better-isms / grcskills
Open GRC skills for AI agents. By ISMS Copilot.
better-isms / grcskills
wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
next-terminal / next-terminal
A simple, secure, easy-to-use bastion and session auditing system. Supports RDP, SSH, VNC, Telnet, HTTP, records and replays sessions for auditing and compliance.
sipyourdrink-ltd / bernstein
The open-source governance layer for AI agents: write the rules declaratively, Bernstein enforces them and produces the verifiable, replayable record. Free, Apache-2.0. https://bernstein.run
borghei / Claude-Skills
385 AI skills, 77 expert agents, and 900 stdlib Python tools for every team: engineering, PM, marketing, C-level, compliance, business ops, research, and a LinkedIn toolkit. Installs on Claude Code, Cursor, Codex, Gemini, Copilot, and 6 other AI assistants.
jagmarques / asqav-sdk
Python and TypeScript SDKs for verifiable evidence of AI agent actions. Signed receipts, policy enforcement, audit trails. Works with LangChain, CrewAI, MCP.
prowler-cloud / prowler
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
kubescape / kubescape
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
We5ter / Scanners-Box
The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵
bridgecrewio / checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
kyverno / kyverno
Unified Policy as Code
microsoft / agent-governance-toolkit
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
cloud-custodian / cloud-custodian
Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
iflytek / astron-rpa
Agent-ready RPA suite with out-of-the-box automation tools. Built for individuals and enterprises.
HotCakeX / Harden-Windows-Security
Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Enterprise, Government and Military security levels | SLSA Level 3 Compliant for Secure Development and Build Process | Apps Available on MS Store✨
intuitem / ciso-assistant-community
CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 200+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.
FastForwardTeam / FastForward
Don't waste your time with compliance. FastForward automatically skips annoying link shorteners.
ElementsProject / lightning
Core Lightning — Lightning Network implementation focusing on spec compliance and performance
ComplianceAsCode / content
Security automation content in SCAP, Bash, Ansible, and other formats
ballerine-io / ballerine
Open-source infrastructure and data orchestration platform for risk decisioning
getprobo / probo
Open source solutions for SOC2, GDPR, and ISO27001
getplumber / plumber
Plumber detects CI/CD security issues in your GitHub workflows and gives you a score
tlsfuzzer / tlsfuzzer
SSL and TLS protocol test suite and fuzzer
DRYTRIX / TimeTracker
Self-hosted time tracking & invoicing for freelancers and teams: timers, projects, PDF and Peppol e-invoicing. Open-source Toggl/Clockify alternative.
RomanZhukov9 / Crypto-Recovery-Tool
Python-based cryptocurrency wallet forensics suite supporting 40+ wallet types on Windows, Linux, and macOS. Features encrypted vault analysis, wallet detection, seed recovery, multi-chain address derivation, threaded processing, and TXT/CSV/JSON export. Designed for security research, compliance, incident response, and blockchain investigations.
Chloe-MIAOmiao / Sales-Agent
An enterprise-grade AI Agent platform designed to streamline sales quality assurance, enforce compliance auditing, and automate high-converting follow-up workflows for EdTech and high-ticket service teams. By analyzing unstructured sales conversation logs, the system bridges the gap between risk management and sales enablement.
ZhangRui987 / agent-oversight-framework
AI 执行与监察体系（Agent Oversight Framework）：分层治理规范 + L2 运行时监察参照实现——证据分级、自校正、边界诚实。A layered governance spec for AI agents, plus a runnable reference implementation of the L2 runtime-oversight layer. Docs CC BY-SA 4.0 / code Apache-2.0.
open-policy-agent / opa
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
codenotary / immudb
immudb - immutable database based on zero trust, SQL/Key-Value/Document model, tamperproof, data change history
ossec / ossec-hids
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
b3nj5m1n / xdg-ninja
A shell script which checks your $HOME for unwanted files and directories.
inspec / inspec
InSpec: Auditing and Testing Framework
xtdb / xtdb
An immutable SQL database for application development, time-travel reporting and data compliance. Developed by @juxt
snapotter-hq / SnapOtter
Open-source, self-hosted file-processing tool. Convert, compress, OCR, transcribe & run local AI across image, video, audio, PDF & documents, via UI, REST API & pipelines. Your files never leave your network.
