Havuz

gitghost — find secrets in a GitHub account's public repos, including ones 'deleted' but still recoverable from git history. Exposure score

AI Agent + 抓包融合安全测试工具 | 自然语言驱动自主渗透测试 | ReAct 编排引擎 | Tauri + FastAPI

An informational platform that provides live GitHub data for programming languages, frameworks, libraries, and database technologies. This p

A BOLA/IDOR access-control confirmation engine — code adjudicates every verdict, not just the model, with a reproducible evidence chain.

AiGuard —— 本地优先的 AI 流量安全网关：本机 MITM 代理只接管 AI 域名，请求侧脱敏、响应侧流式还原，并识别七类风险信号。原文不落盘、不上传。（注意如果你需要模型直接使用token或者其他密钥进行操作，请放入白名单或关闭该功能！！！！）

A privacy-first, local-first password manager with cross-platform synchronization.

A modular, drop-in middleware collection for Laravel AI SDK agents. Offers middleware across security, observability, performance and guidan

surface-watch monitors the authorized external attack surface of an organization over time

AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy,

Defense-in-depth security toolkit for LLM agents — taint tracking, proxy secret guard, policy engine, and red-team benchmarking

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

AI agent firewall that intercepts tool calls (file, shell, network) and enforces deterministic policies at sub-microsecond latency using CEL

A small multithreaded TCP port scanner in plain C (POSIX sockets + pthreads), zero dependencies.

Modular browser-based OSINT toolkit — curated search tools, PII Redactor, multi-country IBAN analysis and embedded CyberChef. No backend req

Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, cove

Concurrent Go CLI that detects hidden prompt-injection content in documents — invisible Unicode, homoglyphs, hidden HTML, and known trigger

Audit, clean, and harden a WordPress site end to end, with an AI agent (Claude/Cursor/Codex/MCP or SSH). Detects & removes hidden malware —

Detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhau

xnew is a fast, low-memory CLI that appends only unique lines to files. Built in Go for large datasets, it streams input efficiently and sca

Runtime security for AI agents. In-process, zero dependencies, Apache 2.0.

Static analysis engine for Python web-applications

MCP server bridging Claude/any LLM client to a persistent Kali Linux VM over SSH — scope-gated nmap, gobuster, nuclei & nikto with structure

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

Local-first Python CLI for safer log sharing: redact secrets, tokens, emails, and local paths before posting to GitHub issues, tickets, or A

Self-hosted, agentic vulnerability research for binaries & firmware: an AI agent decompiles, fuzzes, and verifies exploits inside a sandbox,

Open-source AI security platform providing perimeter defense for LLMs and AI agents through swarm analysis, policy enforcement, adversarial

Security guidance based on library and version for developers and agents.

ThreatRadar is an open-source Threat Intelligence pipeline for SOC and threat intelligence teams that ingests, enriches, scores, and validat

Open-source, local-first desktop security suite for malware scanning, system audits, and maintenance.

Local-first permission gateway for AI agents with scoped connector access, human approval, audit trails, and encrypted local credentials.

🛡️ AI-powered reconnaissance framework unifying 130+ security tools — subdomain enum, vuln scanning, cloud/IoT recon, dark web monitoring &

A stateful AI Intrusion Prevention System (IPS) that reassembles TCP packet fragments in sequence order and uses PyTorch deep learning model

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, an

Flashpaper is an ephemeral secret-sharing service for humans and AI agents. No database — secrets live in volatile RAM only, encrypted, and

AI Powered Reverse Engineering Tool

Installable Codex/AgentSkills workflow pack for dev, Agent/RAG, API/data, Office artifacts, research diagrams, and authorized security revie

Paste a URL, find out something true about the site. Three URL-only readings on one page: Slopmeter scores how much of it is still the templ

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

Beginner-friendly SSH client for Windows - dangerous-command guard, offline error explanations, and a breadcrumb navigator. Fully local, no

Local credential control for AI coding agents.

Harness-driven terminal AI agent for authorized security assessment, with TUI, headless automation, persistent context, 150 built-in skill

Fast, self-contained vulnerability scanner (single Go binary) for web apps, APKs and binaries - extensible with JSON and nuclei YAML templat

Local-first security for developers and their AI coding agents. Finds risky agent settings (hooks, auto-approve, unpinned MCP servers), API

Kernel-enforced policy for coding agents (eBPF LSM). YAML in the repo; deny is EPERM. Claude gets Semantic feedback after deny.

Find every API request a web app makes, from the JavaScript it ships: method, URL, body, headers and GraphQL operations. One command.

❄️ Static, serverless CVE radar — every new CVE from the last 30 days, ranked by real-world risk (KEV · EPSS · PoC · Metasploit · Nuclei · S

Zero-dependency Python CLI for deep security auditing of FortiGate configurations. 5695 lines, 35 audit domains, 300+ checks — firewall poli

A privacy-first, fail-closed AI pentest conductor and autonomous Red Team platform

Instant device integrity + screen protection for React Native. Detect root/jailbreak, Frida, debugger attachment, emulator environments, hoo