A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.
Type legend: 🟢 public source / open-source · 🔬 research (paper / benchmark / dataset / framework) · 🟠 commercial with open components ·
GitHub-hosted entries show static ★ stars and last-commit snapshots; refresh them with python3 scripts/update_github_metrics.py before release. Most recently refreshed entry: 2026-11-01. Hugging Face model entries show license, access, and artifact metadata. Ordering within a section favors flagship and actively maintained projects.
- Autotriage of Security Findings
- AI Agent & Coding-Agent Security
- AI/ML Supply Chain & Model Security
- Pentest & Red-Team Agents
- AI-Powered Recon & Narrow ML Tools
- AI-Powered SAST & Secure Code Review
- AI-Powered Threat Modeling
- LLM-Driven Fuzzing
- Threat Intelligence
- Log Analysis / SIEM / SOC Triage
- Reverse Engineering
- LLM Red-Teaming & Guardrails
- LLM Honeypots & Deception
- CTF / Exploit / Bug-Bounty Agents & Benchmarks
- Cloud / IaC / DFIR / OSINT / Phishing
- Related Awesome Lists
- Contributing
- Contact
- License
AI/LLM tools that triage, deduplicate, prioritize, or validate the output of scanners and finding sources.
- Metis 🟢 — Security-review framework that triages external SARIF findings using source-navigation evidence, optional C/C++ code graphs, and structured LLM decisions. (Arm) Caveat: hosted providers receive selected source and evidence and require credentials; local providers need separately provisioned weights, and indexing may use a separate embedding provider. Debug traces can contain sensitive content. Model verdicts are not proof of exploitability or grounds for automatic suppression. (★ 877 · updated 2026-10-12)
- nuclei-autotriage 🟢
⚠️ — Two-stage LLM triage (falsifier + red-team pass) of Nuclei JSONL findings via OpenAI-compatible endpoints (vLLM/Ollama). (CyberOK) — note: restrictive personal/non-commercial EULA, not a permissive OSS license. (★ 1 · updated 2026-05-25)- Related: agent-audit · asamm
- seclab-taskflow-agent 🟢 — YAML-driven taskflow agent framework for triaging CodeQL/SAST alerts and filtering false positives. (GitHub Security Lab) (★ 268 · updated 2026-09-28)
- Related: SigmaOptimizer
- honeyslop 🟢 — Code-canary decoys to triage AI-hallucinated ("slop") vulnerability reports flooding bug-bounty programs. (★ 101 · updated 2026-05-20)
- nano-analyzer 🟢🔬 — Minimal three-stage LLM pipeline (context → scan → skeptical triage) for zero-day discovery in C/C++. (AISLE) (★ 366 · updated 2026-04-14)
- SigmaOptimizer 🟢 — Generates, tests, and refines Sigma rules from real logs with false-positive checking. (★ 11 · updated 2025-08-01)
- Related: soctalk · seclab-taskflow-agent
- ai-soc-triage-assistant 🟢
⚠️ — SOC alert triage assistant with prompt-injection guardrails, output validation, and MITRE ATT&CK mapping. (★ 0 · updated 2026-02-23)
See also: OpenAI's Aardvark research preview — public references exist, but there is no standalone installable repository to badge here.
Securing the AI agents themselves — auditing coding agents (Claude Code, Codex, OpenClaw), scanning skills / plugins / MCP manifests, and governance for agentic development. A fast-moving 2026 category, split below by role.
- Geiger 🟢 — Local CLI that inventories AI-agent installations, MCP configurations, hooks, and extensions, and reports credential-shaped values and configuration drift. Caveat: configuration inventory, not runtime monitoring or enforcement; exposure labels are heuristics, and coverage depends on known locations and readable files. Detector errors can leave gaps even when the strict-mode exit code is clean; explicit report options write local files. (★ 163 · updated 2026-09-21)
- Sources: Reviewed scan engine
- Guardana 🟢 — Verifies AI artifacts, live-system checks, and recorded agent traces, including evidence of unapproved side effects, outside the request path. Caveat: beta; trace checks depend on complete, trustworthy evidence and do not enforce tool calls. Built-in artifact checks are local, while active probes contact configured targets and optional collectors receive reports. Not a general SAST scanner or compliance certification. (★ 272 · updated 2026-10-13)
- agent-audit 🟢 — Forensic auditor for local AI coding agents (Claude Code, Codex CLI, OpenClaw) and project-surface scanner for repos shipping skills, plugins, and MCP manifests; 296 bundled rules across native + imported detector families, with optional LLM cross-verification. (CyberOK / S. Gordeychik) (★ 15 · updated 2026-07-15)
- Sources: asamm · ATR – Agent Threat Rules · aguara · Cisco AI Defense – skill-scanner
- Related: asamm · aguara · agentguard · agentic-radar · nuclei-autotriage
- AI-Infra-Guard 🟢 — Full-stack AI red-teaming platform covering OpenClaw security scan, agent scan, skills scan, MCP scan, AI-infra vulnerability scan, and LLM jailbreak evaluation. (Tencent Zhuque Lab) (★ 6,847 · updated 2026-10-13)
- SkillSpector 🟢 — Security scanner for AI-agent skills used by Claude Code, Codex CLI, Gemini CLI, and similar ecosystems; combines static analysis, AST/YARA/taint checks, optional LLM semantic review, MCP least-privilege/tool-poisoning checks, risk scoring, and SARIF/JSON/Markdown output. (NVIDIA) (★ 20,087 · updated 2026-10-13)
- Ramparts 🟢 — Rust scanner for MCP servers and agent-skill bundles with YARA rules, optional LLM analysis, OSV/CVE lookups, OWASP MCP Top 10 mapping, and SARIF/JSON/Markdown reports. (★ 98 · updated 2026-10-08)
- lintlang 🟢 — Local deterministic linter for AI-agent instructions, tool definitions, and system prompts that flags ambiguous descriptions, missing limits, conflicting directives, and schema gaps, with CLI and SARIF output. — note: heuristic static instruction/config review only; not runtime enforcement, prompt-injection detection, semantic-correctness proof, or a security guarantee. (★ 140 · updated 2026-10-07)
- Related: little-canary · rule-audit
- mcp-armor 🟢 — Local MCP security scanner with auto-discovery for agentic IDE configs, tool/resource/prompt inventory, prompt-injection checks, rug-pull and tool-poisoning detection, baseline drift monitoring, and JSON/Markdown reports. (Aira Security) (★ 124 · updated 2026-03-27)
- Related: SkillSpector · Ramparts · Cisco AI Defense – mcp-scanner
- aguara 🟢 — Single-binary static scanner (Go, no LLM) for AI-agent skills and MCP servers; multi-layer engine (pattern + NLP + taint tracking + rug-pull detection). Companion aguara-mcp exposes scanning as an MCP tool. (★ 93 · updated 2026-09-10)
- Related: aguara-mcp · agent-audit · Snyk Agent Scan · Cisco AI Defense – skill-scanner
- agent-scan 🟢 — Security scanner for AI agents, MCP servers, and agent skills; the successor path for the original Invariant Labs mcp-scan work. (Snyk) (★ 3,132 · updated 2026-10-06)
- inkog 🟠 — Commercial-backed static security scanner for AI agents across LangChain, LangGraph, CrewAI, AutoGen, and no-code workflows; Apache-2.0 CLI with proprietary deep-scan engine. (Inkog) (★ 30 · updated 2026-09-16)
- Related: Snyk Agent Scan · agentic-radar
- AgentShield 🟢 — Security scanner for AI-agent configurations, MCP servers, hooks, and tool permissions with CLI, GitHub Action, and app workflows. (★ 1,278 · updated 2026-09-10)
- Related: agent-audit · Snyk Agent Scan
- repo-forensics 🟢
⚠️ — Offline scanner for AI-agent repos, skills, plugins, and MCP servers; license is PolyForm Noncommercial. (★ 191 · updated 2026-10-13)- Related: agent-audit · aguara
- skill-scanner 🟠 — Scanner for agent skills combining YAML + YARA patterns, LLM-as-a-judge, and behavioral dataflow analysis (Codex / Cursor skill formats). (Cisco AI Defense) (★ 2,596 · updated 2026-10-09)
- Related: defenseclaw · aguara · Cisco AI Defense – mcp-scanner
- mcp-scanner 🟢
⚠️ — Scanner for MCP servers and agentic tool surfaces, covering tools, prompts, resources, package risk, malware indicators, and deployment readiness. (Cisco AI Defense) (★ 1,091 · updated 2026-10-07)- Related: Cisco AI Defense – skill-scanner · Snyk Agent Scan · aguara
- mcp-guardian 🟢 — JS/TS library and CLI for detecting prompt injection in MCP tool descriptions and pinning tool definitions. (★ 6 · updated 2026-07-29)
- Related: Cisco AI Defense – mcp-scanner · Snyk Agent Scan
- MCP Observatory 🟢🟠 — CI-native MCP-server testing tool for schema drift, safe attack simulation, record/replay verification, health scoring, and SARIF evidence before agents depend on a server. (KryptosAI) — note: the local evidence engine is open source; hosted telemetry intelligence, fleet workflows, and commercial ranking remain outside the package. (★ 142 · updated 2026-10-01)
- Related: Cisco AI Defense – mcp-scanner · skilltotal
- agentic-radar 🟠 — CLI security scanner for agentic workflows (LangGraph, CrewAI, n8n, etc.) — maps tools/data flows and flags risks. (SplxAI) (★ 1,059 · updated 2025-11-27)
- skilltotal 🟢 — Offline deterministic static scanner (regex + AST, no LLM, no account) for AI components — agent skills/plugins, MCP servers, npm & PyPI packages, and git repos; flags supply-chain risk, dangerous capabilities, prompt-injection surfaces, MCP tool poisoning/shadowing, and data-exfiltration paths, maps to the OWASP Agentic Skills Top 10, and emits JSON + SARIF 2.1.0. (skilltotal.ai) (★ 12 · updated 2026-10-12)
- Sunglasses 🟢 — Local input/content scanner for AI agents that checks prompts, files, media metadata, skills, and tool descriptions against pattern and mechanism-based prompt-injection, exfiltration, command-injection, and agent-threat rules. — note: early-stage project; published precision/recall benchmark is self-reported by the project. (★ 10 · updated 2026-10-13)
- Related: skilltotal · Armorer Guard
- trentclaw 🟠 — Client-side security auditor for OpenClaw deployments: applies pattern-based secret redaction locally, then uploads config/skill metadata and confirm-gated skill archives to Trent AI's API, which identifies misconfigurations, risky skills (prompt injection, permission escalation, data exfiltration), and chained attack paths. (Trent AI) — note: core detection runs server-side via the Trent AI API (requires an API key); the Apache-2.0 client collects OpenClaw config/skill metadata, applies pattern-based secret redaction locally, and uploads skill archives only after an explicit in-terminal confirmation. (★ 23 · updated 2026-07-27)
- A2A Security Scanner 🟢 — CLI and PyPI scanner for Agent-to-Agent (A2A) agent cards, source code, registries, and live endpoints using specification validation, YARA rules, heuristics, endpoint testing, and an optional LLM analyzer. (Cisco AI Defense) (★ 166 · updated 2026-04-16)
- Related: Cisco AI Defense – mcp-scanner · Agent Threat Rules
- Ship Safe 🟢🟠 — Local security CLI for application code, AI-agent and MCP configuration, secrets, dependencies, CI, and cloud/IaC surfaces, with deterministic checks, optional AI-assisted analysis, and SARIF output. — note: the MIT CLI works without an account for its core checks; optional AI modes can send selected context to the configured provider, while hosted dashboards and organization workflows are separate commercial features. Coverage and benchmark figures are project-reported. (★ 858 · updated 2026-10-09)
- Related: SkillTotal · agent-audit
- AgentSeal 🟠
⚠️ — Agent-security CLI and runtime library for scanning MCP servers, skills, prompts, and configuration, plus local guard and monitoring workflows with optional model-assisted red teaming. — note: source-available under FSL-1.1-Apache-2.0 rather than an OSI-approved open-source license; offline guard and MCP/skill scanning are available locally, while red-team modes require local Ollama or configured provider credentials. Catalog and coverage figures are project-reported. (★ 377 · updated 2026-06-11)- Related: agent-scan · AgentLock
- SlowMist Agent Security 🟢 — Security-review skill and workflow for auditing agent skills, MCP servers, repositories, URLs, and documents before installation or use. (SlowMist) — note: Markdown-based workflow skill executed by a compatible host agent, not a deterministic standalone scanner; findings depend on the selected model and its available tools. (★ 510 · updated 2026-04-17)
- Related: MCP-Security-Checklist · sast-skills
- Sandbox Probe 🟢 — Static Go probe that measures the effective filesystem, network, process, credential, and runtime capabilities exposed inside an AI-agent sandbox, then compares sandbox and host baselines. (ControlPlane) — note: boundary-measurement auditor, not an enforcement layer; some integration scripts can ask real agents to execute the probe, while deterministic model-free stubs are available for CI. (★ 27 · updated 2026-09-08)
- Related: Sandlock · AIO Sandbox
- RepoGuardBench 🟢🔬 — Repository prompt-injection benchmark with coding tasks, attack carriers, defenses, and separate scoring of attack attempts, observed outcomes, and task utility. Caveat: its subprocess workspace is not an OS sandbox: allowing Python or pytest does not prevent host-file access or networking. Use a separate disposable environment without secrets; marker-based outcomes and model behavior are not proof of production isolation. (★ 71 · updated 2026-10-03)
- Project CodeGuard 🟢
⚠️ — Model-agnostic secure-coding rules and skills framework with translators for popular coding agents, validators, release artifacts, and an MCP server for centrally distributing the rules. (CoSAI / OASIS) — note: framework and ruleset, not a deterministic scanner or runtime enforcement boundary; repository content uses CC BY 4.0 rather than a conventional software license. (★ 353 · updated 2026-10-12) - asamm 🔬 — Agentic SAMM — an OWASP SAMM extension for AI-driven development: an entry-point-based threat taxonomy plus 17 controls across 5 SAMM functions (Governance, Design, Implementation, Verification, Operations) with L1/L2/L3 maturity. License: CC BY-SA 4.0. (CyberOK / S. Gordeychik) (★ 18 · updated 2026-07-26)
- agent-threat-rules (ATR) 🟢 — Open, versioned, machine-readable detection rules for AI-agent threats (prompt injection, tool poisoning, MCP attacks, and skill compromise) — "Sigma for agents"; 768 rules across 10 categories with integrations for Microsoft AGT, Cisco AI Defense, MISP, OWASP, FINOS, and SigmaHQ. (★ 412 · updated 2026-10-12)
