Havuz

AI-first external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and developer-agent MCP inte

0, tarayıcı, terminal ve MCP üzerinden güvenlik iş akışları çalıştırıp bulguları iş etkisine göre önceliklendiren açık kaynak bir güvenlik platformudur.

Neden yükseliyor · 46 günde 492 yıldız ve son 28 günde 677 commit dikkat çekici bir ivmeye işaret ediyor; YC desteği ve browser, CLI, MCP birleşimi de görünürlüğü artırabilir. Ancak commitlerin tek farklı yazardan gelmesi, hareketliliğin geniş topluluk katkısı anlamına gelmediğini gösteriyor.

open·kritt, AI agents kullanarak kod depolarındaki olası güvenlik açıklarını tarayan, doğrulamaya ve önceliklendirmeye yönelik self-hosted bir platformdur.

Neden yükseliyor · 69 günde 2171 yıldız alması dikkat çekici erken ilgiye işaret ediyor; son 28 günde 27 commit ve 5 farklı yazar da projenin aktif geliştirildiğini gösteriyor. Ancak yıldızlar ve README'deki iddialar, taramaların gerçek açık bulma başarısını veya yanlış pozitif oranını kanıtlamıyor.

Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay y

Local security intelligence for CVE triage - 40 data sources and 41 tools, risk scores and an MCP server for AI agents, all in native Rust.

给 AI 生成代码做安全审阅的终端工具：410 条漏洞清单，20 条本地规则 + 模型逐条判定（带证据核实），看完 diff 再决定要不要写（Rust）

Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own mo

Modern attack-surface reconnaissance & asset monitoring platform — rebuilt from classic ARL with async decoupled scheduling, enterprise asse

Security scanner for MCP servers, source trees, and packages, with explicit findings and coverage reporting.

Fast, self-contained vulnerability scanner (single Go binary) for web apps, APKs and binaries - extensible with JSON and nuclei YAML templat

Autonomous Bug Bounty Hunting Framework powered by Claude Code. 20 AI agents, state-machine orchestration, Burp Suite MCP, credential vault,

Open-source AI security tool to scan and fix vulnerabilities in your vibe-coded projects before you ship. AXguard by AwareXone.

Embedded Device Security Assessment Framework — 700 modules, 350 CVEs, 55 vendors, APT Group Engine. Covers routers, IP cameras, GPON ONTs,

Black-box web penetration testing automation framework for AI Agents

Deterministic security analysis for Stellar Soroban smart contracts and Rust projects.

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum au

Open-source cybersecurity analysis agent for Claude Code. Scans projects for vulnerabilities across all OWASP 2025 Top 10 and CWE Top 25 cat

Autonomous AI-powered penetration testing platform. LLM-driven recon, vulnerability analysis, and exploit validation for internal & external

基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and

Self-hosted bug-bounty platform — verification-first recon & DAST, continuous monitoring. Your data stays on your machine.

Autonomous multi-agent pentest framework — plans, exploits, verifies (proof-required), CVSS-scores and writes client-ready reports. 104/104

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

Claude Code / agentic security skill for Solana programs and software. Full audit-firm lifecycle, executable PoC + fix-patch delivery, a Rus

open-source pentest management built to be operated by an AI agent

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

DianXing - AI-Driven End-to-End Code Security Auditing

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed,

Security testing that runs inside the coding agent you already use. Source-available, not open source.

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Cache Commander — a TUI and MCP server to explore, audit, and clean developer cache directories. Scan for CVEs, find outdated packages, recl

Elevate your AI assistants (like Claude & Cursor) into autonomous cybersecurity experts. Pentester-MCP integrates 200+ pentesting tools via

AI agent benchmark hackability scanner — find evaluation vulnerabilities before they undermine your results

AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy,

Measure what a vulnerability is worth to your business, not how severe it is in the abstract. Business Exposure Index scoring over NVD, EPSS

OSINT tool for precise version fingerprinting of open-source web software

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

Hands-off supply-chain watchdog for dev machines: orchestrates multiple security scanners (Perplexity bumblebee + osv-scanner, govulncheck,

Self-hosted CVE triage for your root servers: Trivy scans, LLM-judged exploitability, only the findings that matter.

Automated CLI security auditor for web configuration vulnerabilities.

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

NSAuditor AI Community — open-source network security scanner. 27 discovery plugins, structured findings, SARIF/CSV output, MCP integration,

Go static taint-analysis engine that finds vulnerabilities in WordPress plugins — WordPress-aware (capability tiers, nonce≠authz, REST/AJAX

Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

🛡️ AI-powered reconnaissance framework unifying 130+ security tools — subdomain enum, vuln scanning, cloud/IoT recon, dark web monitoring &

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

❄️ Static, serverless CVE radar — every new CVE from the last 30 days, ranked by real-world risk (KEV · EPSS · PoC · Metasploit · Nuclei · S

Dark-GPT: The ultimate unrestricted AI assistant for cybersecurity research by M4TH4CK3R