering, cloud and Ku

Grepleaks — your AI pentest environment. An AI pentest agent that lives in your terminal.

🛡️Self-hosted security analytics & threat detection for Discord servers. Real-time phishing, raids, spam detection. Privacy-first with GDPR

Cryptographic trust and authorization evidence for AI agents. Every action a receipt, every grant a proof.

Detect and patch vulnerabilities in AI-generated Python code — VS Code extension

Run AI coding agents in sandboxed containers communicate via ACP

Local traffic visibility and privacy controls for coding agents. See what Claude Code, Codex and Copilot send to the model; mask secrets and

A codebase scanner that helps you not run malicous code

Safe runtime for Claude Code, built to be yours.

Solana's SOL-0XX security standard — bug-class rules distilled from $514M of real exploits, firing as you code in every AI tool, editor & CI

Automatic, model-driven permission review for OpenCode

Self-hosted multi-engine Sigma detection for event logs

Local-first security scanner, MCP protocol inspector, dynamic fuzzer, Docker sandbox, and report generator for Model Context Protocol server

Zero-dependency Web Application Firewall in Go. Single binary. Three deployment modes. Tokenizer-based detection.

AuditSentry — AI-powered smart contract security auditor for Claude Code. Automated vulnerability detection, exploit PoCs, mainnet-fork simu

No WiFi? Now WiFi. One command. 27 techniques. Bypass any captive portal.