- Agent Governance Toolkit 🟢 — Multi-language toolkit for policy-enforced agent tool calls and audit records, with optional identity, MCP-gateway, sandboxing, reliability, and compliance components. (Microsoft) — note: official public preview; APIs and deployment patterns may change before general availability. (★ 6,421 · updated 2026-10-12)
- Related: ATR – Agent Threat Rules · ToolHive
- MCP-Security-Checklist 🟢 — Security checklist for MCP clients, servers, multi-MCP deployments, lifecycle controls, authz/authn, isolation, and crypto-specific MCP integrations. (SlowMist) (★ 831 · updated 2025-04-28)
- Anthropic-Cybersecurity-Skills 🟢 — Large community cybersecurity skill library for AI agents, mapped to MITRE ATT&CK, NIST CSF, MITRE ATLAS, D3FEND, and NIST AI RMF. — note: independent community project, not affiliated with Anthropic. (★ 34,338 · updated 2026-08-31)
- Related: sast-skills · Cisco AI Defense – skill-scanner
- Claude-BugHunter 🟢 — Claude Code / agent-skill bundle for authorized bug hunting and external red-team workflows across web, API, identity, cloud, recon, reporting, Burp MCP, slash commands, and the cbh CLI. — note: skill bundle and workflow knowledge base, not a standalone scanner. (★ 5,057 · updated 2026-10-12)
- Related: sast-skills · Anthropic-Cybersecurity-Skills
- AgentDojo 🟢🔬 — Benchmark environment for prompt-injection attacks and defenses in tool-using LLM agents. (★ 913 · updated 2026-06-02)
- Related: agent-audit · ATR – Agent Threat Rules
- Agent3Sigma-Canary 🟢🔬 — Sandboxed research framework for evaluating AI-agent security over complete execution trajectories, covering direct/indirect injection, skill and memory poisoning, and practical risk outcomes. (Ant Group) — note: research framework that requires Docker plus target and auxiliary LLM configuration; use only in controlled environments. (★ 38 · updated 2026-08-09)
- Agent Security Bench (ASB) 🟢🔬 — Official ICLR 2025 benchmark for evaluating attacks and defenses in LLM-based agents across ten scenarios, including direct and indirect prompt injection, memory poisoning, and defensive strategies. — note: research benchmark rather than a production control; reproducing evaluations requires configured target and evaluator models. (★ 312 · updated 2026-09-30)
- Related: AgentDojo · Agent3Sigma-Canary
- InjecAgent 🟢🔬 — ACL Findings 2024 benchmark of indirect prompt injection against tool-integrated LLM agents, with 1,054 cases spanning 17 user tools and 62 attacker tools. — note: historical research reference with no default-branch commits since July 2024; evaluates agent responses to simulated tool outputs rather than production enforcement, and reproduction needs compatible local models or hosted-model credentials. (★ 180 · updated 2024-07-02)
- Sources: InjecAgent paper
- Related: AgentDojo · Agent Security Bench (ASB)
- Skill-Inject 🟢🔬 — Benchmark for measuring prompt-injection vulnerabilities carried by agent skill files across Claude Code, Codex CLI, and Gemini CLI under multiple safety-policy conditions. — note: benchmark artifact that executes controlled malicious skill scenarios; run only in an isolated test environment with synthetic data and accounts. (★ 99 · updated 2026-07-01)
- Related: SkillSpector · AgentDojo
- AI Security Verification Standard (AISVS) 🔬
⚠️ — Stable verification standard defining testable security requirements for AI applications across model lifecycle, supply chain, data handling, agentic systems, and MCP integrations. (OWASP) — note: security standard and checklist, not an executable scanner; share-alike terms apply to adapted material. (★ 552 · updated 2026-10-09) - OWASP Agent Security Regression Harness 🟢 — Vendor-neutral harness for running repeatable agent and MCP abuse scenarios, evaluating policy assertions over execution traces, and emitting machine-readable regression results for local development and CI. (OWASP) — note: early OWASP Incubator project; it is a regression harness for known abuse cases, not a scanner, leaderboard, general benchmark, or guarantee of agent security. (★ 55 · updated 2026-07-27)
- Related: Agent Security Bench (ASB) · AgentDojo
- OpenAPPA 🟢 — Rust information-flow policy engine and agent-tool runtime that tracks trajectory labels and effects and binds approvals to actions using recorded events. (Archestra) Caveat: preview/RFC with evolving interfaces. Policy evaluation is deterministic for fixed policy and recorded evidence, not for whole-agent behavior; protection requires correct tool contracts, trusted labels, and complete mediation. Configured annotation authorities may use LLMs, and project-run benchmarks do not establish universal prompt-injection or exfiltration prevention. (★ 1,556 · updated 2026-10-13)
- Sources: Reviewed policy checks · Recorded-state projection
- Vetto 🟢 — Rust command wrapper that applies native OS containment to coding-agent subprocesses through Linux Landlock/namespaces and platform-specific sandbox backends. Caveat: repository returned HTTP 404 on 2026-10-13; availability is unconfirmed and metrics retain the 2026-10-05 snapshot. Guarantees vary by OS and selected tier: Linux FULL requires kernel support, while FS-ONLY lacks mount/PID/network namespaces and has descendant-cleanup limits. Allowed paths, environment values, and network destinations remain agent capabilities; this is not semantic prompt-injection protection. Optional telemetry is opt-in, and release binaries and escape resistance were not independently verified. (★ 45 · updated 2026-10-05)
- Sources: Reviewed threat model · Telemetry configuration
- Spring MCP Security 🟢 — Spring security components for MCP authentication, JWT audience validation, principal-bound sessions, and transport Origin/Host checks. (Spring AI Community) Caveat: match library and Spring AI versions and the supported transport/stack combination. Operators must configure issuers, scopes, and application authorization; these controls do not detect prompt injection. (★ 118 · updated 2026-09-20)
- yoloAI 🟢 — Coding-agent sandbox runner with multiple backends, credential-brokering integrations, and a copy/diff/apply workflow for reviewing workspace changes. Caveat: public beta; isolation depends on the backend and configuration. Select network isolation explicitly, avoid privileged modes, and review mounts; agents without broker support receive mounted credentials, and hosted agents still send context to their providers. (★ 219 · updated 2026-10-12)
- Jailoc 🟢 — Container launcher for OpenCode with configurable workspace mounts, network/DNS policy, resource limits, and secret references. (Seznam) Caveat: Docker and the agent image remain trusted dependencies; extra mounts, SSH-agent forwarding, optional Docker access, and supplied credentials expand the boundary. Container configuration is not a guarantee against escape or data disclosure to model providers. (★ 32 · updated 2026-09-24)
- Agent Sandbox (agentbox) 🟢 — Container-based coding-agent environment with proxy-mediated egress policies and server-side credential injection. Caveat: the reviewed firewall permits the detected Docker host subnet, not only the proxy, and has no IPv6 rules; proxy enforcement is inactive outside enforce mode. Review IPv6, neighboring services, writable mounts, and the IDE/control plane rather than assuming complete network or host isolation. (★ 210 · updated 2026-10-11)
- Crust 🟢
⚠️ — Local Go gateway that extracts tool calls from supported model API responses and applies rules before forwarding them to an agent. Caveat: source-available under Elastic License 2.0, including managed-service restrictions, not a permissive OSS license. Only intercepted supported paths are covered; parse failures can pass the original body through. The sample forwards to OpenRouter, disables local telemetry, and leaves the storage encryption key empty; review provider disclosure and any enabled local records. (★ 439 · updated 2026-03-30) - Agent Safehouse 🟢 — macOS launcher that assembles Seatbelt sandbox-exec profiles to scope coding agents' filesystem and integration access. Caveat: macOS-only hardening, not a VM or prompt-injection detector. The default profile permits inbound and outbound networking; exfiltration prevention is explicitly out of scope. Granted workspaces and integrations remain accessible, and launched agents retain their own credential, billing, and network behavior. (★ 2,104 · updated 2026-09-30)
- OpenShell 🟢 — Policy-governed runtime for autonomous and coding agents with container or microVM-backed sandboxes, filesystem/process/network controls, endpoint-bound credential injection, and audit logs. (NVIDIA) — note: pre-release runtime whose effective isolation depends on the selected compute driver and policy; Kubernetes and GPU paths are experimental. Anonymous operational telemetry is enabled by default but can be disabled at deployment time or compiled out. (★ 16,028 · updated 2026-10-13)
- Sources: NVIDIA agent-stack security model
- Numbat 🟢 — Endpoint-local visibility and detection for AI-agent activity across hooks, plugins, OTLP, and on-disk artifacts, with CEL rules, multi-step sequence detections, and forensic reconstruction. (Perplexity AI) — note: monitoring is the default posture; blocking is opt-in, limited to supported synchronous pre-action hooks, and the shipped rules are monitor-only until operators explicitly configure enforcement. (★ 1,109 · updated 2026-10-09)
- agentsh 🟢 — Execution-layer policy shell for AI agents that intercepts file, network, process, signal, and selected database activity and emits structured audit events. (Canyon Road) — note: the shell shim bypasses policy for non-TTY stdin unless
--forceis used, which is critical for headless agents and CI. Linux is the production target; native macOS enforcement is alpha and native Windows drivers are not yet production-ready. (★ 393 · updated 2026-09-15) - brood-box 🟢 — Experimental runner for coding agents in hardware-isolated microVMs with copy-on-write workspace snapshots, egress profiles, selective secret forwarding, and file-by-file review before applying changes. (Stacklok) — note: APIs and behavior are explicitly experimental;
workspace-mode=directbypasses snapshot isolation and writes directly to the workspace, so it is suitable only for already-trusted interactive work. (★ 77 · updated 2026-10-13) - Greywall 🟢 — Kernel-enforced filesystem, network, syscall, and command-policy wrapper for coding agents on Linux and macOS, with a separate traffic-observability mode and least-privilege profile generation. (Greyhaven) — note: deny-by-default applies to
greywall;greywatchis intentionally permissive and records rather than blocks activity. Verify the effective platform backend and selected mode before treating it as an enforcement boundary. (★ 309 · updated 2026-08-13) - nono 🟢 — Least-privilege sandbox for AI coding agents that isolates the agent and delegated tools with composable filesystem, network, credential-proxy, and command policies. (NoLabs) — note: APIs are still stabilizing ahead of the 1.0 release; review every pulled profile before use. (★ 4,467 · updated 2026-10-12)
- Related: microsandbox · ToolHive
- Coi 🟢 — Incus-based session manager for coding agents with protected workspace mounts, configurable network policy, optional host-side monitoring, and persistent or ephemeral Linux containers. — note: shared-kernel containers are not a microVM boundary; workspace writes reach the host and configured credentials can be copied into the container. Default
restrictednetworking allows public-internet egress and monitoring is off. The hardened profile enables monitoring and reduces kernel attack surface, but is not a general exfiltration or hostile-agent containment guarantee. (★ 748 · updated 2026-10-13)- Sources: Containment threat model · Reviewed defaults
- cplt 🟢 — Kernel-backed sandbox wrapper for AI coding agents that applies Seatbelt on macOS or Landlock and seccomp on Linux, content-pins approvals for repository policy, filters environment and resource access, and gates selected git and GitHub commands. (NAV (Norwegian Labour and Welfare Administration)) — note: no native Windows backend; the standard posture permits outbound HTTPS on port 443 and warns rather than blocks
git push, while stricter egress and push blocking require explicit configuration. Linux has documented limitations around Git metadata, localhost, and SSH-agent isolation, so review the threat model and effective policy for the target platform. (★ 131 · updated 2026-10-12)- Related: nono · microsandbox
- Arcjet Guard 🟢🟠 — JavaScript runtime guard for AI-agent tool calls and MCP handlers, with prompt-injection detection, sensitive-data detection/redaction, and custom local policy rules. (Arcjet) — note: open SDK packages integrate with Arcjet's hosted platform; assess the service, account, and data-processing requirements for the protections you enable. (★ 692 · updated 2026-10-07)
- ToolHive 🟢 — Platform for running MCP servers in isolated containers with per-request identity/access policy, registry and gateway workflows, audit logs, Kubernetes operator support, and observability hooks. (Stacklok) (★ 2,276 · updated 2026-10-13)
- Related: microsandbox · defenseclaw
- Pipelock 🟢 — AI-agent firewall and verifiable egress-control layer mediating HTTP, WebSocket, CONNECT, MCP, and A2A traffic to detect prompt injection, secret exfiltration, SSRF, and suspicious outbound actions. — note: open-source core is Apache-2.0; commercial reporting/features are also advertised. (★ 922 · updated 2026-10-12)
- Related: ToolHive · mcp-context-protector
- node9 🟢 — Local policy and human-approval gate for supported coding-agent tool calls routed through agent hooks or an MCP wrapper, with credential-path checks, secret detection, and audit logging. (Node9) — note: cooperative hooks/MCP enforcement, not process isolation or a complete credential boundary; scripts are judged by their command line rather than their contents, and the egress allowlist is opt-in. Local use needs no account; optional hosted team features can transmit operational data.