Bearer / bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Checkmarx / kics
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
aboutcode-org / scancode-toolkit
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!
usnistgov / macos_security
macOS Security Compliance Project
Microsoft365DSC / Microsoft365DSC
Manages, configures, extracts and monitors Microsoft 365 tenant configurations
zakirkun / deep-eye
Deep Eye orchestrates multiple AI providers (OpenAI, Claude, Grok, Gemini, OLLAMA, Groq, Mistral, OpenRouter, LiteLLM, LM Studio) for intelligent payload generation, scans targets for 45+ vulnerability types, and produces professional reports with compliance mapping.
tractorjuice / arc-kit
The Enterprise Architecture Governance Harness — strategy, architecture, delivery, and assurance using AI coding assistants
oss-review-toolkit / ort
A suite of tools to automate software compliance checks.
trycompai / comp
AI Native platform to get companies compliant - Vanta & Drata Alternative
konstruktoid / hardening
Hardening Ubuntu. Systemd edition.
OpenSCAP / openscap
NIST Certified SCAP 1.2 toolkit
simonlin1212 / global-stock-data
美股与全球市场数据工具包（给 AI 编程助手用）：官方源优先、零鉴权、标注合规级别 | US & global market data for AI coding assistants — zero-auth, official sources. CBOE options + 0DTE, VIX term structure, FINRA short data, SEC Form 4 / 13F, central-bank rates & FX, Taiwan exchanges, EIA energy. 16 layers, 50+ endpoints, 17 sources, each with its compliance tier.
project-copacetic / copacetic
🧵 CLI tool for directly patching container images!
tirrenotechnologies / tirreno
tirreno is an open-source framework for building sovereign security, compliance and fraud prevention applications. Detect account takeovers, cyberfraud and business logic abuse inside your product.
aklofas / kicad-happy
AI coding agent skills for KiCad electronics design. Works with Claude Code and OpenAI Codex. Analyze schematics, review PCB layouts, EMC pre-compliance, SPICE simulation, download datasheets, source components, and prep boards for fabrication.
mnemox-ai / tradememory-protocol
Decision audit trail + persistent memory for AI trading agents. Outcome-weighted recall, tamper-evident SHA-256 chain with RFC 3161 anchoring, 20 MCP tools.
aws-cloudformation / cloudformation-guard
Guard offers a policy-as-code domain-specific language (DSL) to write rules and validate JSON- and YAML-formatted data such as CloudFormation Templates, K8s configurations, and Terraform JSON plans/configurations against those rules. Take this survey to provide feedback about cfn-guard: https://amazonmr.au1.qualtrics.com/jfe/form/SV_bpyzpfoYGGuuUl0
silverhack / monkey365
Monkey365 is an open-source security assessment tool for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals identify misconfigurations, review cloud security posture, and evaluate environments against industry security best practices and compliance standards.
owasp-dep-scan / dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
wazuh / wazuh-docker
Wazuh - Docker containers
cloud-gouv / securix
SécurixOS is a NixOS-based secure operating system tailored for small to medium-sized teams. It provides a minimal, hardened environment with strong isolation, reproducibility, and policy-driven configurations to ensure operational security and compliance.
fossology / fossology
FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line. As a system, a database and web ui are provided to give you a compliance workflow. License, copyright and export scanners are tools used in the workflow.
adrg / xdg
Go implementation of the XDG Base Directory Specification and XDG user directories
Sushegaad / Claude-Skills-Governance-Risk-and-Compliance
Claude Skills for Governance, Risk, & Compliance (GRC): Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, EU AI Act, ISO 42001, ISO 27701, DORA, CSRD, India's DPDPA, CMMC 2.0, NIST AI Risk, SWIFT, CCPA/CPRA, and others. Benchmark 89% (with skills) vs 55% (without skills). Updated Monthly.
usnistgov / OSCAL
Open Security Controls Assessment Language (OSCAL)
licensee / licensee
Ruby gem & CLI to detect a project's open source license (SPDX) from LICENSE files, package manifests, and READMEs