Havuz

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Evidence-driven Java security review workbench

👻 AI-Powered Pentesting Command Center — Autonomous security testing with real-time streaming, self-improving AI, unlimited tool iterations,

surface-watch monitors the authorized external attack surface of an organization over time

AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy,

Defense-in-depth security toolkit for LLM agents — taint tracking, proxy secret guard, policy engine, and red-team benchmarking

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

Detect abandoned and end-of-life dependencies that CVE-based scanners don't flag, and rank which ones to remove first.

OSINT tool for precise version fingerprinting of open-source web software

Open-source local AI Agent desktop app for authorized security assessment — Electron + Mastra-powered runtime, visual pentest workflow, Kali

A small multithreaded TCP port scanner in plain C (POSIX sockets + pthreads), zero dependencies.

A codebase scanner that helps you not run malicous code

A lightweight Windows PC remote screen monitoring and endpoint activity audit tool. Fast setup, live screen streaming, and silent background

Modular browser-based OSINT toolkit — curated search tools, PII Redactor, multi-country IBAN analysis and embedded CyberChef. No backend req

Fast, cross-platform CLI for finding secrets and sensitive data across filesystems, SMB, Active Directory, Microsoft 365, Slack, Jira and Co

xnew is a fast, low-memory CLI that appends only unique lines to files. Built in Go for large datasets, it streams input efficiently and sca

Runtime security for AI agents. In-process, zero dependencies, Apache 2.0.

Static analysis engine for Python web-applications

WebStrike — automated web-pentesting framework that orchestrates Kali tools (subfinder, httpx, katana, ffuf, nuclei, sqlmap, dalfox) into on

Agent-assisted vulnerability research across Rust, Android APKs, and AI agents: independent discovery, skeptical triage, verification, and p

MCP server bridging Claude/any LLM client to a persistent Kali Linux VM over SSH — scope-gated nmap, gobuster, nuclei & nikto with structure

NSAuditor AI Community — open-source network security scanner. 27 discovery plugins, structured findings, SARIF/CSV output, MCP integration,

Install, run and verify OSINT tools from GitHub automatically, on any OS

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

Self-hosted counter-surveillance for the networks you control: map device and network exposure, verify trusted routes, and hold sensitive ac

Self-hosted, agentic vulnerability research for binaries & firmware: an AI agent decompiles, fuzzes, and verifies exploits inside a sandbox,

Open-source AI security platform providing perimeter defense for LLMs and AI agents through swarm analysis, policy enforcement, adversarial

ThreatRadar is an open-source Threat Intelligence pipeline for SOC and threat intelligence teams that ingests, enriches, scores, and validat

See the AI keys and agents you can't. A read-only check for your Mac, Windows & Linux from GIRD.

Open-source, local-first desktop security suite for malware scanning, system audits, and maintenance.

Local-first permission gateway for AI agents with scoped connector access, human approval, audit trails, and encrypted local credentials.

🛡️ AI-powered reconnaissance framework unifying 130+ security tools — subdomain enum, vuln scanning, cloud/IoT recon, dark web monitoring &

gitghost — find secrets in a GitHub account's public repos, including ones 'deleted' but still recoverable from git history. Exposure score

A stateful AI Intrusion Prevention System (IPS) that reassembles TCP packet fragments in sequence order and uses PyTorch deep learning model

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, an

Flashpaper is an ephemeral secret-sharing service for humans and AI agents. No database — secrets live in volatile RAM only, encrypted, and

AI Powered Reverse Engineering Tool

Installable Codex/AgentSkills workflow pack for dev, Agent/RAG, API/data, Office artifacts, research diagrams, and authorized security revie

Paste a URL, find out something true about the site. Three URL-only readings on one page: Slopmeter scores how much of it is still the templ

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

An informational platform that provides live GitHub data for programming languages, frameworks, libraries, and database technologies. This p

Beginner-friendly SSH client for Windows - dangerous-command guard, offline error explanations, and a breadcrumb navigator. Fully local, no

Local credential control for AI coding agents.

Observe AI agent runs and control consequential actions. Signed policies, exact-action approvals, AuthZEN API vetoes and evidence. MCP gatew

Harness-driven terminal AI agent for authorized security assessment, with TUI, headless automation, persistent context, 150 built-in skill

Fast, self-contained vulnerability scanner (single Go binary) for web apps, APKs and binaries - extensible with JSON and nuclei YAML templat

Kernel-enforced policy for coding agents (eBPF LSM). YAML in the repo; deny is EPERM. Claude gets Semantic feedback after deny.