node9 initasks before sending an install ping, with Yes preselected; the payload includes a persistent machine ID, detected agents, OS, and version, so it is pseudonymous rather than anonymous. (★ 220 · updated 2026-10-12) - SourceryKit 🟠
⚠️ — Python SDK for agent guardrails that intercepts outbound HTTP calls, enforces trusted-endpoint policies, logs requests, and checks agent handoff claims against a Provably backend before propagation. (ProvablyAI) — note: BSL-1.1 licensed; requires Provably backend/API credentials and database setup. (★ 21 · updated 2026-10-02)- Related: Pipelock · mcp-context-protector
- emisar 🟠
⚠️ — Agent-infrastructure control plane that exposes declared, typed actions through MCP, applies policy and approval gates before dispatch, revalidates calls on an outbound-only host runner, and records separate control-plane and host audit trails. — note: runner, MCP bridge, and packs are Apache-2.0; the hosted portal/control plane is BSL-1.1 and converts to Apache-2.0 on 2029-07-26. Connecting a runner requires an emisar account and outbound HTTPS to the control plane. (★ 337 · updated 2026-10-11) - mcp-context-protector 🟢 — MCP security wrapper that sits in front of downstream MCP servers, scans tool responses with guardrail providers, and supports quarantine/review workflows for desktop and coding-agent MCP configs. (Trail of Bits) (★ 226 · updated 2026-02-13)
- Related: Cisco AI Defense – mcp-scanner · ToolHive · Pipelock
- MCP Defender 🟢
⚠️ — Desktop app that proxies MCP tool-call requests and responses for Cursor, Claude, VS Code, and Windsurf, checks intercepted traffic against signatures, and prompts users to allow or block suspicious calls. — note: AGPL-3.0 licensed; project has been acquired by Docker. (★ 255 · updated 2026-06-05)- Related: ToolHive · mcp-context-protector
- MCP Gateway 🟢 — Plugin-based MCP gateway that proxies configured MCP servers, sanitizes sensitive request/response data, supports guardrail plugins such as basic masking and Presidio, and runs a server reputation/risk check before loading MCP servers. (Lasso Security) (★ 395 · updated 2026-01-22)
- Parallax 🟢 — Rust runtime policy engine for AI agents: evaluates lifecycle events with regex, keyword, Sigma, CEL, and SQL rules to block or redact prompt injection, data exfiltration, dangerous tool calls, and secret leakage. — note: early-stage project with limited adoption signal. (★ 38 · updated 2026-06-05)
- Related: Pipelock · Armorer Guard
- Armorer Guard 🟢 — Local Rust scanner and MCP proxy for AI-agent prompt injection, credential leakage, exfiltration, and risky tool-call arguments, with structured reasons and no scanner network calls. — note: young project with limited independent adoption signal. (★ 44 · updated 2026-08-27)
- Related: agentguard · ATR – Agent Threat Rules
- onecli 🟢 — Credential gateway and encrypted vault for AI agents; injects real API credentials at the gateway so agents only see placeholder keys. (★ 3,569 · updated 2026-10-09)
- Related: agentguard · defenseclaw
- microsandbox 🟢 — Local-first, microVM-backed programmable sandboxes for AI agents with SDKs, CLI, MCP support, and rootless hardware isolation. (★ 8,669 · updated 2026-10-12)
- agentguard 🟢 — Real-time security layer for coding agents: hooks scan every new skill, block dangerous actions before execution, run daily posture patrols, and track which skill triggered each action (incl. Web3-specific checks). (★ 467 · updated 2026-10-12)
- Related: agent-audit · defenseclaw
- AgentAegis 🟢 — OpenClaw security plugin that observes or blocks selected prompt, tool-call, memory, exfiltration, and protected-path risks through configurable agent lifecycle hooks. (Ant Group) — note: the code defaults blocking defenses to
enforce; the README'sobserveconfiguration is an optional staged-rollout example. Coverage depends on enabled hooks, modes, and protected assets; this is OpenClaw-specific defense in depth, not a general sandbox or injection-proof boundary, and published effectiveness demonstrations are project-operated. (★ 200 · updated 2026-06-26)- Sources: Configuration defaults
- defenseclaw 🟠 — Enforcement and evidence layer for agentic deployments: static CodeGuard checks, sandboxing, registry ingestion with SSRF guards, and audit/observability. (Cisco AI Defense) (★ 876 · updated 2026-10-13)
- Related: Cisco AI Defense – skill-scanner · agentguard
- clawsec 🟢
⚠️ — Security skill suite for OpenClaw-family agents; AGPL-3.0 licensed. (Prompt Security) (★ 1,119 · updated 2026-09-28)- Related: agentguard · Cisco AI Defense – skill-scanner
- AgentLock 🟢🔬
⚠️ — Pre-action authorization gate for LLM agent tool calls that decides from session provenance rather than content, with deny-by-default tool permissions, parameter lineage, Ed25519 signed receipts, and a hash-chained audit log; AGPL-3.0 licensed with commercial options. — note: evaluated on AgentDojo with predictions pre-registered before the runs; the published results include a suite where the defense costs more utility than the attack it prevents. (★ 19 · updated 2026-09-18) - h5i 🟢 — Local Rust CLI for auditable coding-agent workspaces: per-agent worktrees with sandbox policies, provenance capture, peer review, neutral verification, secret/prompt-injection audit signals, and refs/h5i/* run metadata. — note: security-adjacent agent-workspace governance tool, not a vulnerability scanner or VM-equivalent sandbox. (★ 769 · updated 2026-10-12)
- Related: microsandbox · defenseclaw
- DvalinCode 🟢 — Local-first AI coding agent with runtime governance controls: org/repo policy gates for tools, models, MCP servers, paths, and commands, plus provider/shell/MCP egress controls and hash-chained audit logs. — note: young project with limited independent adoption signal. (★ 118 · updated 2026-10-12)
- Related: h5i · Pipelock · Armorer Guard
- TAP 🟢🟠 — Credential-isolation proxy and MCP server for AI agents: agents send placeholder credentials, TAP injects real secrets server-side after per-action policy checks, with optional human approval on sensitive calls. (human.tech) — note: Apache-2.0 runtime is self-hostable, but the hosted dashboard and managed-service deployment glue are proprietary; self-hosting puts credential/key isolation and policy-engine hardening on the operator. (★ 13 · updated 2026-07-23)
- Agent Memory Guard 🟢 — Runtime middleware for AI-agent memory reads and writes, screening prompt injection, memory poisoning, secret/PII leakage, protected-key tampering, and size anomalies before persisted memory is reused. (OWASP) — note: OWASP Incubator project; published benchmark numbers are project-reported and should be independently reproduced before production enforcement. (★ 185 · updated 2026-10-13)
- AIO Sandbox 🟢
⚠️ — All-in-one Docker workspace for AI agents with browser, shell, file, code-execution, MCP, and VSCode interfaces, plus API-key/JWT controls and private-deployment guidance. — note: the public repository ships SDKs, integrations, and docs rather than the core runtime service; official Chromium-enabled deployments useseccomp=unconfined. Treat it as a trusted execution environment, not a hardened isolation boundary; use separate VMs or a hardened runtime plus network policy for hostile workloads. (★ 6,149 · updated 2026-09-14) - Agentgateway 🟢 — Agent-native proxy and gateway for MCP and A2A traffic with OAuth/JWT/API-key authentication, CEL-based RBAC policies, TLS, rate limiting, and OpenTelemetry observability. (★ 5,301 · updated 2026-10-13)
- Related: MCP Gateway · Pipelock
- Kubernetes Agent Sandbox 🟢 — Kubernetes CRDs and controllers for isolated, stateful singleton agent workloads, delegating low-level isolation to configured runtimes such as gVisor or Kata Containers. (Kubernetes SIG Apps) — note: sandbox orchestrator, not an isolation runtime itself; security depends on the selected RuntimeClass, network policy, and workload configuration. (★ 4,235 · updated 2026-10-12)
- Sources: Kubernetes announcement
- Related: AIO Sandbox
- Prismor 🟢 — Self-hosted runtime control plane for coding agents with pre-tool-call hooks, policy-driven observe/approve/block decisions, an MCP gateway, secret and egress controls, and tamper-evident audit evidence. (★ 416 · updated 2026-10-13)
- Related: Armorer Guard · AgentLock
- Gram 🟢🟠
⚠️ — Open-source stack behind Speakeasy's AI control plane that centrally manages MCPs, Skills, and Assistants with granular permissions, policy enforcement, threat detection, and observability. (Speakeasy) — note: AGPL-3.0 copyleft license; Gram is also available as Speakeasy's hosted commercial control plane, while local development uses a full Docker/Mise stack. (★ 273 · updated 2026-10-12) - tirith 🟢
⚠️ — Terminal guard for developers and AI coding agents that intercepts homograph and terminal-injection tricks, obfuscated execution chains, pipe-to-shell patterns, credential exfiltration, and malicious skill/config files. — note: AGPL-3.0 with a separate commercial license; shell interception is a host-side guard, not a substitute for sandboxing or least-privilege tool access. (★ 2,753 · updated 2026-10-13) - ADR 🟢🔬 — Agentic AI Detection and Response system combining cross-client agent telemetry, ADR-Bench security scenarios, and a dual-agent detector for suspicious intent, tool use, and execution traces. (Uber) — note: deployed at Uber and published with an MLSys 2026 paper; the open release includes the Sensor, benchmark, and Detector, but not ADR Prevention or the offline ADR Explorer. Default detector configurations require model-provider credentials. (★ 2,020 · updated 2026-10-12)
- xaidr 🟢 — In-process runtime security sensor for AI agents that inspects input, tool calls, output, and agent-to-agent envelopes inside the agent process, with structured shell-command classification, YAML policy, privilege tiers, an opt-in circuit breaker, and OpenTelemetry export. (Delphi Security) — note: early-stage in-process sensor, not an isolation boundary; monitor mode is the default and unexpected scan failures fail open while emitting degraded telemetry. Published detection and false-positive figures are project-reported on its committed corpus. (★ 29 · updated 2026-10-09)
- Related: agentguard · defenseclaw
- Agentmetry 🟢 — Local-first sensor for AI coding agents and MCP servers that records intercepted tool calls in a hash-chained JSONL trail with RFC 6962 Merkle roots, applies MITRE-mapped sequence detection, reports coverage gaps and supports optional pre-execution deny/approval decisions and SIEM export. — note: young project with limited independent adoption; tool policy and DLP default to log mode. Blocking requires block mode and a supported pre-execution hook; post-execution hooks and the separate stdio MCP proxy are observational. Hooks are cooperative, coverage is not universal, and hash-chain integrity does not establish attribution. Optional SIEM forwarding exports operational metadata; the project states that its Sentinel sink has not been tested against a live workspace. (★ 19 · updated 2026-10-31)
- Sources: Pre-execution policy handling · Observational MCP proxy
- Related: HOL Guard · ADR
- piighost 🟢 — Local runtime pseudonymization layer that replaces detected PII with stable placeholders before model calls and restores the original values in responses and selected tool arguments, with integrations for LangChain, Pydantic AI, LlamaIndex, and OpenAI-compatible clients. — note: reversible de-identification, not anonymization; the placeholder mapping remains sensitive, restored tool arguments can contain the original PII, and optional LLM-backed detectors may send content to the configured model provider. (★ 14 · updated 2026-10-08)
- HOL Guard 🟢🟠 — Local-first runtime security layer for coding agents that evaluates commands, package installs, skills, MCP configuration, and sensitive actions through policy, approval, evidence, and audit workflows. (Hashgraph Online) — note: integrations are cooperative hooks rather than a hard isolation boundary, and documented hook failures can fail open; synchronized evidence, team policy, and fleet workflows use the optional hosted service. (★ 868 · updated 2026-10-13)
- StackOne Defender 🟢 — Offline TypeScript runtime guard for indirect prompt injection in tool results, using bundled ONNX classifiers, deterministic checks, sanitization, and allow/block verdicts. (StackOne) — note: blocking high-risk results is opt-in by default; missing Tier-2 dependencies can fall back to simpler Tier-1 detection unless strict mode is enabled, so configure fail behavior explicitly for enforcement use. (★ 126 · updated 2026-10-10)
- Related: LLM Guard · little-canary
- Earl 🟢 — Capability proxy for AI agents that exposes approved operation names while keeping request templates and credentials outside the model, with HCL policy, audit, and egress controls. (Mathematic) — note: operation templates and policy configuration form part of the trusted boundary and require review; the proxy reduces credential and request-construction exposure but is not a sandbox for the agent process. (★ 113 · updated 2026-09-25)
- Related: onecli · agentgateway
- Bifrost 🟢🟠 — Apache-licensed AI and MCP gateway with multi-provider routing, virtual-key access controls, budgets, rate limits, MCP aggregation, OAuth, automatic fallbacks, and load balancing. (Maxim) — note: model-provider credentials and proxied request/response data are sensitive; restrict and authenticate the gateway and admin interface, use TLS, and load only trusted plugins. Content guardrails, RBAC/SSO, clustering, and other advanced governance controls require Bifrost Enterprise. (★ 8,737 · updated 2026-10-13)
- Related: Portkey AI Gateway · Agentgateway
- Portkey AI Gateway 🟢🟠 — Open AI gateway with provider routing, fallback and retry controls, guardrail integrations, observability, and MCP traffic support for model and agent applications. (Portkey) — note: the gateway is general infrastructure rather than a standalone security scanner; model-provider credentials are required, and some RBAC, analytics, and managed control-plane capabilities belong to Portkey's hosted or enterprise products. (★ 13,174 · updated 2026-05-25)
- Related: agentgateway · Pipelock
- Casbin AI Gateway 🟢 — Local gateway and policy layer for model-provider and MCP traffic, combining provider-key mediation, access control, prompt records, and configurable request handling. (Apache Casbin) — note: binds to localhost by default because its local UI can exercise administrative operations and the relay can access stored provider keys; do not expose it beyond a trusted host without adding authentication and reviewing prompt-recording settings. (★ 643 · updated 2026-10-11)
- Related: agentgateway · Portkey AI Gateway
- Adrian 🟢🟠 — Runtime monitoring and intervention layer that correlates agent actions with available reasoning traces through Python and TypeScript SDKs, a Claude Code integration, and managed or self-hosted deployments. (Secure Agentics) — note: the bundled self-hosted stack requires Docker, substantial disk space, and an NVIDIA GPU for the recommended local classifier; the README's
+35%and4xheadline extrapolates cited third-party research rather than an Adrian benchmark. (★ 581 · updated 2026-09-15)- Related: Agentic Radar · Armorer Guard
- Sandlock 🟢 — Unprivileged Linux process sandbox using Landlock, seccomp-BPF, and seccomp user notification to apply per-process filesystem, network, syscall, and execution policies without a container or VM. (Multikernel) — note: Linux-kernel process isolation rather than prompt-injection detection; protection depends on available Landlock and seccomp features and is not a multi-tenant VM boundary. (★ 566 · updated 2026-10-12)
- Related: Sandbox Probe · AIO Sandbox
- Lunar 🟢🟠 — API and MCP gateway combining outbound-traffic visibility, policy enforcement, rate limits, retries, circuit breakers, and centralized MCP server aggregation for agent workloads. (Lunar.dev) — note: the repository is active but its latest formal GitHub release is from 2024; the README positions the open core for non-production or personal use and directs production deployments to commercial platform tiers. (★ 504 · updated 2026-10-13)
- Related: agentgateway · Bifrost
- Norviq 🟢 — Kubernetes policy enforcement point for LLM agent tool calls that content-hash pins each tool definition at discovery and evaluates every tools/call against OPA/Rego policy before the upstream MCP server receives it. — note: ships in audit mode — the installed baseline records what it would have refused and lets the call proceed, and all shipped policy presets default to allow, so enforcement starts with the first rule an operator writes. The discovery-time description scanner is a documented heuristic and the project publishes the payloads that defeat it. Young project with limited independent adoption signal. (★ 25 · updated 2026-10-01)
- Related: Prismor · mcp-context-protector
- sofagent 🟢 — Commit-time audit and governance suite for AI coding agents that scans git diffs against deterministic rules, records local audit history, and exposes MCP tools for governance aggregation. — note: HMAC signing is optional, while local hooks, configuration, and key material remain accessible to same-user agents; the default setup is not fail-closed and Git hooks can be bypassed, so treat the history as local audit evidence rather than a hardened tamper-proof boundary. (★ 52 · updated 2026-10-13)
- Related: Pipelock
- Tenuo 🟢🟠 — Capability-based authorization for agent tool calls using signed, holder-bound warrants that constrain tools and arguments, verify locally, and narrow authority across delegation. — note: the Rust core, SDKs, and authorizer sidecar are Apache-2.0; the managed control plane is commercial. Enforcement requires trusted verification on every effecting tool path, outside agent control when bypass is possible; this is not a sandbox. The stateless core permits identical-call replay within its proof-of-possession window, so state-changing operations need application-level nonce or idempotency controls. (★ 103 · updated 2026-10-12)
- Related: Agentgateway · AgentLock
- Future AGI 🟢🟠 — Self-hostable evaluation and tracing platform with an OpenAI-compatible Go gateway for inline model-traffic checks, MCP/tool permissions and optional external guardrail services. (Future AGI) Caveat: the core is Apache-2.0; enterprise components have a separate commercial license. Gateway guardrails are disabled by default, and scanner timeout/panic handling defaults to fail-open. Setting
fail_open: falsedoes not fix every permissive path: the Future AGI adapter also passes missing credentials/evaluation IDs or empty evaluation results. Local injection/hallucination checks are heuristic, not factuality guarantees; external adapters send checked text to credentialed provider services. Self-hosting requires a multi-component database/application stack. Deployment telemetry defaults to account emails/domains for owners/admins/staff/superusers, instance metadata, aggregate usage and actor-journey events.FUTURE_AGI_TELEMETRY_DISABLED=truestill permits a minimal registration containing instance ID, version, deployment type, timestamp and the disabled flag; preventing that contact requires an egress restriction on the telemetry endpoint (defaultapi.futureagi.com), which can also affect optional vendor evaluations. (★ 2,185 · updated 2026-10-19)- Sources: Guardrail defaults · Adapter skip paths · Telemetry behavior
- Related: Portkey AI Gateway · Bifrost
- Tracekit 🟢 — Out-of-process signer and policy service for intercepted agent tool calls, with argument-bound allow/deny/human-approval decisions and signed hash-chained run records exportable for offline verification. (Cygnux Labs) Caveat: young project with limited independent adoption. Only calls routed through configured adapters, hooks or gateways are checked and recorded. Default dev mode shares an OS account with the agent; protect signer keys, code, policy and storage through an actual isolation boundary. Detecting truncation or re-signing requires independently trusted witnesses/anchors. Signed records do not prove that every action was captured or that a reported event occurred; command/tool-name rules are heuristic prevention, not a general prompt-injection defense. Published benchmark results are project-reported. The hosted Enterprise product is separate; the MIT signer remains available without it. (★ 352 · updated 2026-10-28)
- Sources: Security model and evaluation limits
- Related: node9 · Agentmetry
- AEGIS 🟢 — Windows-first desktop monitor for local AI-agent processes, configured file activity, TCP endpoints and audit records, with opt-in selected-action policies and MCP gateways. Caveat: Windows beta; macOS/Linux remain experimental. Default monitoring observes activity, not automatic blocking or agent containment; process actions are explicit, and policy/gateway controls cover only separately configured routes. Sensor gaps and incomplete attribution remain possible. Logs and exports can contain sensitive paths and endpoints. Optional Anthropic analysis sends activity metadata on request using the operator's API key; DNS lookups and update checks are separate network activity. (★ 160 · updated 2026-10-27)
Tools for securing model artifacts, serialized ML files, AI/ML supply-chain surfaces, and malicious-package detection datasets/benchmarks.
