Havuz

Free local guardrail for AI coding agents: every tool_call judged on-device (regex + Laya), allow/review/block

Runtime visibility for Python MCP servers. Captures tool calls, session lifecycle, module imports (SHA-256), and subprocess execution as str

AI 辅助的授权渗透测试平台（基于 Ed1s0nZ/CyberStrikeAI 二次开发）：单/多智能体交战、本地近5年 CVE 语料与每日增量同步、GitHub-C2 交接、经验总结人审入库、HITL 审批与审计。

Self-hosted CVE triage for your root servers: Trivy scans, LLM-judged exploitability, only the findings that matter.

Free client-side password and key generator for secure passwords, API keys, UUIDs, JWT secrets, and encryption keys. Powered by the Web Cryp

MCP server with 55 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), dom

DropLink is a decentralized, temporary peer-to-peer sharing platform. Files, folders, links, and chat messages move directly between browser

Track the lifetime of leaked secrets through git history - detect credential-shaped strings offline and report how long each stayed exposed.

Pure-Rust Android decompiler and security-audit suite. DEX → Java, Hermes → JavaScript. Cross-layer taint across the React Native bridge. Cy

🔒 Jail OpenCode, Claude Code, Copilot CLI and OmO in micro-VMs: only your project folders, only the networks you allow.

Generates executable Proof-of-Concept for any bug in any project. AI agents discover and reproduce vulnerabilities — verified, not hallucina

Privacy-first SOS application for sending emergency messages and real-time location updates to trusted contacts.

Minimalistic FIDO2 authenticator for Linux built to have convenience of Windows Hello

Browser extension with 35+ rules for keeping your AI agent safe while browsing

Argus — the all-seeing eye for Microsoft 365. Self-hosted, Dockerized notification & reporting for IT admins and security teams.

Static-analysis-based dataset for training LLMs to detect, explain, and patch security vulnerabilities (Java, Korean/English annotations, ve

compiles your JS to encrypted bytecode run by a obfuscated bundled vm

🔐 The password manager for terminal users and AI agents. Age-encrypted, keyring-cached, MCP-ready. Zero telemetry.

Keyed reversible source code obfuscator for Rust: syntactically valid, functionally identical, spiritually hostile.

Myrtia — agent-native red teaming for LLMs and AI agents: a deliberating council of attacker models (propose, cross-critique, Borda vote, ch

Inventario as-built y health check de servidores Windows en un solo .ps1

A health check for AI-written code. Finds leaked secrets, broken APIs, privacy risks and code-health issues in JavaScript, TypeScript, Pytho

Free, open-source SSH client, SFTP, tunnels, database GUI and a secure AI-agent (MCP) bridge in one app a MobaXterm, PuTTY and Termius al

Black-box web penetration testing automation framework for AI Agents

Lightweight SSH login observability for Linux servers. Sends a rich push notification via ntfy on every SSH login and failed attempt, and sh

OSS license watchdog. Monitors GitHub repos you depend on and alerts you when a license changes, explaining exactly what you can no longer d

Local-first MCP policy proxy. Tool-block, SQL-mutation gate, PII redact, audit, rate-limit, OpenTelemetry, vault secrets, first-use quaranti

基于 LLM 的白盒漏洞挖掘 Agent。四条挖掘路径（启发式、快速扫描 Sink 回溯、历史漏洞绕过、无约束）+ Docker 靶场 / 局部 harness / 静态验证，支持互联网复现与攻击链串联。 LLM-based white-box vuln mining agent

Find vulnerabilities. Ship secure. — Senior security-engineer skill for AI coding agents. OWASP Top 10, CWE Top 25, secrets detection, IaC +

Run a command in a sandbox with the same flags on every OS — one capability model compiled to Seatbelt (macOS), gVisor (Linux), and AppConta

CLI for Local Isolated Environments for Coding Agents

Styx is where everything converges: every repo you work in, the AI coding agents building in them, and every login they need to ship. Switch

Claude Code Architecture Deep Analysis — 14-chapter report, 7 languages | Claude Code 架构全景分析 — 14章报告，7种语言

Security gate for AI-generated code - blocks the build until vulnerabilities are fixed

Practical DevOps interview questions for Aspiring DevOps Engineers

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers,

Agentless SOC & GRC — SIEM, FIM, MITRE ATT&CK, compliance over SSH. Nothing installed on servers. Web · Windows · Linux · Docker.

Semantic shell command safety classifier — AST-based risk scoring for AI coding agents

Runtime security for AI agents. In-process, zero dependencies, Apache 2.0.

Real-time data anonymization for LLMs: secure your logs and conversations across cloud or local environments. Docker-ready & Multi-IA suppor

Secure MCP access to local repositories — without shell, Git, or arbitrary writes.

Static analyzer for Postgres Row-Level Security — 67 lint rules covering tenant and per-user row-scoping bugs, performance traps, and hygien

Soup Wall: open-source security for AI agents and model traffic. Local Agent, Gateway, self-hosted Console. Apache-2.0.

Noisegate: a differential privacy gateway that lets an untrusted LLM agent query sensitive data over MCP (Model Context Protocol), with a fo

HashiCorp Vault + GitHub Actions — secrets management and CI/CD integration on Kubernetes

Web UI for remote firewall security audits over SSH (iptables/nftables/ufw)

Batteries-included, transport-agnostic authentication for FastAPI.

Donate your spare AI usage for Open Source security

Coral is an open-source, local-first session bridge that lets AI agents borrow a user's already-authenticated browser sessions on a per-site

🔎 Fast, local search across the CS research literature, with an expressive query language, an interactive TUI, and scriptable output.