Havuz

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-

An open library of 206 security skills for AI agents — pentest, bug bounty, CTF, reversing & defense across 23 domains, with CI-verified rou

Proper sandboxing for agentic coding and web browsing

一款安全又便捷的网页加密工具。采用 AES-256 + PBKDF2 百万次迭代 + HMAC 验签，密码与解密全程留在浏览器本地；一条命令或图形界面即可把 HTML（乃至整站 css/js/图片）加密成自解密页面，部署到任意静态托管。Secure, effortless HTM

Runtime security for AI agents: discover agents, map their permissions, and enforce what they can do.

DevOps secrets base: lightweight, self-hosted secrets manager in a single file

Laravel Security Tool

Wazuh MCP Server: AI-Driven SOC Automation

27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code pl

LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.

Open source CSPM for Azure - scan for misconfigurations and quantum-unsafe cryptography, map findings to CIS/NIST/ISO27001/SOC2, and fix the

A Linux CLI utility that transparently routes all system traffic through the Tor network using nftables. It enables rapid IP rotation and ea

Verify what AI coding agents can actually read, write, execute and reach using synthetic canaries.

A lightweight network security tool that verifies IP location, validates network safety, and prevents access to protected links when unexpec

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Rust 跨平台应急响应分析工具，提供 CLI 与桌面 GUI；支持日志、进程和离线流量分析、案件项目管理、IOC 匹配、AI 辅助分析、报告导出及 Windows/Linux 应急命令速查。支持 Windows、Linux、macOS ARM64。

Deterministic security analysis for Stellar Soroban smart contracts and Rust projects.

Catch .env secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked

⚔️ Suite de hacking ético 100% client-side: +100 herramientas de ciberseguridad, forense, ingeniería inversa y anti-phishing que corren en t

Blitz Strike, penetration-testing iş akışını MCP üzerinden sunan ve bulguları canlı doğrulamaya yönelen bir güvenlik aracıdır.

Neden yükseliyor · 15 günlük yaşına rağmen 512 yıldız almış; MCP tabanlı agent iş akışlarıyla penetration testing'i tek entegrasyonda toplama vaadi dikkat çekiyor. Ancak son 28 günde yalnızca 2 commit ve 1 farklı yazar görünmesi, bu ilginin aktif geliştirme veya topluluk katkısıyla henüz desteklenmediğini gösteriyor.

Real-world AI penetration testing engineer for authorized assessments — built-in cloud module covering AWS/Azure/GCP + Aliyun/Tencent/Huawei

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

Audit and fix your Mac's security in one command. No agent, no signup, open source.

Offline password, identity, and secret vault. Argon2id + AES-256-GCM, zero servers, zero telemetry.

Passive Bluetooth neighbourhood monitor for Raspberry Pi and Linux: a live radar, device triage, categories and alerts for new devices.

A modular, drop-in middleware collection for Laravel AI SDK agents. Offers middleware across security, observability, performance and guidan

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

AI agent firewall that intercepts tool calls (file, shell, network) and enforces deterministic policies at sub-microsecond latency using CEL

Browser-based Android console, APK decompiler and security analyzer. Mirror, logcat, shell, Frida, jadx, and static and dynamic analysis, wi

Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, cove

Concurrent Go CLI that detects hidden prompt-injection content in documents — invisible Unicode, homoglyphs, hidden HTML, and known trigger

基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。

Audit, clean, and harden a WordPress site end to end, with an AI agent (Claude/Cursor/Codex/MCP or SSH). Detects & removes hidden malware —

Detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhau

Dependency safety gate for Claude Code & Codex CLI — OSV pre-approval, npm lockfile-closure enforcement, and auto-rollback. Local, zero runt

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

Jadart is a fast Flutter decompiler designed for Agents/Mobile Security Researchers.

Local-first Python CLI for safer log sharing: redact secrets, tokens, emails, and local paths before posting to GitHub issues, tickets, or A

Security guidance based on library and version for developers and agents.

AI Agent + 抓包融合安全测试工具 | 自然语言驱动自主渗透测试 | ReAct 编排引擎 | Tauri + FastAPI

AI-orchestrated, Kali-native pentesting lab: an MCP tool-server with scope/VPN/rate/audit enforced in code, independent finding verification

A BOLA/IDOR access-control confirmation engine — code adjudicates every verdict, not just the model, with a reproducible evidence chain.

AiGuard —— 本地优先的 AI 流量安全网关：本机 MITM 代理只接管 AI 域名，请求侧脱敏、响应侧流式还原，并识别七类风险信号。原文不落盘、不上传。（注意如果你需要模型直接使用token或者其他密钥进行操作，请放入白名单或关闭该功能！！！！）

Local-first security for developers and their AI coding agents. Finds risky agent settings (hooks, auto-approve, unpinned MCP servers), API

发现藏在前端代码里的 API，验证未授权访问风险 · 动态浏览器追踪 × JavaScript 静态分析

Local privacy preflight for files, folders, and archives—catch secrets, PII, metadata, and hidden document content before sharing.

A privacy-first, local-first password manager with cross-platform synchronization.

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, de

Kubernetes security assessment CLI: RBAC, pod-escape, and privilege-escalation path analysis. Cloudsplaining for Kubernetes.