- MindArmour 🟢🔬 — MindSpore toolkit for adversarial robustness and model-privacy research, including gradient-based targeted and untargeted attacks. (MindSpore) Caveat: requires a compatible MindSpore, hardware, model, and dataset stack; package metadata points to Gitee for source and issue tracking. Model-specific evaluations are not robustness guarantees. (★ 92 · updated 2026-02-25)
- FedREDefense 🟢🔬 — ICML 2024 research implementation of federated-learning model-poisoning defense using reconstruction error of client updates. Caveat: an experimental training/evaluation pipeline, not a production federation security layer; GPU, datasets, and attack configuration affect results. Consult the published erratum for the FLTrust baseline rather than copying the original comparison figures. (★ 32 · updated 2026-09-16)
- Related: FLDetector poisoning-detection research (historical; no root license, legacy MXNet 1.9.1) · FL-WBC client-side poisoning defense (historical; no root license, legacy PyTorch 1.2) · NDSS21 model-poisoning research (historical; no root license, legacy datasets/frameworks) · ModelPoisoning FL research (historical; no root license, legacy TensorFlow 1.8)
- ModelAudit 🟢 — Model-artifact scanner with format-specific static parsers, a Rust-backed pickle-analysis companion, metadata checks, and JSON/SARIF reporting. (Promptfoo) Caveat: installed usage enables telemetry by default; disable with
PROMPTFOO_DISABLE_TELEMETRY=1orNO_ANALYTICS=1. Local scans need no hosted LLM, while remote sources need network access and sometimes credentials. Reports can retain raw secrets; optionalmetadata --trust-loaderscan deserialize artifacts. A clean static scan does not establish model safety. (★ 78 · updated 2026-10-10) - AI BOM 🟢 — Inventories models, agents, tools, MCP clients and servers, datasets, prompts, guardrails, secrets, and cloud AI resources, with CycloneDX 1.6 output and policy workflows. (Cisco AI Defense) — note: core inventory is distinct from the narrower model-file AIsbom already listed; the extended
analyzepipeline requires an external LLM provider and can send analysis context off-host. Optional sanitized Galileo telemetry is separately configurable. (★ 114 · updated 2026-10-01)- Sources: Cisco announcement
- Related: AIsbom
- Fraim 🟢 — Framework for AI-powered security workflows including LLM SAST and IaC analysis with SARIF/HTML output. (★ 159 · updated 2025-12-01)
- Related: sast-skills
- Adversarial Robustness Toolbox (ART) 🟢 — Flagship machine-learning security library for evaluating and defending models against evasion, poisoning, extraction, and inference attacks across major ML frameworks. (LF AI & Data / IBM) (★ 6,267 · updated 2026-10-08)
- Foolbox 🟢 — Classic Python toolbox for generating adversarial examples and benchmarking robustness of PyTorch, TensorFlow, and JAX models. (★ 2,982 · updated 2024-03-04)
- Related: Adversarial Robustness Toolbox
- modelscan 🟢 — Scans ML model files for unsafe serialization patterns and embedded code, with a focus on model serialization attacks. (Protect AI) (★ 783 · updated 2026-02-18)
- Related: Fickling · picklescan · ai-exploits
- Fickling 🟢 — Python pickle decompiler, rewriter, and static analyzer for inspecting and detecting malicious pickle/PyTorch payloads. (Trail of Bits) (★ 670 · updated 2026-10-01)
- Related: modelscan · picklescan
- picklescan 🟢 — Lightweight CLI/library for detecting suspicious Python pickle operations in ML and model artifacts. (★ 427 · updated 2026-09-01)
- AIsbom 🟢 — AI software bill of materials tooling for AI/ML supply-chain inventory and provenance metadata. (★ 81 · updated 2026-09-19)
- Related: modelscan · model-provenance-kit
- model-transparency (model-signing) 🟢 — Python library and CLI for signing and verifying ML model artifact manifests with Sigstore, signing keys, certificates, or PKCS#11-backed keys. (Sigstore) — note: verification requires a trusted signer identity and issuer, key, or certificate; signatures establish artifact integrity and signer authenticity, not freedom from backdoors or unsafe model behavior. (★ 249 · updated 2026-10-23)
- model-provenance-kit 🟢 — Toolkit for model-family provenance and fingerprinting across model weights, tokenizers, and architecture signals. (Cisco AI Defense) (★ 108 · updated 2026-09-18)
- Related: AIsbom
- pickle-fuzzer 🟢 — Structure-aware fuzzer for pickle scanners, useful for hardening tools such as modelscan, Fickling, and picklescan. (Cisco AI Defense) (★ 17 · updated 2026-08-03)
- Related: modelscan · Fickling · picklescan
- Medusa 🟢
⚠️ — AI-first security scanner for AI/ML repos, agents, and MCP surfaces; AGPL-3.0 licensed. (Pantheon Security) (★ 1,002 · updated 2026-06-24)- Related: agent-audit · modelscan
- PrivacyRaven 🟢🔬 — Privacy-testing library for deep-learning systems, covering model extraction and membership-inference style attacks. (Trail of Bits) — note: archived/hiatus project, but still a useful reference implementation. (★ 213 · updated 2025-09-05)
- Related: Adversarial Robustness Toolbox
- gym-malware 🟢🔬 — OpenAI Gym environment for reinforcement-learning agents that mutate PE malware to evade static ML malware detectors. (★ 637 · updated 2018-06-15)
- deep-pwning 🟢🔬 — Historical "Metasploit for machine learning" framework for experimenting with adversarial robustness of ML models. (★ 570 · updated 2022-05-17)
- open-malicious-code-benchmark 🟢🔬 — OMCBench benchmark suite for malicious-code/package detection: labeled Python and JavaScript package archives, common runners, and published precision/recall/F1 metrics. (False Positive Community) — note: evaluates an unreleased commercial ML detector (MOLOT / PT Application Inspector) alongside open-source baselines. (★ 18 · updated 2026-06-09)
- Related: GuardDog · OSSGadget · malicious-code-ruleset · bandit4mal
- malicious-software-packages-dataset 🟢🔬 — Human-vetted dataset of malicious software packages across npm, PyPI, IDE extensions, and AI Skills, useful for detector training and evaluation. (Datadog Security Labs) — note: contains real malware samples; Datadog notes selection bias because many samples were identified by GuardDog. (★ 384 · updated 2026-10-13)
- Related: GuardDog · pypi_malregistry
- GuardDog 🟢 — CLI for detecting malicious PyPI, npm, Go, RubyGems, GitHub Actions, and VSCode extension packages using Semgrep rules and package-metadata heuristics. (Datadog) (★ 1,232 · updated 2026-09-02)
- Related: malicious-software-packages-dataset · Packj
- package-analysis 🟢🔬 — Sandboxed static/dynamic analysis pipeline for open-source packages, capturing filesystem, process, and network behavior and publishing data for malicious-package research. (OpenSSF) (★ 919 · updated 2026-07-21)
- Related: malicious-packages · package-feeds
- malicious-code-ruleset 🟢 — Focused Semgrep ruleset for malicious-code patterns such as dynamic execution and obfuscation, used as an OMCBench baseline. (Apiiro) (★ 151 · updated 2025-02-24)
- Related: open-malicious-code-benchmark
- pypi_malregistry 🔬
⚠️ — ASE'23 / USENIX Security'26 malicious-PyPI dataset with more than 10k malicious package versions. — note: no LICENSE file found and the repository contains malware samples; handle in an isolated environment. (★ 136 · updated 2026-09-03)- Related: malicious-software-packages-dataset
- Activation-based Model Scanner (AMS) 🟢🔬 — PyPI scanner that uses safety-related activation fingerprints to detect degraded or removed safety training and compare an open-weight model with a known baseline. (Google Cloud Platform) — note: unofficial and unsupported Google research-derived project; GPU execution is recommended, calibration covers a limited set of model families, and the documented method can miss modifications that preserve measured safety directions. (★ 33 · updated 2026-10-07)
- Related: AASE research · model-provenance-kit
Autonomous and semi-autonomous AI agents for penetration testing, exploitation, and attack simulation.
