interplains / zero-breach

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

chaenmasahiro0425 / claude-security-scan

「セキュリティチェックして」の一言で、Mac・リポジトリ・GitHub・Vercel・AWS・Gmailを読み取り専用で横断点検する Claude Code スキル

NVIDIA / SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

maurosoria / dirsearch

Web path scanner

blacklanternsecurity / bbot

The recursive internet scanner for hackers. 🧡

NVIDIA / garak

the LLM vulnerability scanner

PyCQA / bandit

Bandit is a tool designed to find common security issues in Python code.

lintsinghua / DeepAudit

DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。

Tencent / AI-Infra-Guard

A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

infobyte / faraday

Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.

commixproject / commix

Automated Αll-in-One OS command injection exploitation tool.

OWASP / Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

kaifcodec / user-scanner

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.

awarexone / Agentic-Bug-Hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

jonaslejon / malicious-pdf

💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

snooppr / snoop

Snoop — инструмент разведки на основе открытых данных (OSINT world)

kelvinBen / AppInfoScanner

一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iOS、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。

codingo / NoSQLMap

Automated NoSQL database enumeration and web application exploitation tool.

snyk / agent-scan

Security scanner for AI agents, MCP servers and agent skills.

cisco-ai-defense / skill-scanner

Security Scanner for Agent Skills

derv82 / wifit3

Wifite but USB-only & cross-platform.

msoedov / agentic_security

Agentic LLM Vulnerability Scanner / AI red teaming kit 🧪

PiLiDAR / PiLiDAR

an open-source, low-cost DIY 360° LiDAR scanner and panoramic 3D reconstruction system.

wapiti-scanner / wapiti

Web vulnerability scanner written in Python3

0xSteph / pentest-ai

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.

shner-elmo / TradingView-Screener

A package that lets you create TradingView screeners in Python

freelabz / secator

secator - the pentester's swiss knife

Marven11 / Fenjing

专为CTF设计的Jinja2 SSTI全自动绕WAF脚本 | A Jinja2 SSTI cracker for bypassing WAF, designed for CTF

owasp-dep-scan / dep-scan

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

topscoder / nuclei-wordfence-cve

80k+ WordPress Nuclei templates, updated daily from Wordfence intel—filter by severity/tags/CVE and scan in one line. 🚀🔒

CERT-Polska / Artemis

A modular vulnerability scanner with automatic report generation capabilities.

GamehunterKaan / AutoPWN-Suite

AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.

berylliumsec / nebula

Cybersecurity Harness

ASCIT31 / Dark-Moon

Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.

ZeroQI / Absolute-Series-Scanner

Seasons, absolute mode, Subfolders...

cisco-ai-defense / mcp-scanner

Scan MCP servers for potential threats & security findings.

stanislav-web / OpenDoor

OWASP Web Recon & Directory Discovery Platform

hashgraph-online / hol-guard

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

Zyrexnn / Cybermes

Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.

MaxHu-xuan / chat-archive-guard

Audit AI chat exports locally before sharing or migration. Find possible secrets, personal-data patterns, broken JSON/JSONL, SQLite issues, and scan gaps—without uploading the archive.

toby-bridges / api-relay-audit

Local security audit for AI API relays and LLM proxies: detects prompt injection, model substitution, tool-call rewriting, SSE anomalies, error leakage, and Web3 wallet risks.

stamparm / DSSS

Damn Small SQLi Scanner

xinyitang3 / cfnb

这是一个全自动的 Cloudflare CDN 节点优选工具。它通过 TCP 延迟筛选 + IP 可用性二次检测 + HTTP 延迟及抖动检测 + 真实带宽测速 多重机制，从多个公开数据源中聚合节点，自动识别并解析任意格式（标准代码、中文名、emoji国旗、JSON等），筛选出当前网络环境下速度最快、延迟最低、抖动最小的 Cloudflare IP，并支持自动更新至 Cloudflare DNS 以及同步至 GitHub 仓库，同时支持微信实时通知。

nix-community / vulnix

Vulnerability (CVE) scanner for Nix/NixOS [maintainer=@henrirosten]

duriantaco / skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

vil / H4X-Tools

A modular, terminal-based toolkit for OSINT, reconnaissance, and scraping - built in Python, runs on Linux and Windows.

r0075h3ll / Oralyzer

Python tool that probes websites for open redirection via headers, JavaScript, and meta-tag refresh, pulls candidate URLs from the Wayback Machine, and checks CRLF injection and DOM XSS.

nealbridges / VulnHunter

Agentic AI security scanner that hunts exploitable vulnerabilities like an adversary, proves them with executable PoCs, and fixes them test-first. A maintained fork of Capital One's VulnHunter, rebuilt for any agent harness.

aboutcode-org / vulnerablecode

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/

awslabs / automated-security-helper

ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.

Madi-S / Lead-Generation

Python script, which empowers people with no programming background to generate robust leads on a mass scale. This repo will be compiled of various versatile techniques used in lead generation.

BullsEye0 / ghost_eye

Ghost Eye Informationgathering Footprinting Scanner and Recon Tool Release. Ghost Eye is an Information Gathering Tool I made in python 3. To run Ghost Eye, it only needs a domain or ip. Ghost Eye can work with any Linux distros if they support Python 3. Author: Jolanda de Koff

dmdhrumilmistry / pyhtools

A Python Hacking Library consisting of network scanner, arp spoofer and detector, dns spoofer, code injector, packet sniffer, network jammer, email sender, downloader, wireless password harvester credential harvester, keylogger, download&execute, ransomware, data harvestors, etc.

Aletheore / Aletheore

Evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.

ValdikSS / tor-relay-scanner

Tor Relay availability checker, for using it as a bridge in countries with censorship

shenril / Sitadel

Web Application Security Scanner

NVIDIA / SkillEvaluator

Multi-tier framework for evaluating AI agent skills with quality gates, semantic overlap detection, synthetic evaluation dataset generation, and live agent evaluation that measures how skills affect agent behavior.

Ostorlab / oxo

OXO is a security scanning orchestrator for the modern age.

fgeek / pyfiscan

Free web-application vulnerability and version scanner

anmolksachan / TheTimeMachine

Weaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not