chaitin / SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
chaitin / SafeLine
kubernetes-sigs / agent-sandbox
agent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes and reinforcement learning (RL).
AbolfazlTafakori / w-ui
WireGuard, AmneziaWG and OpenVPN panel for selling access — kernel-enforced quotas, expiry, device limits, subscription pages, Telegram bot, one-command install
istio / istio
Connect, secure, control, and observe services.
OpenNHP / opennhp
A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the AI-driven world.
EndlessCheng / codeforces-go
算法竞赛模板库 by 灵茶山艾府 💭💡🎈
flyteorg / flyte
Type-safe, distributed orchestration of agents, ML pipelines, and real-time inference on your k8s — in pure Python with async/await, also other languages (rust, go and ts)
julien040 / anyquery
One SQL interface for 60+ tools (e.g., GitHub, Notion, Airtable). Plug into any LLM through MCP.
bytedance / vArmor
vArmor is a cloud-native container hardening system that leverages AppArmor/BPF/Seccomp and NetworkProxy technologies to enforce access control from system calls to application protocols — protecting workloads including AI Agents.
projectdiscovery / dnsx
dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.
kubearmor / KubeArmor
Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (LSM-BPF, AppArmor).
x90skysn3k / brutespray
Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.
AgentsMesh / AgentsMesh
The AI Agent Workforce Platform. Run a hundred AI coding agents across your own machines — schedule, isolate, and steer them all from one console.
projectdiscovery / shuffledns
MassDNS wrapper written in go to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard filtering and easy input-output support.
ossf / allstar
GitHub App to set and enforce security policies
uber-go / atomic
Wrapper types for sync/atomic which enforce atomic access
m0n0x41d / haft
Engineering decisions engine that know when they're stale. Frame, compare, decide — with evidence decay and parity enforcement. For Claude Code, Cursor, Gemini CLI, Codex and more.
palantir / policy-bot
A GitHub App that enforces approval policies on pull requests
0xPugal / fuzz4bounty
1337 Wordlists for Bug Bounty Hunting
hoophq / hoop
Open-source enforcement at runtime that masks sensitive data and blocks destructive commands from AI agents. You change one thing: your agent's port.
yoheimuta / protolint
A pluggable linter and fixer to enforce Protocol Buffer style and conventions.
chainloop-dev / chainloop
Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.
cordum-io / cordum
The action firewall for AI agents. Enforce policy and human approval before risky tool calls, shell commands, workflows, and production changes, with auditable evidence.
lajosdeme / mole
A deep-research agent with an enforced budget, verified quotes, and a privacy boundary for local data.
decionis / docker
Govern consequential AI agent actions in Docker with deterministic policy, human approval, and signed Decision Dossiers.
solongate / agent-security
Local-first, open-source security gateway for AI coding agents. Enforce tool-call policies, detect secrets, and audit actions on-device.
peterretief / yggstore
People and organisations pool their own machines over Yggdrasil to keep files, websites, email for their own domains and messaging for alarms and alerts among themselves, with no central server and no provider holding their data. Trust can be personal or enforced. Open source to use as you want.
masaleem-oss / Fengard
Kernel-enforced firewall and DNS filtering for any OpenWrt router. Parental controls, ad blocking and screen time. A Pi-hole alternative.
xinyao27 / jevonian
One local endpoint. The right model for every turn — enforced in code, not prompts.