- Cairn 🟢🔬
⚠️ — Fact-intent graph coordinator that schedules Claude Code, Codex, or Pi workers for penetration-testing and CTF exploration through a shared persistent blackboard. Caveat: workers can execute arbitrary tools; Docker mode exposes the host Docker socket and local mode has no OS sandbox. Configured providers receive target context; use a dedicated isolated host. Root license is AGPL-3.0; README describes personal/educational use and offers a separate commercial license for use without AGPL obligations. (★ 3,550 · updated 2026-09-07) - PentestGPT 🟢🔬 — The original USENIX'24 LLM pentest agent; re-released as an autonomous pipeline with strong benchmark results. (★ 15,926 · updated 2026-07-14)
- PentAGI 🟢 — Fully autonomous multi-agent pentest framework with Docker sandboxing. (VXControl) (★ 27,471 · updated 2026-10-09)
- CAI – Cybersecurity AI 🟢🟠🔬
⚠️ — Archived modular agent framework for model-assisted offensive and defensive security workflows, retained as a research reference. (Alias Robotics) Caveat: no further releases or security fixes are planned. The current archive combines MIT upstream components with Alias Robotics additions restricted to non-commercial research; professional or production use requires separate permission. Use only in isolated, authorized research environments. (★ 9,842 · updated 2026-08-22) - Strix 🟢 — Autonomous "AI hackers" that dynamically run code and validate vulnerabilities with PoCs (Apache-2.0). (★ 68,259 · updated 2026-10-12)
- hackingBuddyGPT 🟢🔬 — Minimal (~50 LOC) research framework for LLM-driven Linux priv-esc and web pentesting (FSE'23). (★ 1,268 · updated 2026-09-13)
- Nebula 🟢🟠 — AI pentesting CLI assistant with local-LLM support (Llama-3.1, Mistral, DeepSeek). (★ 1,126 · updated 2026-10-13)
- HexStrike-AI 🟢 — MCP server exposing 150+ security tools (nmap, gobuster, nuclei, …) to AI agents (MIT). (★ 12,733 · updated 2026-08-03)
- Deep Eye 🟢 — AI-assisted penetration-testing scanner that orchestrates multiple LLM providers for payload generation, 45+ vulnerability checks, CVE/RAG-assisted testing, AI triage, scan diffing, browser automation, proxying, and multi-format reports. — note: MIT-licensed; authorized use only. Heavy runtime surface: optional browser automation/proxying, plaintext API-key config, plugins with full OS access, and pickle model files called out in SECURITY.md. (★ 2,340 · updated 2026-10-06)
- Related: HexStrike-AI · pentest-ai
- Burp Suite MCP Server 🟢
⚠️ — Official Burp Suite extension exposing Burp to AI clients through MCP. (PortSwigger) — note: GPL-3.0 licensed. (★ 1,233 · updated 2026-08-12) - pentest-ai 🟢 — Offensive-security MCP server with 200+ wrapped tools, specialist agents, and OWASP-oriented probes for authorized testing. (★ 1,734 · updated 2026-10-07)
- Related: pentest-ai-agents
- Transilience Community Tools 🟢 — Claude Code skill and coordination-role bundle with supporting tools for authorized penetration testing, reconnaissance, source review, and AI threat testing. (Transilience AI) — note: agent-interpreted workflows, not a deterministic scanner or enforcement boundary; results depend on the configured coding agent/model, and published CTF results are maintainer-run after iterative benchmark tuning. The Docker helper uses host networking and
--dangerously-skip-permissions, whileenv-reader.pyprints requested secrets. Review and pin content, use disposable environments and scoped test credentials, and treat transcripts and context sent to model providers as sensitive. (★ 567 · updated 2026-07-29)- Sources: Container helper · Credential helper
- pentest-ai-agents 🟢 — Collection of Claude Code offensive-security subagents for authorized penetration-testing research. (★ 2,323 · updated 2026-08-16)
- Related: pentest-ai
- DarkMoon 🟢
⚠️ — Autonomous AI penetration-testing platform that orchestrates specialized web, AD, Kubernetes, CMS, and framework agents through an MCP-controlled Docker toolbox with local privacy-tokenization for sensitive target data. — note: GPL-3.0 licensed; heavy Docker/LLM stack, use only for authorized testing. (★ 1,021 · updated 2026-10-01)- Related: PentAGI · HexStrike-AI · pentest-ai
- T3MP3ST 🟢
⚠️ — Autonomous offensive-security meta-harness that wraps local or API-backed coding agents into a multi-agent recon-to-exploit workflow with MCP/API, War Room UI, tool arsenal, and committed benchmark artifacts. — note: very new AGPL-3.0 project with bold benchmark claims; use only for authorized testing and verify independently before operational use. (★ 6,500 · updated 2026-09-08)- Related: PentAGI · HexStrike-AI · pentest-ai
- Shannon 🟢🟠
⚠️ — White-box autonomous AI pentester with strong XBOW-benchmark results. Shannon Lite is AGPL-3.0; Shannon Pro is commercial. (★ 48,816 · updated 2026-10-08) - AIDA 🟢
⚠️ — Model-agnostic autonomous pentest agent running inside an isolated Docker environment; AGPL-3.0 licensed. (★ 494 · updated 2026-09-15) - HackSynth 🟢🔬
⚠️ — Planner/summarizer LLM-agent framework for autonomous penetration testing and benchmark evaluation; AGPL-3.0 licensed. (★ 322 · updated 2025-06-24) - VulnBot 🟢🔬 — Multi-agent collaborative penetration-testing framework with RAG support. (★ 198 · updated 2025-04-07)
- PentestAgent 🟢 — Black-box AI pentest framework with MCP, multi-agent spawning, and persistent sessions. (★ 3,173 · updated 2026-09-21)
- cyber-security-llm-agents 🟢
⚠️ — AutoGen-based agents for cybersecurity tasks (shown at RSAC 2024). (NVISO) (★ 397 · updated 2024-05-07) - Pentest-Swarm-AI 🟢 — Swarm-intelligence multi-agent pentest with stigmergic blackboard coordination (Go). (★ 2,884 · updated 2026-10-11)
- hackGPT 🟢
⚠️ — LLM offensive-security toolkit. (★ 1,215 · updated 2026-08-12) - ShiftGrid 🟢 — Prompt engine that turns Claude Code into a transparent, human-in-the-loop pentester, structuring engagements through checklists, observations, and notes exposed via an agent-facing API. — note: early-stage local Docker application with no built-in authentication; keep its API and UI ports bound to localhost. (★ 41 · updated 2026-10-07)
- BugTraceAI 🟢
⚠️ — Self-hosted autonomous web-application security scanner that combines reconnaissance, specialist exploit agents, Go fuzzers, and Playwright validation to produce evidence-backed findings. (BugTraceAI) — note: AGPL-3.0 licensed and beta; use only for authorized testing. Requires an LLM provider or local Ollama endpoint and a substantial Docker/Playwright/Go runtime. (★ 184 · updated 2026-10-13)- Related: Project overview · Web dashboard · Docker launcher
- HunterX 🟢 — AI-assisted offensive security engine that orchestrates reconnaissance, security-tool coordination, vulnerability detection and validation, evidence collection, and report-ready findings in one workflow. (NullC0d3) — note: early-stage and tool-orchestration-heavy; run only in an isolated, authorized assessment environment. (★ 13 · updated 2026-08-28)
- MCP Security Hub 🟢 — Collection of Dockerized MCP servers that expose offensive-security tools such as Nmap, Nuclei, SQLMap, Ghidra, Hashcat, and related assessment utilities to MCP-capable assistants. (FuzzingLabs) — note: orchestration and wrapper collection rather than a security boundary; its containers invoke offensive tools and must be used only in isolated, explicitly authorized environments. (★ 807 · updated 2026-04-08)
- Related: pentest-ai · Burp Suite MCP Server
- Forefy .context 🟢 — MIT-licensed collection of AI-agent Skills, Goals, and Dynamic Workflows for security auditing, authorized penetration testing, and research across web, cloud, blockchain, and defensive workflows. (Forefy) — note: agent-interpreted skill and workflow bundle rather than a deterministic scanner; includes active offensive procedures, so review and pin content before use and run it only in isolated, authorized assessments. The hosted AI Security Registry is a separate SaaS-backed catalog that publishes commit provenance and project-generated scan/audit metadata. (★ 153 · updated 2026-10-04)
- Related: AI Security Registry · Review methodology · OpenAPI schema
- RedAmon 🟢
⚠️ — Self-hosted AI pentest framework combining reconnaissance, a Neo4j attack-surface graph, Kali-based tooling, configurable human approvals, and agent-assisted remediation pull requests, with MCP client and server interfaces. — note: authorized testing only, on a dedicated isolated host. The heavy Docker stack includes seccomp-unconfined components and services with Docker-socket access; approval gates are configurable, not an unavoidable boundary. Cloud LLMs receive target context; local inference avoids that provider transfer but does not disable external reconnaissance or other configured services. Bundled tools retain separate licenses, including copyleft and WPScan restrictions. (★ 3,034 · updated 2026-10-08)
Hyper-specific AI/ML tools for a single offensive-security, recon, or detection step — the subwiz/eyeballer pattern rather than broad autonomous agents. 🅐 = self-contained trained model or learned model/pattern engine; 🅑 = LLM wrapper that calls an external API.
- subwiz 🟢 — 🅐 Lightweight nanoGPT model that predicts resolvable subdomains via beam search; model weights are published on Hugging Face. (Hadrian Security) (★ 390 · updated 2026-09-24)
- Related: HadrianSecurity/subwiz model
- regulator 🟢
⚠️ — 🅐 Learns and ranks regex-like naming patterns from known subdomains to generate likely new candidates. — note: no LICENSE file found; treat as source-available until clarified. (★ 394 · updated 2023-02-18)- Related: subwiz
- eyeballer 🟢
⚠️ — 🅐 Convolutional neural network that classifies pentest/recon screenshots (login pages, webapps, old-looking sites, parked domains, and custom 404s) for attack-surface triage. (Bishop Fox) — note: GPL-3.0 licensed. (★ 1,293 · updated 2024-02-19)
- GyoiThon 🟢🔬 — 🅐 Machine-learning-assisted web intelligence tool that fingerprints products, versions, CVEs, login pages, debug messages, and related web-server signals from HTTP responses. — note: historical research reference; Apache-2.0 licensed, but maintenance is low. (★ 830 · updated 2021-06-29)
- ffufai 🟢
⚠️ — 🅑 AI wrapper around the ffuf web fuzzer that suggests file extensions and paths from the target URL and headers using OpenAI or Anthropic models. (Joseph Thacker) — note: requires an LLM API key; README states MIT but no LICENSE file was found. (★ 810 · updated 2025-12-04)
- PassGPT 🔬
⚠️ — 🅐 GPT-style password model trained on leaked passwords for research on password generation and strength estimation. (Rando et al.) license: CC BY-NC-4.0 · access: open 10-char model; 16-char variant gated · artifacts: PyTorch/Safetensors. Research-only / non-commercial use; related code: javirandor/passgpt. - PassGAN 🔬 — 🅐 WGAN that learns password distributions from leaks to generate guesses; historical reference implementation of the PassGAN paper (MIT). — note: historical research reference; not an actively maintained password-auditing product. (★ 2,013 · updated 2018-09-30)
- neural_network_cracking 🔬 — 🅐 RNN password-guessing model from Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks (USENIX Security 2016); Apache-2.0 licensed. (CMU CUPS Lab) — note: historical USENIX research implementation, not a maintained password-auditing product. (★ 243 · updated 2018-11-30)
- phishing-url-detection 🟢 — 🅐 Packaged URL phishing classifier with ONNX and pickle artifacts. license: MIT · access: open · artifacts: ONNX, pickle. Model card recommends ONNX over pickle for safer inference.
- Phishing Email Detection DistilBERT v2.4.1 🟢 — DistilBERT text-classification model for email and URL phishing detection, trained on a public Hugging Face phishing-email dataset. license: Apache-2.0 · access: open · artifacts: Safetensors. — note: strong download signal, but independently verify the very high published metrics before production use.
- PhishIntention 🔬 — 🅐 Deep-vision phishing detector that infers both brand intention and credential-taking intention from webpage appearance and dynamics (USENIX Security 2022). — note: CC0-1.0 licensed. (★ 263 · updated 2026-06-04)
- VisualPhishNet 🔬
⚠️ — 🅐 Triplet CNN for zero-day phishing detection by visual similarity to trusted websites (ACM CCS 2020). (CISPA) — note: no LICENSE file found; dataset access is research-request based. (★ 30 · updated 2022-02-09)
- SYARA 🟢🔬 — 🅐 Semantic YARA-like rule engine for text and multimodal signals, adding embedding similarity, classifier-backed rules, LLM evaluators, and pHash matching to familiar YARA-style syntax. — note: early-stage engine; useful for LLM-era intent signals such as phishing, prompt injection, jailbreaks, hallucination, and disinformation rather than classic binary-only YARA matching. (★ 20 · updated 2026-10-12)
- AutoYara 🟢🔬 — 🅐 Research implementation of automatic YARA rule generation via biclustering over byte n-grams for malware-family samples. — note: Apache-2.0 research code from the ACM AISec 2020 paper; README explicitly says it comes with no warranty or support. (★ 78 · updated 2025-10-08)
- yaraml_rules 🟢🔬 — Research code that trains scikit-learn classifiers on malware and benign corpora, then compiles the learned model into deployable YARA rules. (Sophos) — note: historical research reference; the maintained value is the ML-to-YARA technique, not a current detection product. (★ 216 · updated 2020-12-18)
- RuleLLM 🟢🔬 — 🅑 LLM-assisted malware-rule generator that clusters malicious code samples and produces/refines/validates YARA and Semgrep rules. — note: MIT-licensed research prototype; requires OpenAI-compatible API access plus YARA/Semgrep validators. (★ 12 · updated 2025-04-25)
- open-appsec 🟢🟠
⚠️ — ML-based web application and API firewall combining an offline-trained model with environment-specific traffic learning and block/log decisions. Caveat: the bundled Apache-2.0 basic model is recommended for monitor/test use; the production-oriented advanced model is a separate portal download with its own terms. Review standalone versus SaaS management, telemetry/data flows, and deployment privileges such as host IPC; detection claims are not a security guarantee. (★ 1,721 · updated 2026-09-01) - DeepSQLi 🟢
⚠️ — 🅐 Deep-learning SQL-injection detector with dataset, trained models, and a Flask Prediction API for GatewayD IDS/IPS integration. (GatewayD) — note: AGPL-3.0 licensed; defensive detector rather than offensive generator. (★ 7 · updated 2026-02-21) - deepsecrets 🟢 — Semantic secrets scanner using lexing/parsing, entropy checks, and hashed-known-secret matching across 500+ languages. — note: useful narrow detector, but not a trained ML model. (★ 185 · updated 2026-09-28)
- VLAI Vulnerability Severity Classifier 🟢🔬 — RoBERTa-based vulnerability-severity classifier trained on CIRCL vulnerability scores to assist triage before manual CVSS scoring. (CIRCL) license: CC-BY-4.0 · access: open · artifacts: Safetensors.
Static analysis and secure code review enhanced with LLMs.
