Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Open Source Agentic Security Scanner
| Date | Stars |
|---|---|
| 2026-07-31 | 314 |
| 2026-08-06 | 314 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
15.0
growth rate 0.00%/day
# ⏚ [OpenHack](https://openhack.com) **Open Source Agentic Security Scanner & Verifier for your codebase.** Like Claude Code Security / Codex Security but open source and **exclusively uses open source models**. <p align="center"> <a href="https://openhack.com"><img src="https://img.shields.io/badge/Website-openhack.com-0969da?style=for-the-badge" alt="Website"></a> <a href="https://openhack.com/discord"><img src="https://img.shields.io/badge/Discord-Join_Server-5865F2?style=for-the-badge&logo=discord&logoColor=white" alt="Discord"></a> <a href="https://x.com/openhackai"><img src="https://img.shields.io/badge/X-@openhackai-000000?style=for-the-badge&logo=x&logoColor=white" alt="Follow on X"></a> </p> <p align="center"> <a href="https://pypi.org/project/openhack/"><img src="https://img.shields.io/pypi/v/openhack?style=for-the-badge&label=pypi&color=3775A9" alt="PyPI"></a> <a href="https://github.com/openhackai/openhack/blob/main/LICENSE"><img src="https://img.shields.io/github/license/openhackai/openhack?style=for-the-badge" alt="License"></a> </p> ## Get started ```bash pipx install openhack ``` Or with [uv](https://docs.astral.sh/uv/): ```bash uv tool install openhack ``` Or with pip: ```bash pip install openhack ``` ## How it works OpenHack does `recon` -> `hunting` -> `validation` -> `verification` all in one pipeline to find high quality verified vulnerabilities. **Recon**: Does a deep dive and fully understands your application along with any custom context you give it. Builds a full project model before hunting begins. **Hunter**: Specialized category based hunters get to finding vulnerabilities initially, along with feature based hunters divind deep to find vulnerabilities in risky code areas. **Validation**: Validation agent performs a review of the finding and it's impact and whether it's even valid. **Verification**: Verification agent performs a full browser + sandbox based attack to find verify vulnerabilities in a real docker / DOM environment. ## Quick start ```bash openhack ``` On first run you'll go through a one-time setup: 1. Pick **Login with OpenHack account** (recommended) — opens a browser, you log in, get **$20 in free credits**, and the CLI gets a token automatically. 2. Type `/scan .` to scan the current directory, or `/scan path/to/repo` for somewhere else. 3. While scanning, the **Trace tab** shows live agent activity (recon → hunters → validators). When the scan finishes, the **Findings tab** shows everything that was found. ## What it does OpenHack runs a multi-agent pipeline against your codebase: - **Recon** — reads the code, builds a project model - **Hunters** — multiple specialized agents look for different vulnerability classes (input validation, access control, data handling, …) - **Feature hunters** — deeper passes on specific risk categories (XSS rendering, raw SQL, command exec, etc.) - **Validators** — re-read the suspect code to confirm or reject each candidate finding - **Sandbox verification** (`/verify sandbox`) *(Beta — requires Docker)* — spins up your app in a Docker container and attempts to exploit each finding with live HTTP requests. Findings that are successfully exploited get a ✓ mark. - **Browser verification** (`/verify browser`) *(Beta — requires Docker when combined with sandbox)* — launches a headless browser against the sandboxed app to verify client-side vulnerabilities (XSS, CSRF, DOM-based issues) with real browser execution. > **Docker prerequisite.** Sandbox verification requires Docker Desktop (or any working Docker daemon) installed and running on the machine where the scan runs. Browser verification inherits this when used with sandbox. If Docker isn't running, `/verify sandbox` will fail with a clear error before the scan starts. For every confirmed finding you get: severity, CVSS score, file location, full description, the vulnerable code snippet, and a recommended fix — all rendered with syntax hi
Excerpt of 11,175 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:158bf1b65e81d98f, llm:Repository topics: agents, ai, cybersecurity, hacking, llm, sast, security; description: 'Open Source Agentic Security Scanner' — an AI agent for security scanning (SAST).
matched fp:158bf1b65e81d98f, llm:Repository topics: agents, ai, cybersecurity, hacking, llm, sast, security; description: 'Open Source Agentic Security Scanner' — an AI agent for security scanning (SAST).
matched fp:158bf1b65e81d98f, llm:Repository topics: agents, ai, cybersecurity, hacking, llm, sast, security; description: 'Open Source Agentic Security Scanner' — an AI agent for security scanning (SAST).
matched fp:158bf1b65e81d98f, llm:Repository topics: agents, ai, cybersecurity, hacking, llm, sast, security; description: 'Open Source Agentic Security Scanner' — an AI agent for security scanning (SAST).