Havuz

The black box for AI-written code. Passive decision graph linking every commit to the agent prompts behind it: drift detection, DLP audit of

A CI/CD Red Team Framework for demonstrating Build Pipeline security risks.

Harden your package manager configs against supply chain attacks.

DSH plugin - framework upgrade safety & plugin gating: contract pre-check, rollback point, auto-rollback on failure, evidence-based auto-dis

A gh CLI extension that generates and verifies the GitHub Actions dependency lockfile, pinning every action your workflows use to an exact c

Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed,

Offline cyber security agent for your apps and AI coding tools. Open R&D: measured in public, improved every release.

Verified AI dependency migrations. Finds which of your lines a version bump actually breaks, fixes them, and proves the result still compile

Free, MIT-licensed MCP security testing from ClearFrame. Scan, audit, compare, and review locally; continue in the ClearFrame CLI or Mac app

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

🦞 Local, read-only security audit for your OpenClaw agent. Finds config, prompt-injection and supply-chain risks, watches for drift, and ve

Cache Commander — a TUI and MCP server to explore, audit, and clean developer cache directories. Scan for CVEs, find outdated packages, recl

Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, ne

Detect abandoned and end-of-life dependencies that CVE-based scanners don't flag, and rank which ones to remove first.

Tamper-evident evidence and verification layer for AI agents. Verify any agent's session offline with just openssl. No cloud, no lock-in.

Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or d

A Git-native dependency admission controller. Evaluates trust signals on every dependency change and blocks commits or builds when packages

Tiny offline Codex auth.json snapshot switcher for multiple ChatGPT accounts. Zero dependencies, no network.