- Symfony Security Auditor 🟢 — Symfony-aware source-audit package with attacker/reviewer model passes, confidence filtering, baseline deduplication, and budget-bounded partial results. Caveat: reviewer-validated findings are model judgments, not confirmed exploitation. Offline-only mode defaults to false, so hosted providers receive selected source; local inference needs separately provisioned models. Requires PHP 8.3+ and a compatible Symfony version. (★ 97 · updated 2026-10-04)
- Clearwing 🟢 — Agent-driven source-security research pipeline that ranks files, coordinates vulnerability hunting and validation, optionally generates patches, and exports SARIF, JSON, and Markdown findings. Caveat: can compile untrusted targets and execute generated proofs or exploits; use isolated authorized environments and explicit spending limits. Hosted models receive source context; local providers are supported. Optional OTLP/Phoenix tracing can export run metadata. Findings need independent verification, and released packages can lag main. (★ 1,075 · updated 2026-10-02)
- Cloudflare Security Audit Skill 🟢 — Coding-agent skill for a multi-phase source-security audit with reconnaissance, coverage-led hunting, independent verification, structured findings, and a separate record-validation pass. (Cloudflare) — note: workflow skill, not a standalone scanner; it requires a capable coding agent with parallel subagents and an OS-enforced sandbox. Results are nondeterministic, and Cloudflare reports that one run finds only about half of the vulnerabilities found across repeated runs. (★ 28,989 · updated 2026-09-14)
- Mantis 🟢🔬 — Security-review skills and an ADK reference harness for vulnerability discovery, triage, reproduction, patching, and deterministic verification gates. (Google) — note: can generate and execute code while reproducing findings; use only on authorized source in an isolated restricted environment. Model output and proposed findings still require expert verification. (★ 2,424 · updated 2026-10-06)
- Sources: Google Cloud announcement
- VulnHunter (Capital One) 🟢 — Attacker-oriented source-review workflow with forward analysis from exposed entry points, a finding-falsification pass, evidence-backed remediation, and a separate fix-verification flow. (Capital One) — note: built and optimized for Claude Code with an Opus-class model, so source context is processed under the selected provider's terms and results remain model-dependent. Use only on code you are authorized to assess. (★ 1,097 · updated 2026-10-07)
- Sources: Capital One announcement
- Vulnhuntr 🟢 — Zero-shot vulnerability discovery in Python repos via LLM call-chain analysis; credited with a 0-day RCE in Ragflow. (Protect AI) (★ 2,800 · updated 2025-02-06)
- Related: IRIS
- deepsec 🟢 — Agent-powered security harness for scanning large codebases with coding agents, resumable parallel runs, custom matchers, and optional revalidation. (Vercel Labs) (★ 8,134 · updated 2026-09-29)
- Related: claude-code-security-review · sast-skills
- Codex Security 🟠 — CLI and TypeScript SDK that use Codex Security to find, validate, and help fix vulnerabilities in a codebase, with scan comparison and containerized bulk-scan support. (OpenAI) — note: the CLI/SDK are open source, but scans require Codex Security access and, for best results, OpenAI Trusted Access. (★ 11,079 · updated 2026-10-13)
- Related: deepsec · defending-code-reference-harness
- open·kritt 🟢
⚠️ — Self-hosted platform that orchestrates Codex or Claude Code across focused vulnerability-research workflows, then validates, de-duplicates, ranks, and reports resulting findings. (Kritt AI) — note: jobs run as root in disposable Docker containers with writable target copies and direct internet access; the stack has no application auth by default and sends scanned code to the configured model provider. Deploy only on a dedicated, access-controlled host and scan authorized targets. (★ 2,280 · updated 2026-09-15)- Related: deepsec · Visa Vulnerability Agentic Harness
- Visa Vulnerability Agentic Harness 🟢 — Agentic SAST pipeline for autonomous vulnerability discovery, exploitability verification, SARIF/Markdown reporting, remediation, and validation using frontier AI models. (Visa) — note: Apache-2.0; authorized use only. The default
scanprofile can continue into remediation and edit target source files; use--stop-after s9for detection-only runs. (★ 2,907 · updated 2026-10-09)- Related: deepsec · defending-code-reference-harness
- defending-code-reference-harness 🟢 — Reference Claude Code skills and autonomous vulnerability-discovery pipeline for threat modeling, static scanning, triage, execution-verified C/C++ memory-bug discovery, reporting, and patch generation. (Anthropic) — note: official reference implementation, not maintained as a product; the autonomous pipeline executes target code and should be run only inside the documented gVisor sandbox. (★ 7,570 · updated 2026-08-06)
- Related: deepsec · claude-code-security-review
- rust-in-peace 🟢 — Rust-security fork of Anthropic's defending-code reference harness, adding a Rust profile for agentic review of unsafe/FFI memory bugs, panic-DoS, deserialization-trust issues, and Miri/ASan/panic/hang-verified findings. (Sergey Gordeychik) — note: very new Apache-2.0 fork; autonomous runs execute target code and should use the documented sandbox. (★ 23 · updated 2026-10-12)
- Related: defending-code-reference-harness · deepsec
- Reproof 🟢 — Multi-language Kimi Code port of rust-in-peace, orchestrating agentic vulnerability discovery, PoC replay in fresh containers, comparison with known bugs, and patch re-testing. (Sergey Gordeychik) Caveat: newly published, maintainer-authored project; benchmark results are project-reported, not independently reproduced here. The autonomous pipeline executes target code and generated PoCs; use the documented Linux/Docker/gVisor setup on authorized targets. The configured model provider receives source and execution context and may incur costs; review generated patches and sensitive findings before use or disclosure. (★ 2 · updated 2026-10-12)
- Related: rust-in-peace · defending-code-reference-harness
- claude-code-security-review 🟠 — Official Claude-based semantic SAST GitHub Action that reviews PR diffs. (Anthropic) (★ 6,361 · updated 2026-02-11)
- IRIS 🟢🔬 — Neurosymbolic SAST combining LLMs with CodeQL for Java vulnerability detection (MIT). (★ 440 · updated 2026-07-02)
- sast-skills 🟢 — Agent skills that turn AI coding assistants into a multi-agent SAST scanner. (★ 1,335 · updated 2026-04-08)
- llm-sast-scanner 🟢 — SAST skill for AI coding agents with structured source-to-sink analysis across 34 vulnerability classes. License: MIT stated in README. (★ 289 · updated 2026-08-22)
- Related: sast-skills
- sast-ai-workflow 🟢 — LangGraph workflow for reviewing static-analysis findings, reducing false positives, and producing vulnerability review output. (Red Hat Ecosystem AppEng) (★ 22 · updated 2026-06-29)
- Related: seclab-taskflow-agent · Fraim
- llm-security-scanner 🟢
⚠️ — LLM-powered code scanner that opens GitHub issues for findings. (★ 25 · updated 2025-04-02) - Trail of Bits Skills 🟢
⚠️ — Claude Code- and Codex-compatible security workflow skills for code review, differential review, false-positive analysis, supply-chain checks, GitHub Actions auditing, Semgrep rule generation, and vulnerability research. (Trail of Bits) — note: reusable agent workflow instructions rather than a standalone deterministic scanner; share-alike terms apply to adapted material. (★ 7,502 · updated 2026-10-09) - OpenHack 🟢 — File-based source-guided white-box security-review workspace that orchestrates agents through reconnaissance, vulnerability hunting, validation, evidence capture, and reporting. (Hadrian Security) — note: requires an external coding harness/model and can consume substantial model tokens; OpenHack provides workflow state and review artifacts, not sandboxing or an execution-security boundary. Use only on authorized targets. (★ 743 · updated 2026-06-01)
- Related: deepsec · rust-in-peace
- Buttercup 🟢🔬
⚠️ — Multi-component cyber reasoning system for finding, validating, and patching software vulnerabilities with coordinated agent workflows. (Trail of Bits) — note: AGPL-3.0 research/competition system rather than a lightweight scanner; deployment uses multiple services, Docker, and configured model providers. (★ 1,720 · updated 2026-09-28)- Related: OpenHack · Visa Vulnerability Agentic Harness
Architecture-level threat model generation and design-phase risk analysis driven by LLM reasoning.
- ThreatForest 🟢🔬 — Strands-based threat-modeling pipeline that analyzes repositories, generates attack trees and mitigations, and maps attack steps to ATT&CK and other TTP frameworks through an embedding service. (AWS Samples) Caveat: sends project context to configured model providers and requires separately licensed embedding weights; optional Langfuse export defaults off. Keep its unauthenticated API on loopback. Generated paths and embedding-based TTP mappings require expert review, not automatic acceptance as demonstrated attack paths. (★ 80 · updated 2026-08-01)
- tachi 🟢 — Threat modeling and AI-reasoning vulnerability detection harness for Claude Code that dispatches 14 specialized threat agents (6 STRIDE, 5 LLM, 3 agentic) against an architecture description in Mermaid, C4, PlantUML, ASCII, or free text, producing SARIF 2.1.0 for code scanning, MAESTRO seven-layer classification, attack trees, CVSS-aligned composite risk scores, compensating-controls analysis of the target codebase, and a PDF report. (David Matousek) — note: runs inside Claude Code; architecture descriptions are processed by the configured Claude model. (★ 94 · updated 2026-10-12)
- Related: STRIDE GPT · defending-code-reference-harness
- Clarity 🟢 — Design-time companion to RAMPART with desktop, web, CLI, and embedded workflows for structured requirements, threat analysis, and failure-mode reasoning about agentic systems. (Microsoft) — note: model-assisted design workflow, not a vulnerability scanner or runtime control; hosted-provider modes require credentials or provider login and send project context to the configured model. (★ 275 · updated 2026-09-17)
- Sources: Microsoft Security announcement
- Related: RAMPART · STRIDE GPT
- STRIDE GPT 🟢 — LLM-powered threat modeling tool that generates STRIDE threat models, attack trees, data flow diagrams, DREAD risk scores, mitigations, and Gherkin test cases from application descriptions, architecture diagrams, or codebases (agentic analysis mode), with OWASP LLM Top 10 and Agentic (ASI) coverage, MITRE ATT&CK/ATLAS mapping, Markdown/JSON/SARIF/HTML output, and broad LLM provider support via LiteLLM including local hosting. (Matthew Adams) (★ 1,141 · updated 2026-10-05)
- Related: tachi
Two families: (a) LLMs generating harnesses/targets for traditional fuzzing, and (b) fuzzing the LLM itself.
- seclab-taskflows-fuzzing 🟢 — Taskflow package for LLM-assisted C/C++ fuzz-harness generation and repair, AFL++ campaigns, coverage feedback, and crash triage. (GitHub Security Lab) Caveat: requires a configured model provider and a Linux build/fuzzing toolchain; provider-backed analysis can disclose source code. Host-shell and file-write tools are not a sandbox, and setup can install system tools. Use a disposable isolated environment for authorized targets. (★ 24 · updated 2026-09-21)
- Related: seclab-taskflow-agent
- Ultrafuzz 🟢 — Agentic smart-contract fuzzing orchestrator that generates tests, coordinates analysis campaigns, and collects findings and reports. (Monad Foundation) Caveat: agents deliberately bypass permission and sandbox approvals and can access host files and the network. Run only on an ephemeral isolated VM without unrelated credentials; review a published release rather than the default unstable branch. Model/provider configuration determines cost and data disclosure; the harness is not an isolation boundary. (★ 99 · updated 2026-10-06)
- PromeFuzz 🟢🔬 — Research framework for C/C++ fuzz-harness generation using code metadata, documentation, API relationships, iterative compilation repair, and crash analysis (CCS 2025). Caveat: requires target build metadata, a native LLVM/Clang toolchain, and configured generation/embedding models. Hosted providers receive source and documentation context; generated harnesses and target code execute during campaigns. Use isolated authorized environments and do not generalize the paper's coverage or bug-finding results to arbitrary targets. (★ 62 · updated 2026-07-30)
- oss-fuzz-gen 🟢 — LLM-driven fuzz-harness generation for OSS-Fuzz; reported 26 real vulnerabilities (incl. CVE-2024-9143 in OpenSSL). (Google) (★ 1,443 · updated 2026-03-02)
- PromptFuzz 🟢🔬
⚠️ — LLM-mutated prompts to generate fuzz drivers for C/C++ libraries (Rust). (★ 347 · updated 2026-05-15) - Fuzz4All 🟢🔬 — "Universal" LLM-based fuzzer across compilers/languages (ICSE 2024). (★ 338 · updated 2025-08-11)
- ChatAFL 🟢🔬 — LLM-guided protocol fuzzing extending AFLNet (NDSS'24). (★ 400 · updated 2025-06-20)
- TitanFuzz 🟢🔬
⚠️ — First LLM-based fuzzer for PyTorch/TensorFlow (ISSTA'23). (★ 95 · updated 2023-09-10)
- LLMFuzzer 🟢🔬 — First open-source fuzzing framework for LLM API integrations. — note: historical research reference; maintenance appears low compared with current LLM security scanners. (★ 383 · updated 2024-02-12)
- ps-fuzz 🟠 — System-prompt hardening fuzzer; 16 attacks × 16 providers. (Prompt Security) (★ 717 · updated 2026-08-19)
- FuzzyAI 🟠 — Automated LLM fuzzer for jailbreaks/prompt injection. (CyberArk) (★ 1,586 · updated 2026-02-06)
- spikee 🟢 — Prompt-injection evaluation and exploitation kit with dataset generation, Burp integration, and pluggable judges. (ReversecLabs / WithSecure) (★ 266 · updated 2026-09-11)
- Related: promptmap
- promptmap 🟢
⚠️ — Prompt-injection scanner for custom LLM applications in white-box and black-box modes; GPL-3.0 licensed. (★ 1,280 · updated 2025-12-01)- Related: spikee
- ai-prompt-fuzzer 🟢 — Burp Suite extension fuzzing GenAI/LLM prompts. (PortSwigger) (★ 37 · updated 2025-09-04)
AI/LLM tooling for CTI gathering, IOC/TTP extraction, and analysis.
- ZettelForge 🟢 — CTI investigation memory with entity and IOC extraction, graph and vector retrieval, local storage, and an MCP interface. Caveat: core storage and retrieval are local, but embedding models require an initial download and optional remote LLM providers receive analysis content. Rich extraction and synthesis depend on the configured model; synthesis without an LLM is a placeholder, not a completed analysis. Generated links and attribution need analyst validation. (★ 65 · updated 2026-07-10)
- VoidAccess 🟢 — OSINT and CTI pipeline combining source collection, IOC/entity extraction, enrichment, relationship analysis, and intelligence exports. Caveat: collection contacts external and potentially hostile sources; Tor is not an anonymity guarantee. Cloud model adapters disclose submitted content, while local models are configurable. Neural embeddings are optional and the SHA-256 fallback is not semantic ML; generated attribution and detection rules require analyst review. (★ 790 · updated 2026-10-12)
- cti-skills 🟢 — CTI workflow skills and integration clients for source assessment, IOC investigation, ATT&CK mapping, detection-rule drafting, and MISP/OpenCTI workflows. (Liberty91) Caveat: skills guide a host agent rather than provide an independent detection engine. Live integrations need provider credentials and can disclose intelligence; some clients can create, modify, or delete records. Confirmation instructions are not enforced authorization, so scope credentials and review writes separately. (★ 27 · updated 2026-09-30)
- trs 🟢 — LLM + ChromaDB tool to summarize threat reports and extract MITRE TTPs and IOCs. (★ 11 · updated 2023-11-15)
- TI-Mindmap-GPT 🟢 — Streamlit app: AI summaries, mindmaps, IOC/TTP extraction, and ATT&CK Navigator layers. (★ 112 · updated 2026-02-16)
- aiocrioc 🟢 — LLM + OCR IOC extraction (pulls IOCs from images/PDFs). (★ 38 · updated 2024-12-04)
- ThreatIngestor 🟢 — Extracts/aggregates IOCs from feeds; integrates with MISP/ThreatKB (pairs well with LLM post-processing). (★ 931 · updated 2026-05-26)
- IATelligence 🟢 — Explains imported Windows APIs in PE files via GPT and maps to MITRE ATT&CK. (★ 386 · updated 2022-12-09)
- Related: MCP_Security
- MCP_Security 🟢
⚠️ — MCP server (ORKL) for querying the ORKL threat-intel API. (★ 52 · updated 2025-01-22)- Related: IATelligence
- threat-intelligence-cti-analysis 🟢 — NLP/LLM pipeline for IOC extraction, MITRE ATT&CK mapping, and knowledge-graph generation from unstructured CTI. (★ 4 · updated 2025-11-03)
- Related: soctalk
- CTINexus 🟢🔬 — LLM-assisted framework for data-efficient extraction of cyber-threat intelligence and construction of structured cybersecurity knowledge graphs from unstructured reports. — note: ships tests, releases, Docker configuration, and a Python package; extraction workflows require a configured supported LLM provider. (★ 89 · updated 2026-02-25)
- Related: threat-intelligence-cti-analysis · CTIBench
- CTIBench 🔬
⚠️ — NeurIPS 2024 Spotlight benchmark with 4,610 examples across CTI knowledge, CWE root-cause mapping, CVSS prediction, ATT&CK technique extraction, and threat-actor attribution. — note: non-commercial research benchmark; the repository publishes data, evaluation notebooks, model outputs, and raw logs rather than a production CTI service. (★ 94 · updated 2026-05-07) - CTI-BERT 🟢🔬 — BERT model pretrained from scratch on a large cybersecurity text corpus for downstream CTI extraction, classification, and question-answering tasks. (IBM Research) license: Apache-2.0 · access: open · artifacts: PyTorch.
