samugit83 / redamon

Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.

blacklanternsecurity / bbot

The recursive internet scanner for hackers. 🧡

LINGYK352 / Watchtower

Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.

ivre / ivre

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

pablosnt / rekono

Offensive security platform that automates attack surface discovery and vulnerability management

dotdna-io / assetatlas

Open-source asset inventory — turn scattered, contradictory tool data into one reliable inventory, then chat with it using the LLM of your choice. Tagging, posture rules, and alerting built in.

OWASP / OWASP-Subtractive-Hardening-Top-10

The OWASP Subtractive Security Top 10 Project is an initiative to identify, document, and promote the highest-impact opportunities for reducing cyber risk through the elimination of attack paths.