projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

NVIDIA / SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

zaproxy / zaproxy

The ZAP by Checkmarx Core project

future-architect / vuls

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

wpscanteam / wpscan

WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via contact@wpscan.com

NVIDIA / garak

the LLM vulnerability scanner

google / tsunami-security-scanner

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

PyCQA / bandit

Bandit is a tool designed to find common security issues in Python code.

lintsinghua / DeepAudit

DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。

Bearer / bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

ajinabraham / nodejsscan

nodejsscan is a static security code scanner for Node.js applications.

kpcyrd / sn0int

Semi-automatic OSINT framework and package manager

doyensec / inql

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

shekyan / slowhttptest

Application Layer DoS attack simulator

fkie-cad / cwe_checker

cwe_checker finds vulnerable patterns in binary executables

semgrep / semgrep-rules

Semgrep Community Edition rules, maintained by Semgrep and the community. Free to use under the Semgrep Rules License.

mongodb / kingfisher

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

CERT-Polska / Artemis

A modular vulnerability scanner with automatic report generation capabilities.

protofire / solhint

Solhint is an open-source project to provide a linting utility for Solidity code.

vigolium / vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.

stanislav-web / OpenDoor

OWASP Web Recon & Directory Discovery Platform

zaproxy / zap-extensions

ZAP Add-ons

hashgraph-online / hol-guard

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

toby-bridges / api-relay-audit

Local security audit for AI API relays and LLM proxies: detects prompt injection, model substitution, tool-call rewriting, SSE anomalies, error leakage, and Web3 wallet risks.

appvia / krane

Kubernetes RBAC static analysis & visualisation tool

NVIDIA / SkillEvaluator

Multi-tier framework for evaluating AI agent skills with quality gates, semantic overlap detection, synthetic evaluation dataset generation, and live agent evaluation that measures how skills affect agent behavior.

Ostorlab / oxo

OXO is a security scanning orchestrator for the modern age.

boostsecurityio / poutine

poutine, a supply chain vulnerability scanner for build pipelines

graygnatconsole / mcp-audit-tool

🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI ready.

eldarshiraliyev / BugScanner

🐛 Advanced web vulnerability scanner with 5-rule false-positive reduction, WAF evasion, and modern HTML reports

BushANQ / DRX-Operator

—

luantak / is-malicious

A codebase scanner that helps you not run malicous code

Spade-sec / jsowl

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态扫描、运行时交互、AI 辅助分析与 MCP Server，输出 JSON 与交互式 HTML 报告，是渗透测试、红队信息收集与 Web 安全测试的高效自动化方案。

vigneshwaran1702 / Cloud-Security-Scanner

Cloud Security Scanner is a tool that automatically scans cloud environments to identify security vulnerabilities, misconfigurations, and compliance risks, helping organizations protect their cloud infrastructure.