AI agents for SOC alert triage, investigation, and incident response.
- AI-SOC-Agent 🟢 — Black Hat 2025 MCP server exposing security-investigation tools (ELK, IRIS). (★ 51 · updated 2026-09-30)
- soctalk 🟢 — LangGraph SOC automation agent with MCP integrations for Wazuh, Cortex, TheHive, and MISP plus mock-agent test lab. (★ 89 · updated 2026-08-12)
- Related: SigmaOptimizer
- Vigil SOC 🟢 — Open-source AI SOC with readable Python agents, Markdown playbooks, and MCP integrations for triage, investigation, hunting, response, reporting, and forensics. (Vigil SOC) (★ 365 · updated 2026-10-12)
- Related: soctalk
- agentic-soc-platform 🟢 — Agentic SOC platform (LangGraph/Dify) with local-LLM support. (★ 1,205 · updated 2026-09-29)
- SigmAIQ 🟢
⚠️ — pySigma wrapper and LangChain toolkit for automatic Sigma rule creation and translation; LGPL-2.1 licensed. (AttackIQ) (★ 98 · updated 2025-11-03)- Related: SigmaOptimizer
- RulePilot 🟢🔬 — LLM-powered security-rule generation agent for Splunk, Microsoft Sentinel, and Elastic, with field detection from log samples, multi-stage refinement, and cross-platform rule conversion. — note: MIT-licensed ICSE 2026 research prototype; requires an OpenAI API key. (★ 15 · updated 2025-10-20)
- Related: SigmAIQ · SigmaOptimizer
- SOCGPT 🟢 — LLM log summarization, severity triage, MITRE mapping, and Q&A. (★ 7 · updated 2025-06-11)
- AttackGen 🟢 — LLM-driven incident-response scenario generator using MITRE ATT&CK + ATLAS. (★ 1,254 · updated 2026-10-09)
- Google Security Operations and Threat Intelligence MCP Server 🟢 — MCP servers and packages that let MCP clients access Google Security Operations, SOAR, Google Threat Intelligence, and Security Command Center for investigation, hunting, and security automation workflows. (Google Cloud) — note: integration layer rather than an MCP-defense tool; requires Google credentials and access to the connected security products/services. (★ 532 · updated 2026-10-06)
- Related: MCP_Security · Vigil SOC
- ExCyTIn-Bench (SecRL) 🟢🔬 — ICML 2026 benchmark for evaluating LLM agents on cyber-threat investigation and threat hunting through security question-answering over eight anonymized incident databases. (Microsoft) — note: evaluation requires model-provider credentials, Dockerized MySQL incident databases, and roughly 10 GB for the standard eight-container setup (up to 33 GB for the combined database). (★ 159 · updated 2026-08-27)
- Related: CTIBench · Google Security Operations MCP
LLM-assisted binary analysis and traffic inspection.
- IDAssist 🟢 — Native IDA Pro plugin for LLM-assisted function explanation, symbol renaming, binary knowledge graphs, document retrieval, and tool-driven analysis through local or hosted model providers. Caveat: requires separately licensed IDA Pro; hosted models receive analysis context, optional SymGraph sharing exports symbols and graph data, and MCP tools can modify the IDB or start local processes. Findings require analyst verification. (★ 872 · updated 2026-09-20)
- DeepZero 🟢🔬 — Resumable Windows driver research framework combining Ghidra decompilation, static analysis, and optional LLM assessment through YAML pipelines. — note: the Windows-driver workflow requires an operator-provided Ghidra installation and optional LLM-provider credentials; analyze only drivers you are authorized to research. (★ 739 · updated 2026-09-10)
- Gepetto 🟢 — IDA Pro plugin: GPT adds comments and meaningful variable names. (★ 3,482 · updated 2026-08-15)
- ida-pro-mcp 🟢 — MCP bridge for IDA Pro exposing decompile, disassemble, xref, rename, and debugging workflows to LLM clients. (★ 12,722 · updated 2026-09-26)
- GhidraMCP 🟢 — MCP server exposing Ghidra reverse-engineering ops to any MCP-capable LLM. (★ 11,156 · updated 2026-10-10)
- Related: GhidrOllama · OGhidra
- ReVa 🟢 — Ghidra-focused reverse-engineering assistant with MCP support, Claude Skills integration, and long-form analysis workflows. (★ 871 · updated 2026-10-13)
- Related: GhidraMCP · GhidrAssistMCP
- GhidrAssistMCP 🟢 — Native Ghidra MCP extension with broad tool coverage, headless support, and security-sensitive tool gating. (★ 770 · updated 2026-10-09)
- Related: ReVa · ghidra-mcp
- ghidra-mcp 🟢 — Ghidra MCP server with large tool coverage, GUI plugin, headless server, and lazy tool loading. (★ 5,542 · updated 2026-10-08)
- Related: GhidrAssistMCP
- GhidrOllama 🟢
⚠️ — Ghidra script using the Ollama API for function analysis/renaming. (★ 154 · updated 2024-11-29) - GhidraGPT 🟢 — Ghidra plugin that integrates LLMs for automated code refactoring and analysis. (★ 825 · updated 2026-07-22)
- LLM4Decompile 🟢🔬
⚠️ — Research project for binary-to-C decompilation with LLMs; code is MIT, but model weights use a more restrictive license. (★ 7,127 · updated 2026-02-12) - x64dbg_mcp 🟢 — MCP server exposing x64dbg debugging and reverse-engineering operations to AI clients. (★ 131 · updated 2026-06-08)
- binaryninja-mcp 🟢 — MCP server for Binary Ninja-assisted reverse engineering. (★ 50 · updated 2025-05-13)
- OGhidra 🟢 — Natural-language Ghidra analysis via Ollama. (Lawrence Livermore National Lab) (★ 454 · updated 2026-09-16)
- Related: GhidrOllama · GhidraMCP
- ghidra_tools (G-3PO) 🟢 — Ghidra plugin for AI-assisted decompiled-code analysis. (Tenable) (★ 314 · updated 2023-05-10)
- gpt-wpre 🔬 — Whole-program reverse engineering with GPT-3. (★ 410 · updated 2022-12-31)
- burpgpt 🟢 — Burp Suite extension integrating GPT for passive scanning. (★ 2,398 · updated 2024-06-09)
- Related: Burp-extension-for-GPT
- Burp-extension-for-GPT 🟢 — Burp extension to analyze HTTP traffic with GPT. (Tenable) (★ 115 · updated 2023-05-01)
- Related: burpgpt
- REA 🟢 — Local CLI and MCP toolkit for agent-assisted reverse engineering of native binaries, JavaScript/Electron and .NET applications, Android artifacts, firmware, and browser/process behavior, integrating analysis providers including Hopper, Ghidra, and IDA. — note: provider and host requirements vary; native engines, including commercial Hopper/IDA, are separate dependencies. Setup can modify agent MCP registrations and workflow skills after approval. REA is not a sandbox: dynamic capture can execute targets with the current user's permissions and inherited environment. Use isolated, authorized analysis environments. Tool analysis is local, but results enter the host agent's context and may reach its model provider; agent conclusions depend on that model. (★ 176,042 · updated 2026-10-13)
- Open-ReverseLab 🟢
⚠️ — Agent-native reverse-engineering workspace and MCP server combining Ghidra headless analysis with Frida, x64dbg, Rizin, YARA, and a runnable CTF/APK/PE knowledge base. — note: the repository additionally asserts a mandatory disclaimer with use, redistribution, derivative-work, and indemnification terms beyond GPL-3.0. Optional installers download and execute numerous third-party offensive tools, sometimes from latest or moving upstream refs without checksums; review them before use and run only in an isolated, authorized lab. (★ 1,255 · updated 2026-09-29)
Tools for attacking and defending LLM applications themselves.
- DrAttack 🟢🔬 — Research jailbreak implementation that decomposes requests, searches prompt substitutions, and evaluates target-model responses. Caveat: historical defaults use the old OpenAI ChatCompletion API and gpt-3.5-turbo-0613, requiring compatible dependencies or adaptation. Refusal-prefix and model-judge heuristics do not prove attack success; configured generation and embedding APIs receive research inputs. (★ 69 · updated 2026-09-12)
- RL-Hammer (rl-injector) 🔬
⚠️ — Research training pipeline for prompt-injection attacker models, with InjecAgent tool-response substitution and target-based reward computation. (Meta) Caveat: noncommercial code; GPU resources, models, and data are separate dependencies. Hosted targets receive attack contexts, and the reviewed tokenizer path enables trust_remote_code, so model repositories require separate review. Published outcomes are not independently reproduced here. (★ 57 · updated 2025-11-24) - Prompt Injection as Role Confusion 🟢🔬
⚠️ — Research code for probing role representations and studying prompt injection through confusion between instruction and data roles. Caveat: the root license contains the MIT permission text without a copyright header. Experiments require compatible model weights and GPU resources; some configurations are marked untested, and API-backed paths disclose inputs to providers. This is not a production guardrail. (★ 134 · updated 2026-05-31) - GuidedBench 🟢🔬 — Guideline-grounded jailbreak evaluator that scores saved model responses against case-specific criteria using configurable judge backends. Caveat: the bundled dataset integration is gated and needs approval/HF_TOKEN; dataset and model terms are separate from the code license. Judge models can disagree or fail, and hosted backends receive evaluated content; this is an evaluator, not an attack generator or ground-truth oracle. (★ 33 · updated 2026-08-31)
- OpenART 🟢🔬
⚠️ — Research benchmark and Docker-based runtime for red-teaming tool-using agents through adversarial changes to stateful, long-running task environments. Caveat: bundled runnable tasks are a subset of the paper's broader evaluation, not the entire headline corpus. Model-backed attackers, targets, and judges require configured providers and can disclose evaluation content. Executable evaluators, container mounts, and network access require disposable authorized environments; this is not a production guardrail or independently verified containment layer. (★ 237 · updated 2026-10-03) - ZeroLeaks 🟠
⚠️ — Source-available TypeScript library and CLI for model-based system-prompt extraction and injection testing with adaptive attacks and configurable providers. Caveat: FSL restricts competing commercial use before the future Apache conversion. The public package tests a model plus system prompt, not a deployed application's actual tools, memory, or side effects; hosted deployed-agent testing is separate and paid. Hosted providers receive prompt material and require credentials, while local compatible endpoints are supported. Model-graded results are not proof of exploitation. (★ 733 · updated 2026-09-26) - RAMPART 🟢 — Pytest-native framework for repeatable adversarial and benign safety regression tests against AI agents, with statistical trials and evaluators for responses, tool calls, and external side effects. (Microsoft) — note: test framework built on PyRIT, not a runtime protection layer; users must supply target adapters and model credentials, and passing its scenarios does not establish production safety beyond the tested behaviors. (★ 420 · updated 2026-10-09)
- Sources: Microsoft Security announcement
- Related: PyRIT
- Agent OPFOR 🟢 — Adversary-emulation toolkit for AI agents, LLM applications, and MCP servers with multi-turn attack templates, tool and memory tests, trace-aware evaluation, CLI, SDK, browser, MCP, and skill interfaces. (KeyValue Software Systems) — note: attacker and judge workflows depend on configured LLM providers and add inference cost; trace integrations can expose internal agent data to the selected observability service. Use only against systems you own or are authorized to test. (★ 582 · updated 2026-08-13)
- NuGuard 🟢 — Generates an AI-SBOM, statically analyzes agentic applications, red-teams live targets for prompt injection/tool misuse/data exfiltration, and validates behavioral policy compliance with SARIF, JSON, and Markdown reports. (NuGuard AI) — note: beta project; live red-team scans actively probe the target and require authorization. LLM-assisted features need provider credentials, and the optional NuGuard.ai hosted offering adds commercial features. (★ 61 · updated 2026-10-09)
- garak 🟢 — The LLM vulnerability scanner — probes for prompt injection, jailbreaks, data leakage, and more. (NVIDIA) (★ 9,548 · updated 2026-10-10)
- PyRIT 🟢 — Python Risk Identification Tool; battle-tested across 100+ GenAI red-team operations. (Microsoft) (★ 4,607 · updated 2026-10-13)
- promptfoo 🟢 — LLM eval + red-teaming/pentesting CLI with 50+ attack plugins (MIT). Note: OpenAI announced an acquisition agreement in March 2026; remains MIT-licensed — track governance. (★ 25,956 · updated 2026-10-13)
- Augustus 🟢 — Single-binary LLM security testing framework for prompt injection, jailbreaks, and adversarial attacks across many providers. (Praetorian) (★ 304 · updated 2026-10-03)
- agentic_security 🟢 — Agentic LLM vulnerability scanner and AI red-team kit for jailbreaks, prompt injection, fuzzing, and API stress testing. (★ 2,019 · updated 2026-09-22)
- HackAgent 🟢 — Python SDK and CLI for red-teaming AI agents with research-backed attacks such as AdvPrefix, AutoDAN-Turbo, PAIR, TAP, FlipAttack, BoN, and static templates across agent frameworks. — note: works locally without an API key; optional cloud reporting is available. (★ 521 · updated 2026-09-21)
- Related: PyRIT · garak · agentic_security
- wallbreaker 🟢🔬
⚠️ — Claude-Code-style terminal and red-team harness for authorized LLM safety testing, with HarmBench, PAIR/TAP, Crescendo, GCG-style workflows, Parseltongue transforms, MCP tooling, LLM judges, and reproducible run artifacts. — note: repository returned HTTP 404 on 2026-10-13; availability is unconfirmed and metrics retain the 2026-08-17 snapshot. Offensive jailbreak toolkit for authorized testing only; AGPL-3.0 licensed and NOTICE flags external jailbreak corpora with their own or missing upstream licenses. (★ 1,208 · updated 2026-08-11) - HiveTrace Red 🟢 — Early-stage LLM red-teaming framework with 80+ attack templates, async evaluation pipelines, WildGuard evaluators, multi-provider support, and HTML reporting. — note: young project with limited independent adoption signal. (★ 32 · updated 2026-10-02)
- DeepTeam 🟢 — Open-source framework for red-teaming LLMs and LLM systems across jailbreaks, prompt injection, data leakage, and safety risks. (★ 3,010 · updated 2026-10-01)
- Moonshot 🟢 — Modular tool for benchmarking, red-teaming, and evaluating LLM applications with custom connectors and recipes. (AI Verify Foundation) (★ 356 · updated 2026-02-05)
