Havuz

27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code pl

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Control plane for the tools agents run: inventory, evidence, policy, enforcement. Clean is only emitted when every check ran. · agent 工具层的控制

Audit and fix your Mac's security in one command. No agent, no signup, open source.

Local, evidence-based application security assessment engine and Claude Code plugin

Offline password, identity, and secret vault. Argon2id + AES-256-GCM, zero servers, zero telemetry.

Passive Bluetooth neighbourhood monitor for Raspberry Pi and Linux: a live radar, device triage, categories and alerts for new devices.

Evidence-driven Java security review workbench

👻 AI-Powered Pentesting Command Center — Autonomous security testing with real-time streaming, self-improving AI, unlimited tool iterations,

LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.

A modular, drop-in middleware collection for Laravel AI SDK agents. Offers middleware across security, observability, performance and guidan

Open source CSPM for Azure - scan for misconfigurations and quantum-unsafe cryptography, map findings to CIS/NIST/ISO27001/SOC2, and fix the

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

Open-source, self-hosted attack surface management platform with distributed agents for asset discovery, scan orchestration, and vulnerabili

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

Advanced web security scanner with 49 modules, evasion engine, and CVE database.

surface-watch monitors the authorized external attack surface of an organization over time

Local-first credential manager & validator for red teams / pentest：致力于 ALL IN ONE 的本地凭据管理与验证平台。 允许将红队渗透测试中获取的散落在各处的 API Key、云厂商 AK/SK、机器人 To

Local-first code audit workbench for Opengrep. Scan locally, track findings across versions, verify fixes, and produce reproducible security

A Linux CLI utility that transparently routes all system traffic through the Tor network using nftables. It enables rapid IP rotation and ea

AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy,

Defense-in-depth security toolkit for LLM agents — taint tracking, proxy secret guard, policy engine, and red-team benchmarking

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process with

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态

Detect abandoned and end-of-life dependencies that CVE-based scanners don't flag, and rank which ones to remove first.

Scan, fuzz, and assess OT protocols from one CLI.

OSINT tool for precise version fingerprinting of open-source web software

Verify what AI coding agents can actually read, write, execute and reach using synthetic canaries.

C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel

A curated collection of AI SecOps 24 SKILL.md capabilities for security work offensive security, SOC and detection engineering, cloud and Ku

AI agent firewall that intercepts tool calls (file, shell, network) and enforces deterministic policies at sub-microsecond latency using CEL

Open-source local AI Agent desktop app for authorized security assessment — Electron + Mastra-powered runtime, visual pentest workflow, Kali

A small multithreaded TCP port scanner in plain C (POSIX sockets + pthreads), zero dependencies.

A codebase scanner that helps you not run malicous code

A lightweight Windows PC remote screen monitoring and endpoint activity audit tool. Fast setup, live screen streaming, and silent background

Modular browser-based OSINT toolkit — curated search tools, PII Redactor, multi-country IBAN analysis and embedded CyberChef. No backend req

A lightweight network security tool that verifies IP location, validates network safety, and prevents access to protected links when unexpec

Browser-based Android console, APK decompiler and security analyzer. Mirror, logcat, shell, Frida, jadx, and static and dynamic analysis, wi

Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, cove

Concurrent Go CLI that detects hidden prompt-injection content in documents — invisible Unicode, homoglyphs, hidden HTML, and known trigger

基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。

Audit, clean, and harden a WordPress site end to end, with an AI agent (Claude/Cursor/Codex/MCP or SSH). Detects & removes hidden malware —

Detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhau

Fast, cross-platform CLI for finding secrets and sensitive data across filesystems, SMB, Active Directory, Microsoft 365, Slack, Jira and Co

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Open-source security for AI coding agents: record, detect and block at the tool boundary, with a verifiable audit trail in the SIEM you alre

xnew is a fast, low-memory CLI that appends only unique lines to files. Built in Go for large datasets, it streams input efficiently and sca

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-