Havuz

Fast, self-contained vulnerability scanner (single Go binary) for web apps, APKs and binaries - extensible with JSON and nuclei YAML templat

Fush Vue MCP —— Vue 前端逆向 + Web 安全测试工具（Chrome 扩展 + MCP 服务端，91 个工具）

Local, evidence-based application security assessment engine and Claude Code plugin

Catch .env secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked

Local-first code audit workbench for Opengrep. Scan locally, track findings across versions, verify fixes, and produce reproducible security

See the AI keys and agents you can't. A read-only check for your Mac, Windows & Linux from GIRD.

🔓 An AI web-pentest skill for Claude Code. Point it at a site you're authorized to test — it maps the attack surface, works through the OWAS

Static reverse engineering of untrusted files with verifiable, byte-anchored evidence. Open tools (Ghidra, JADX, LIEF, YARA-X, Babel) in loc

Local security intelligence for CVE triage - 40 data sources and 41 tools, risk scores and an MCP server for AI agents, all in native Rust.

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

确定性取证 × 大模型定性 × Agent 反证复核的恶意代码审计智能体 · Deterministic forensics × LLM verdict × agent falsification for malicious-code audits

Reverse engineering skill for Claude Code and other AI coding agents.

Local-first credential manager & validator for red teams / pentest：致力于 ALL IN ONE 的本地凭据管理与验证平台。 允许将红队渗透测试中获取的散落在各处的 API Key、云厂商 AK/SK、机器人 To

ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军

Find every API request a web app makes, from the JavaScript it ships: method, URL, body, headers and GraphQL operations. One command.

Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish

Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Cod

An informational platform that provides live GitHub data for programming languages, frameworks, libraries, and database technologies. This p

Rust 跨平台应急响应分析工具，提供 CLI 与桌面 GUI；支持日志、进程和离线流量分析、案件项目管理、IOC 匹配、AI 辅助分析、报告导出及 Windows/Linux 应急命令速查。支持 Windows、Linux、macOS ARM64。

Evidence-driven Java security review workbench

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, de

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态

❄️ Static, serverless CVE radar — every new CVE from the last 30 days, ranked by real-world risk (KEV · EPSS · PoC · Metasploit · Nuclei · S

⚔️ Suite de hacking ético 100% client-side: +100 herramientas de ciberseguridad, forense, ingeniería inversa y anti-phishing que corren en t

Observe AI agent runs and control consequential actions. Signed policies, exact-action approvals, AuthZEN API vetoes and evidence. MCP gatew

Deterministic security analysis for Stellar Soroban smart contracts and Rust projects.

Defensive OSINT exposure checker: see what an email, password, domain or username leaks in public breach data. No API keys. CLI + local web

A codebase scanner that helps you not run malicous code

Control plane for the tools agents run: inventory, evidence, policy, enforcement. Clean is only emitted when every check ran. · agent 工具层的控制

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

Browser-based Android console, APK decompiler and security analyzer. Mirror, logcat, shell, Frida, jadx, and static and dynamic analysis, wi

AiGuard —— 本地优先的 AI 流量安全网关：本机 MITM 代理只接管 AI 域名，请求侧脱敏、响应侧流式还原，并识别七类风险信号。原文不落盘、不上传。（注意如果你需要模型直接使用token或者其他密钥进行操作，请放入白名单或关闭该功能！！！！）

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-

Local-first offensive security engagement platform for mapping assets, credentials, sessions, pivots, findings, evidence, and attack paths.

Blitz Strike, penetration-testing iş akışını MCP üzerinden sunan ve bulguları canlı doğrulamaya yönelen bir güvenlik aracıdır.

Neden yükseliyor · 15 günlük yaşına rağmen 512 yıldız almış; MCP tabanlı agent iş akışlarıyla penetration testing'i tek entegrasyonda toplama vaadi dikkat çekiyor. Ancak son 28 günde yalnızca 2 commit ve 1 farklı yazar görünmesi, bu ilginin aktif geliştirme veya topluluk katkısıyla henüz desteklenmediğini gösteriyor.

Passive Bluetooth neighbourhood monitor for Raspberry Pi and Linux: a live radar, device triage, categories and alerts for new devices.

Open-source local AI Agent desktop app for authorized security assessment — Electron + Mastra-powered runtime, visual pentest workflow, Kali

🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomo

DSH RedTeam 模式：把 DeepSeek Harness 变成红队作战指挥台——一个靶标名称拉起信息收集/漏洞检测/漏洞利用/内网渗透四个角色，资产与战果实时落入本地 SQLite 事实库（仅供已授权测试）

A Geiger counter for AI agents — one read-only command that inventories every agent, MCP server, plugin, and AI extension on a machine

Jadart is a fast Flutter decompiler designed for Agents/Mobile Security Researchers.

Offline WebAssembly component inspection and capability-policy toolkit - decode .wasm binaries, classify host capabilities, gate against exp

Reverify, AI agent’larının reverse engineering ve kod doğrulama iddialarını deterministik araçlarla sınayan, CLI ve MCP server sunan bir Python aracıdır.

Neden yükseliyor · Repo yalnızca 28 günlük olmasına rağmen 1.245 yıldıza ve son 28 günde 83 commit’e ulaşmış; AI agent’ları için doğrulanabilir çıktı ihtiyacıyla MCP entegrasyonu dikkat çekmiş olabilir. Dört farklı yazarın katkısı aktiviteyi destekliyor, ancak yıldızlar tek başına benimseme veya kalite kanıtı değil.

Open-source, self-hosted attack surface management platform with distributed agents for asset discovery, scan orchestration, and vulnerabili

DevOps secrets base: lightweight, self-hosted secrets manager in a single file

Pentest Harness, yetkili güvenlik testleri için farklı LLM sağlayıcılarını ve pentest araçlarını yerel bir arayüzde birleştiren self-hosted bir agent çalışma alanıdır.

Neden yükseliyor · 33 günlük bir repoda 398 yıldız dikkat çekiyor; ancak README dışındaki benimseme verisi bilinmiyor ve son 28 günde 2 commit ile 2 farklı yazar görülmesi geliştirme temposu hakkında güçlü kanıt sunmuyor.

基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。

MCP server bridging Claude/any LLM client to a persistent Kali Linux VM over SSH — scope-gated nmap, gobuster, nuclei & nikto with structure

Install, run and verify OSINT tools from GitHub automatically, on any OS

Local privacy preflight for files, folders, and archives—catch secrets, PII, metadata, and hidden document content before sharing.