graygnatconsole / mcp-audit-tool

🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI ready.

SivaSaiKrishnaSuryadevara / docker-mcp-guardian

Security-hardened MCP server for Docker with read-only defaults, restart deny-lists, and secret redaction

Spectrmachina / Ztrust

Zero-trust supply-chain security for open source: detects malicious & vulnerable dependencies, typosquats, leaked secrets and unsafe GitHub Actions — and pays independent researchers in shielded Zcash via a front-running-proof bounty protocol.

MuzeAnisichael / GreatSage

GreatSage · 大贤者 — a Windows desktop voice secretary that listens, remembers across sessions, turns meetings and Markdown notes into cited minutes and todos, and asks before it acts. Cloud or local AI, auditable, with a desktop pet.

MaxHu-xuan / chat-archive-guard

Audit AI chat exports locally before sharing or migration. Find possible secrets, personal-data patterns, broken JSON/JSONL, SQLite issues, and scan gaps—without uploading the archive.

elementalsouls / Claude-OSINT

8 Claude skills · 100+ recon capabilities · 80 secret-regex patterns · 80+ dorks · 9 read-only credential validators · 27 attack-path templates · ~10,000 lines of structured tradecraft. Drop-in SKILL.md files that turn Claude into a god-mode external recon operator for authorized red-team and bug-bounty engagements.

hashgraph-online / hol-guard

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

golbin / rekey

Reissue an API key with one command and update it everywhere it is used (1Password + templates)

scito / extract_otp_secrets

Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authentication apps can be captured by camera, read from images, or read from text files. The secrets can be exported to JSON or CSV, or printed as QR codes to console.

secret-tools / crown-tools

Crown Tools — 78 Python utilities for files, structured data, public information and authorised diagnostics.

AnuragRoy485 / Sleuth

Sleuth finds hardcoded secrets, API keys, tokens, private keys and high-entropy strings in your codebase fast, accurately, and with beautiful output.

GitGuardian / ggshield

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

pypa / gh-action-pypi-publish

The blessed :octocat: GitHub Action, for publishing your :package: distribution files to PyPI, the tokenless way: https://github.com/marketplace/actions/pypi-publish

shea256 / secret-sharing

A system for securely splitting secrets with Shamir's Secret Sharing Scheme

GetSHIM / shim-cli

Local traffic visibility and privacy controls for coding agents. See what Claude Code, Codex and Copilot send to the model; mask secrets and personal data where the client allows it.

aws / aws-sdk-pandas

pandas on AWS - Easy integration with Athena, Glue, Redshift, Timestream, Neptune, OpenSearch, QuickSight, Chime, CloudWatchLogs, DynamoDB, EMR, SecretManager, PostgreSQL, MySQL, SQLServer and S3 (Parquet, CSV, JSON and EXCEL).

hannob / snallygaster

Tool to scan for secret files on HTTP servers

freeipa / freeipa

Mirror of FreeIPA, an integrated security information management solution

duriantaco / skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

duy90utc528 / repo-publication-audit

Dependency-free preflight checks for repositories before making them public

rootsecdev / SecretsStalker

—

Santosh-Prasad-Verma / ClaudeGate

High-performance bridge proxy connecting Claude Code CLI & Anthropic SDK to ANY OpenAI-compatible LLM provider (DeepSeek, OpenRouter, Groq, Ollama, Gemini, OpenAI) with zero-crash streaming, failover & secret redaction.

Nour-yahyaoui / env-sentry

Zero-dependency CLI that catches .env drift, leaked secrets, and missing .gitignore entries before you commit them.

Palladiymateria / sharecheck

Local CLI that checks your project for accidental secrets, sensitive files, and oversized assets before publishing to GitHub. No uploads. No runtime dependencies.

shriramkv / agentgateway-lint

Static linter for agentgateway configurations that detects security, reliability, and operational risks such as unsafe CORS, missing authentication/rate limits, hardcoded secrets, and exposed admin interfaces. Supports YAML and JSON with precise issue locations.

cedricbonhomme / Stegano

A pure Python steganography module.

blacklanternsecurity / badsecrets

A library for detecting known secrets across many web frameworks

jasonzhang06-source / sharelint

Local privacy preflight for files, folders, and archives—catch secrets, PII, metadata, and hidden document content before sharing.

VanTaS15 / RotationLedger

Track the lifetime of leaked secrets through git history - detect credential-shaped strings offline and report how long each stayed exposed.

Aletheore / Aletheore

Evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.