Havuz

xnew is a fast, low-memory CLI that appends only unique lines to files. Built in Go for large datasets, it streams input efficiently and sca

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-

Runtime security for AI agents. In-process, zero dependencies, Apache 2.0.

Static analysis engine for Python web-applications

Dependency safety gate for Claude Code & Codex CLI — OSV pre-approval, npm lockfile-closure enforcement, and auto-rollback. Local, zero runt

WebStrike — automated web-pentesting framework that orchestrates Kali tools (subfinder, httpx, katana, ffuf, nuclei, sqlmap, dalfox) into on

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Agent-assisted vulnerability research across Rust, Android APKs, and AI agents: independent discovery, skeptical triage, verification, and p

MCP server bridging Claude/any LLM client to a persistent Kali Linux VM over SSH — scope-gated nmap, gobuster, nuclei & nikto with structure

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime

NSAuditor AI Community — open-source network security scanner. 27 discovery plugins, structured findings, SARIF/CSV output, MCP integration,

Install, run and verify OSINT tools from GitHub automatically, on any OS

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

Local-first Python CLI for safer log sharing: redact secrets, tokens, emails, and local paths before posting to GitHub issues, tickets, or A

Self-hosted counter-surveillance for the networks you control: map device and network exposure, verify trusted routes, and hold sensitive ac

Self-hosted, agentic vulnerability research for binaries & firmware: an AI agent decompiles, fuzzes, and verifies exploits inside a sandbox,

Open-source AI security platform providing perimeter defense for LLMs and AI agents through swarm analysis, policy enforcement, adversarial

Security guidance based on library and version for developers and agents.

ThreatRadar is an open-source Threat Intelligence pipeline for SOC and threat intelligence teams that ingests, enriches, scores, and validat

See the AI keys and agents you can't. A read-only check for your Mac, Windows & Linux from GIRD.

Open-source, local-first desktop security suite for malware scanning, system audits, and maintenance.

Rust 跨平台应急响应分析工具，提供 CLI 与桌面 GUI；支持日志、进程和离线流量分析、案件项目管理、IOC 匹配、AI 辅助分析、报告导出及 Windows/Linux 应急命令速查。支持 Windows、Linux、macOS ARM64。

Local-first permission gateway for AI agents with scoped connector access, human approval, audit trails, and encrypted local credentials.

🛡️ AI-powered reconnaissance framework unifying 130+ security tools — subdomain enum, vuln scanning, cloud/IoT recon, dark web monitoring &

gitghost — find secrets in a GitHub account's public repos, including ones 'deleted' but still recoverable from git history. Exposure score

A stateful AI Intrusion Prevention System (IPS) that reassembles TCP packet fragments in sequence order and uses PyTorch deep learning model

AI Agent + 抓包融合安全测试工具 | 自然语言驱动自主渗透测试 | ReAct 编排引擎 | Tauri + FastAPI

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, an

AI-orchestrated, Kali-native pentesting lab: an MCP tool-server with scope/VPN/rate/audit enforced in code, independent finding verification

Flashpaper is an ephemeral secret-sharing service for humans and AI agents. No database — secrets live in volatile RAM only, encrypted, and

Offline WebAssembly component inspection and capability-policy toolkit - decode .wasm binaries, classify host capabilities, gate against exp

AI Powered Reverse Engineering Tool

Installable Codex/AgentSkills workflow pack for dev, Agent/RAG, API/data, Office artifacts, research diagrams, and authorized security revie

Static reverse engineering of untrusted files with verifiable, byte-anchored evidence. Open tools (Ghidra, JADX, LIEF, YARA-X, Babel) in loc

Paste a URL, find out something true about the site. Three URL-only readings on one page: Slopmeter scores how much of it is still the templ

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

An informational platform that provides live GitHub data for programming languages, frameworks, libraries, and database technologies. This p

Deterministic security analysis for Stellar Soroban smart contracts and Rust projects.

Beginner-friendly SSH client for Windows - dangerous-command guard, offline error explanations, and a breadcrumb navigator. Fully local, no

A BOLA/IDOR access-control confirmation engine — code adjudicates every verdict, not just the model, with a reproducible evidence chain.

Local credential control for AI coding agents.

Catch .env secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked

AiGuard —— 本地优先的 AI 流量安全网关：本机 MITM 代理只接管 AI 域名，请求侧脱敏、响应侧流式还原，并识别七类风险信号。原文不落盘、不上传。（注意如果你需要模型直接使用token或者其他密钥进行操作，请放入白名单或关闭该功能！！！！）

⚔️ Suite de hacking ético 100% client-side: +100 herramientas de ciberseguridad, forense, ingeniería inversa y anti-phishing que corren en t

Observe AI agent runs and control consequential actions. Signed policies, exact-action approvals, AuthZEN API vetoes and evidence. MCP gatew

Harness-driven terminal AI agent for authorized security assessment, with TUI, headless automation, persistent context, 150 built-in skill

Local-first security for developers and their AI coding agents. Finds risky agent settings (hooks, auto-approve, unpinned MCP servers), API

Kernel-enforced policy for coding agents (eBPF LSM). YAML in the repo; deny is EPERM. Claude gets Semantic feedback after deny.