google / mantis

A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

lupingQAQ / JGD

Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-model adversarial auditing → weaponized PoC. Solving the last mile.

cve-search / cve-search

cve-search - a tool to perform local searches for known vulnerabilities

huhusmang / Awesome-LLMs-for-Vulnerability-Detection

The community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers across function-level, repository-level, agentic, and smart-contract detection, plus datasets, benchmarks, and surveys.

CERT-Polska / Artemis

A modular vulnerability scanner with automatic report generation capabilities.

larlarua / AutoCVE

Agent-driven automated CVE discovery platform for source code auditing, vulnerability verification, and report generation.

aboutcode-org / vulnerablecode

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/

Zuimeng-0710 / java-audit-lab

Evidence-driven Java security review workbench

kulchankas / paranoid

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.