Havuz

open·kritt, AI agents kullanarak kod depolarındaki olası güvenlik açıklarını tarayan, doğrulamaya ve önceliklendirmeye yönelik self-hosted bir platformdur.

Neden yükseliyor · 69 günde 2171 yıldız alması dikkat çekici erken ilgiye işaret ediyor; son 28 günde 27 commit ve 5 farklı yazar da projenin aktif geliştirildiğini gösteriyor. Ancak yıldızlar ve README'deki iddialar, taramaların gerçek açık bulma başarısını veya yanlış pozitif oranını kanıtlamıyor.

DianXing - AI-Driven End-to-End Code Security Auditing

Fast, self-contained vulnerability scanner (single Go binary) for web apps, APKs and binaries - extensible with JSON and nuclei YAML templat

Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own mo

给 AI 生成代码做安全审阅的终端工具：410 条漏洞清单，20 条本地规则 + 模型逐条判定（带证据核实），看完 diff 再决定要不要写（Rust）

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Self-hosted bug-bounty platform — verification-first recon & DAST, continuous monitoring. Your data stays on your machine.

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum au

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed,

Security scanner for MCP servers, source trees, and packages, with explicit findings and coverage reporting.

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Deterministic security analysis for Stellar Soroban smart contracts and Rust projects.

Claude Code / agentic security skill for Solana programs and software. Full audit-firm lifecycle, executable PoC + fix-patch delivery, a Rus

Cache Commander — a TUI and MCP server to explore, audit, and clean developer cache directories. Scan for CVEs, find outdated packages, recl

OSINT tool for precise version fingerprinting of open-source web software

❄️ Static, serverless CVE radar — every new CVE from the last 30 days, ranked by real-world risk (KEV · EPSS · PoC · Metasploit · Nuclei · S

Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled

AI agent benchmark hackability scanner — find evaluation vulnerabilities before they undermine your results

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Self-hosted CVE triage for your root servers: Trivy scans, LLM-judged exploitability, only the findings that matter.

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

Automated CLI security auditor for web configuration vulnerabilities.

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

NSAuditor AI Community — open-source network security scanner. 27 discovery plugins, structured findings, SARIF/CSV output, MCP integration,

Offensive web security scanner — OWASP Top 10 · MCP server · CLI · Go