vxcontrol / pentagi

Self-hosted multi-agent system that autonomously plans and runs penetration tests using tools like nmap, Metasploit and sqlmap in Docker.

Asymptote-Labs / agent-beacon

Open-source memory layer that captures coding-agent session history across harnesses and turns it into reusable knowledge for future agents.

usestrix / strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

jiwoochris / artex-global

ARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)

Check-Risk-WAF / Check-Risk-WAF

Check Risk WAF is an all-in-one Web Application Firewall with Anti-Bot and Anti-DDoS protection at L3, L4, and L7. Available on-premises or as SaaS, it protects web apps against OWASP Top 10 attacks, CWE vulnerabilities, botnets, and DoS/DDoS. Free and unlimited for everyone, forever for personal, non-commercial use.

NVIDIA / SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

gitleaks / gitleaks

Scans git repos, files, and stdin for hardcoded secrets such as passwords, API keys, and tokens.

trhhubsd / ARTEX

ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军

rawfilejson / awesome-osint-arsenal

Curated list and one-command installer for 750+ open-source intelligence and security tools across 50 categories.

opentrap / opentrap

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

morluto / awesome-reverse-engineering

Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.

x64dbg / x64dbg

Open-source user-mode binary debugger for Windows, built for reverse engineering and malware analysis of executables without source.

CarterPerez-dev / Cybersecurity-Projects

Building 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Gamified Cybersecurity learning 👇

ZeroDayEvil / ai-security-tool

🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.

Autumn-27 / ScopeSentry

Distributed security asset discovery platform covering subdomain enumeration, port scanning, vulnerability scanning, and page monitoring.

KeygraphHQ / shannon

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

AIPentest / CyberStrikeAI

The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.

ZeroDayEvil / CVE-2026-75604-PoC

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.

aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Fazmin / cve-intel

Local security intelligence for CVE triage - 38 data sources and 36 tools, risk scores and an MCP server for AI agents, all in native Rust. Private by default.

edoardottt / awesome-hacker-search-engines

A curated Markdown list of search engines for security work, covering servers, vulnerabilities, exploits, leaks, and threat intelligence.

trufflesecurity / trufflehog

Scans repositories, filesystems, and chats for leaked credentials, then verifies whether each one is still live.

nolabs-ai / nono

agent runtime security - zero trust, zero setup, zero latency agent sandboxing

google / mantis

A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

six2dez / reconftw

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

elementalsouls / Claude-BugHunter

A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.

JoasASantos / Malvex

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

Tencent / AI-Infra-Guard

A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

JesseCHale / HaleHound-CYD

ESP32-DIV HaleHound Edition for Cheap Yellow Display - Multi-protocol offensive security toolkit

pipelab-org / pipelock

Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.

lkimuk / ReArk

An intelligent reverse engineering and AI-assisted analysis tool for HarmonyOS NEXT (HAP/APP/ABC), Android (APK/AAB), iOS (IPA), and native PE/ELF/Mach-O binaries.

ZeroDayEvil / CVE-2026-54121-Certighost

🛡 Official AI Security Tool module for CVE-2026-54121 (Certighost): AD CS certificate abuse deep-dive, defensive audit workflows, and safe in-app console execution for authorized Active Directory security testing.

CyberDefenderAI / AI-Security-Tools-Applied-Scenarios

A highly actionable, curated list of open-source tools and practical use cases leveraging AI, ML, and LLMs to solve complex information security challenges. This module bridges the gap between theoretical AI capabilities and daily security operations.

kamalx06 / TornadoC2

Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64.

Infisical / infisical

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

Netw0rkNoob / VulnClaw

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排， 配合大语言模型， 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

KatrielMoses / MailAccess

Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess

GitHubSecurityLab / gh-secure

A GitHub CLI extension to enable security features on repositories following best practices from GitHub Security Lab.

Karib0u / rustinel

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

lissy93 / web-check

🕵️‍♂️ All-in-one OSINT tool for analysing any website

lissy93 / personal-security-checklist

🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026

secdev / scapy

Scapy: the Python-based interactive packet manipulation program & library.

google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

vavkamil / awesome-bugbounty-tools

A curated list of various bug bounty tools

kaifcodec / user-scanner

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.

DedSecInside / TorBot

Dark Web OSINT Tool

cifertech / ESP32-DIV

ESP32DIV is a multi-purpose wireless offensive and defensive toolkit powered by an ESP32

CyberStrikeus / CyberStrike

Open-source AI-powered offensive security harness for automated penetration testing.

betterleaks / betterleaks

Find leaked secrets everywhere.

0xMarcio / pocindex

Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.

2akouwu / reverify

Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.

ASCIT31 / Dark-Moon

Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.

OSINT-Experts-Society / Consensus-OSINT

🔎 Username, email & phone OSINT — 9,700+ lookup checks from 19 projects, with profile enrichment, bulk searches, evidence graphs and expert-reviewed updates.

fail2ban / fail2ban

Daemon to ban hosts that cause multiple authentication errors

wazuh / wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

jason5ng32 / MyIP

The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.

BishopFox / sliver

Adversary Emulation Framework

PyCQA / bandit

Bandit is a tool designed to find common security issues in Python code.

zizmorcore / zizmor

Static analysis for GitHub Actions (and more)