Havuz

SkillSpector, AI agent skills paketlerini yüklemeden önce güvenlik riskleri açısından tarayan bir Python aracıdır.

Neden yükseliyor · AI agent skills ekosistemindeki güvenlik ihtiyacına doğrudan yanıt veriyor ve NVIDIA Verified Skills pipeline'ıyla bağlantılı. 191 günlük bir repo için 18.391 yıldızın yanı sıra son 28 günde 144 commit ve 24 farklı yazar, dikkat çekmenin yalnızca README iddialarına dayanmadığını gösteriyor.

Multi-tier framework for evaluating AI agent skills with quality gates, semantic overlap detection, synthetic evaluation dataset generation,

Open-source antivirus and firewall for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugi

Adversarial AI bug hunter with auto-fix skill for Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI, Opencode, Pi Coding Agent, a

Local security audit for AI API relays and LLM proxies: detects prompt injection, model substitution, tool-call rewriting, SSE anomalies, er

Cross-Code Organizer (formerly Claude Code Organizer): cross-harness config dashboard for Claude Code, Codex CLI, MCP servers, skills, memor

Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS,

DreamGraph is a graph-governed conceptual development environment (CDE) that turns plans, architecture decisions, and project knowledge into

AI protocol scanner — discover exposed MCP servers, A2A Agent Cards, and open LLM APIs in one command. 一条命令盘点 MCP、A2A Agent Card 和 LLM 开放接口暴

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

Open source CSPM for Azure - scan for misconfigurations and quantum-unsafe cryptography, map findings to CIS/NIST/ISO27001/SOC2, and fix the

Supabase RLS checker and security scanner for Vercel + Supabase apps (CLI + MCP server): tables without RLS, using (true) policies, service_

Advanced web security scanner with 49 modules, evasion engine, and CVE database.

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

A modular threat detection library for AI and LLM pipelines. It provides language-agnostic guardrails through a configurable pipeline of loa

A codebase scanner that helps you not run malicous code

Security scanner for MCP servers, source trees, and packages, with explicit findings and coverage reporting.

GRASP — Code architecture visualizer + 150-tool MCP server. Dependency graphs, security scanning, multimodal knowledge graph, ORM tracking,

Open-source AI security tool to scan and fix vulnerabilities in your vibe-coded projects before you ship. AXguard by AwareXone.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

NSAuditor AI Community — open-source network security scanner. 27 discovery plugins, structured findings, SARIF/CSV output, MCP integration,

gitghost — find secrets in a GitHub account's public repos, including ones 'deleted' but still recoverable from git history. Exposure score

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, an

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, ne

Local-first security for developers and their AI coding agents. Finds risky agent settings (hooks, auto-approve, unpinned MCP servers), API

Sandboxed multi-scanner security for AI skills, MCP servers, and package trees — coverage honesty, SIE judging, heatmap posture, guided tria

Autonomous web-app pentest engine — a multi-agent pipeline wielding 30+ offensive-security tools as skills, PoC-validated findings. Built on

MCP security scanner & config linter for AI coding agents. Finds leaked secrets, risky commands, broad permissions and invalid MCP servers i