- Guardrails AI 🟢 — Python framework for adding input/output guards, validators, structured-output controls, and Guardrails Hub checks to LLM applications. (Guardrails AI) (★ 7,511 · updated 2026-08-26)
- Giskard 🟢 — Open-source evaluation, testing, and red-teaming framework for LLM agents, including agent vulnerability scanning and RAG evaluation workflows. (Giskard AI) (★ 5,892 · updated 2026-10-09)
- LangKit 🟢 — LLM monitoring toolkit extracting safety/security signals such as jailbreak similarity, prompt-injection similarity, hallucination checks, PII patterns, toxicity, and refusal metrics. (WhyLabs) (★ 999 · updated 2024-11-22)
- LLM Guard 🟢 — Suite of input/output scanners (PII, prompt injection, etc.). (Protect AI) — note: archived by the maintainer; retained as a historical reference for local input/output guardrails. (★ 3,218 · updated 2026-07-08)
- Rebuff 🟢 — Archived prompt-injection detector (heuristics + LLM + vector DB + canary tokens). (Protect AI) — note: archived by the maintainer; retained as a historical prompt-injection defense reference. (★ 1,529 · updated 2024-01-25)
- Related: LLM Guard
- NeMo Guardrails 🟢 — Programmable guardrails (input/output/dialog/retrieval rails) for LLM apps. (NVIDIA) (★ 7,286 · updated 2026-10-10)
- PurpleLlama 🟢
⚠️ — Safety tooling including Llama Guard classifiers, CodeShield, CyberSecEval, and LlamaFirewall's configurable prompt, code, and alignment scanner pipelines. (Meta) — note: LlamaFirewall's MIT code license does not cover all bundled projects or model weights; model-backed checks require separate model/provider setup and do not guarantee resistance to adaptive prompt injection. (★ 4,448 · updated 2026-10-12)- Related: LlamaFirewall
- LLAMATOR 🟢
⚠️ — Red-teaming framework for chatbots and GenAI systems; CC BY-NC-SA 4.0 licensed. (★ 223 · updated 2026-01-15) - Vigil 🟢🔬 — Library/REST API to scan prompts and responses for prompt injection. (★ 506 · updated 2024-01-31)
- Counterfit 🟢 — ML/AI penetration-testing automation tool. (Microsoft) (★ 942 · updated 2025-07-18)
- AI-Red-Teaming-Playground-Labs 🟢 — CTFd-based AI red-team training challenges. (Microsoft) (★ 2,095 · updated 2025-10-07)
- EasyJailbreak 🟢🔬 — Framework for building and testing adversarial jailbreak prompts. (★ 926 · updated 2026-09-01)
- TextAttack 🟢🔬 — Python framework for adversarial attacks, data augmentation, and training for NLP models; useful for robustness testing beyond chat-only LLM scanners. (★ 3,475 · updated 2026-08-15)
- GPTFuzz 🟢🔬 — Research framework for red-teaming LLMs with auto-generated jailbreak prompts. (★ 608 · updated 2026-02-27)
- HarmBench 🟢🔬 — ICML 2024 standardized evaluation framework for automated red-teaming and robust-refusal benchmarking. (Center for AI Safety) (★ 1,068 · updated 2024-08-05)
- llm-attacks (GCG) 🟢🔬 — Canonical Greedy Coordinate Gradient adversarial-suffix attack implementation for transferable attacks on aligned language models. (★ 4,829 · updated 2024-08-02)
- nanoGCG 🟢 — Fast, lightweight PyTorch implementation of the GCG adversarial-suffix algorithm. (★ 356 · updated 2025-05-13)
- Related: llm-attacks (GCG)
- JailbreakBench 🟢🔬 — NeurIPS 2024 open robustness benchmark and leaderboard for generating and defending against LLM jailbreaks. (★ 687 · updated 2025-03-31)
- Open-Prompt-Injection 🟢🔬 — Open-source toolkit and benchmark for implementing and evaluating prompt-injection attacks, defenses, and LLM-integrated applications. (★ 506 · updated 2026-09-27)
- PINT Benchmark 🟢🔬 — Prompt-injection test benchmark for evaluating detectors and guardrails across multilingual prompt injection, jailbreak, benign, and hard-negative inputs. (Lakera) — note: archived benchmark retained as a historical research reference; use newer maintained corpora for current detector comparisons. (★ 200 · updated 2026-04-02)
- PIArena 🟢🔬 — ACL 2026 toolbox and benchmark for prompt-injection attacks and defenses, with ready-to-use attacks/defenses, evaluation pipelines, agent benchmarks, a Hugging Face dataset, and leaderboard. (★ 53 · updated 2026-08-31)
- Related: PINT Benchmark · Open-Prompt-Injection
- Whistleblower 🟢
⚠️ — Offensive testing tool for inferring system prompts and discovering capabilities of LLM applications exposed through APIs. (Repello AI) — note: no LICENSE file found. (★ 179 · updated 2025-10-27) - LLMmap 🟢🔬 — Minimal-query fingerprinting tool for identifying LLMs from behavioral traces, with a pretrained open-set inference model. (★ 477 · updated 2025-07-24)
- llm-security 🔬 — Original PoC for indirect prompt-injection attacks. (★ 2,149 · updated 2025-07-17)
- Related: Dropbox LLM extraction research (historical code and results) · PIPE threat-model primer (2023 reference, not current API guidance; no root license) · HouYi (historical prompt-injection research) · RAG poisoning teaching PoC (AGPL-3.0; embedding weights/model endpoint required; not a benchmark)
- JailbreakLLMs 🔬
⚠️ — Research dataset of 6,387 ChatGPT prompts, including in-the-wild jailbreak prompts from Reddit, Discord, websites, and open datasets. (★ 27 · updated 2024-02-21) - Do-Not-Answer 🟢🔬 — Dataset for evaluating LLM safeguards on unsafe or policy-sensitive prompts. (★ 346 · updated 2024-06-07)
- prompt-injection-defenses 🟢
⚠️ — Curated catalog of practical defenses against prompt injection. (★ 737 · updated 2025-02-22) - little-canary 🟢🔬 — Prompt-injection preflight sensor that probes untrusted input with a powerless canary model and returns PASS, FLAG, or BLOCK with explicit coverage state before primary-agent action; includes opt-in Claude Code prompt-submission and OpenAI Agents SDK input-boundary adapters. — note: experimental sensing layer, not a security guarantee or runtime containment. A failed canary can return availability-first routing with explicit degraded coverage; remote/OpenAI-compatible canary or judge endpoints receive raw input. (★ 39 · updated 2026-10-08)
- Related: Rebuff · prompt-injection-defenses
- Kiji Privacy Proxy 🟢 — Local privacy proxy for OpenAI-compatible AI API traffic that detects and masks 26 PII types with an ONNX model before forwarding requests, then restores mappings in responses. (Dataiku 575 Lab) — note: protects configured proxied traffic, not every path by which an application or agent can disclose data; operators retain responsibility for proxy routing and local mapping storage. (★ 437 · updated 2026-09-14)
- Related: LLM Guard · Kiji PII model
- Anamorpher 🟢🔬 — Research tool with a frontend and Python API for crafting and visualizing image-scaling attacks that reveal hidden prompt injections to multimodal AI systems after downscaling. (Trail of Bits) — note: active beta research tool for authorized testing; generated payloads are sensitive to the target's image-resampling implementation and preprocessing pipeline. (★ 1,080 · updated 2026-02-19)
- AgentPoison 🟢🔬 — NeurIPS 2024 research implementation of backdoor attacks on LLM agents through poisoned long-term memory or RAG knowledge bases and optimized retrieval triggers. — note: research artifact with GPU/model-checkpoint and dataset setup; external model and dataset licenses apply separately, hosted-model modes need credentials and transmit experiment content, and agent experiments belong in isolated authorized environments. (★ 250 · updated 2026-10-23)
- Sources: AgentPoison paper
- Related: Agent Security Bench (ASB) · Agent Memory Guard
- Prompt SIREN 🟢🔬 — Research workbench for developing and evaluating prompt-injection attacks and defenses with state-machine agent control, AgentDojo/SWE-bench integrations, configuration sweeps, and reproducible result aggregation. (Meta AI) — note: experiment harness; running target evaluations requires model-provider credentials and may need Docker or browser extras depending on the selected environment. (★ 62 · updated 2026-05-18)
- Argus 🟢🔬 — Black-box red-team framework for LLM applications and agents with target adapters, attack probes, deterministic and model-assisted judging, and SARIF, JUnit, HTML, and JSON reporting. — note: pre-1.0 project; full deployments use an orchestrator and PostgreSQL, while model-assisted judges require provider credentials. Attack-success and guardrail-improvement figures are project-reported; probe only authorized targets. (★ 206 · updated 2026-08-25)
- Cryptex OSS 🟢🟠 — Browser-based and self-hostable adversarial prompt workbench with transformation pipelines, campaign workflows, TAP/PAIR/Crescendo methods, and HarmBench/JailbreakBench-style corpora. — note: authorized-testing toolkit; provider keys are supplied by the operator and retained in browser storage. Included benchmark scoring is explicitly heuristic rather than paper-accurate, and the separate production product is closed-source. (★ 336 · updated 2026-06-09)
- Related: wallbreaker · HarmBench
- API Relay Audit 🟢
⚠️ — Local audit CLI for third-party LLM relays and proxies, testing prompt injection, model substitution, tool-call rewriting, streaming behavior, and relay-specific trust assumptions. — note: sends the supplied API credential to the relay being tested, so use a scoped disposable key and only assess services you are authorized to probe. Results identify suspicious behavior but do not certify a relay as safe. (★ 880 · updated 2026-10-09) - AIDR Bastion 🟢🟠
⚠️ — Runtime input-protection service combining detection rules, similarity search, classifiers, optional LLM analysis, and code-oriented checks to allow, block, or notify on suspicious GenAI traffic. (SOC Prime) — note: multi-service deployment can require OpenSearch/Elasticsearch, Qdrant, Kafka, and an optional local or hosted model; some rule and integration workflows connect to SOC Prime services. Treat it as a layered signal source, not a complete isolation boundary. (★ 107 · updated 2026-08-20)- Related: LLM Guard · NeMo Guardrails
- CaMeL 🟢🔬 — Research implementation of the capability-based CaMeL interpreter architecture for separating trusted control flow from untrusted data while evaluating prompt-injection defenses on AgentDojo. (Google Research / Google DeepMind / ETH Zurich) — note: unsupported paper-reproduction artifact whose maintainers explicitly warn that the interpreter may contain bugs and may not be fully secure; do not treat it as a production guardrail. (★ 405 · updated 2025-06-20)
- Meta SecAlign 🔬
⚠️ — Research code, training recipe, and evaluation harness for prompt-injection-resistant Meta SecAlign models across six security and eight utility benchmarks. (Meta / UC Berkeley) — note: most repository code is non-commercial while published model weights use separate Llama community terms; reproducing training or the full evaluation requires substantial GPU capacity and optional provider credentials. (★ 71 · updated 2026-02-25)
- Wolf Defender Prompt Injection 🟢 — Hugging Face text-classification model for prompt-injection detection in agents, chatbots, and CI workflows. (Patronus Studio / Casdo Labs) license: Apache-2.0 · access: open · artifacts: Safetensors, ONNX.
- DeBERTa v3 Prompt Injection v2 🟢 — Apache-licensed prompt-injection classifier usable via Transformers pipelines and ONNX. (Protect AI) license: Apache-2.0 · access: open · artifacts: Safetensors, ONNX.
- PromptGuard 🟢
⚠️ — ModernBERT-based prompt-injection and jailbreak classifier. (CodeIntegrity AI) license: Apache-2.0 · access: gated auto · artifacts: Safetensors. - Llama Prompt Guard 2 86M 🟠
⚠️ — Meta's multilingual binary classifier for detecting explicit prompt-injection and jailbreak attempts. (Meta) license: Llama 4 Community License · access: gated manual · artifacts: Safetensors. — note: 512-token context window requires segmentation of longer inputs; adaptive attacks and application-specific distribution shifts can bypass detection, so use as one defense layer rather than a security boundary. - prompt-injection-sentinel 🔬
⚠️ — ModernBERT-large classifier for prompt-injection and jailbreak detection. (Qualifire) license: other · access: gated auto · artifacts: Safetensors.
- Foundation-Sec-8B-Reasoning 🟠
⚠️ — Downloadable Llama-3.1-derived 8B reasoning model for cybersecurity analysis, threat intelligence, and multi-step security workflows. (Cisco Foundation AI) license: Llama 3.1 Community License (base materials); Apache-2.0 (Cisco changes) · access: open · artifacts: Safetensors. Caveat: not an Apache-only model; retain the base-model license and NOTICE obligations. Local inference needs a separate runtime and substantial memory, but no mandatory Cisco service. Security analysis can hallucinate; this is not a verified scanner or guardrail, and any tool-executing wrapper needs independent authorization and isolation. - SecGPT 🟢 — Open cybersecurity-tuned LLM family for vulnerability analysis, log/traffic investigation, anomaly detection, attack/defense reasoning, command analysis, and security Q&A. (Clouditera) (★ 3,114 · updated 2025-06-25)
- Related: SecGPT model
- Antares-1B 🟢
⚠️ — Open-weight security SLM specialized for agentic vulnerability localization: it explores repository snapshots through a terminal-style loop and ranks likely vulnerable files for analyst review. (Cisco Foundation AI) license: Apache-2.0 · access: gated manual · artifacts: Safetensors + CLI ZIP. — note: HF access is gated/manual; related smaller model: Antares-350M, benchmark: VLoc Bench. - Trendyol Cybersecurity LLM v2 70B 🟢 — Defense-focused cybersecurity LLM based on Llama-3.3-70B, trained on an alignment-safe security instruction dataset for SOC, cloud, AppSec, detection, and vulnerability-management workflows. (Trendyol Group Security Team) license: Apache-2.0 · access: open · artifacts: GGUF.
- WhiteRabbitNeo 2.5 Qwen Coder 7B 🟢
⚠️ — Cybersecurity-oriented Qwen2.5-Coder fine-tune positioned for offensive and defensive security assistance. (WhiteRabbitNeo) license: Apache-2.0 + WhiteRabbitNeo restrictions · access: open · artifacts: Safetensors. - Lily-Cybersecurity-7B-v0.2 🟢 — Mistral-7B-Instruct fine-tune for cybersecurity assistance, trained on hand-crafted security and hacking-related instruction pairs. (Segolily Labs) license: Apache-2.0 · access: open · artifacts: Safetensors.
- RavenX CyberAgent 35B Q4_K_M 🟢
⚠️ — GGUF security-specialized text-generation model positioned for pentest, bug-bounty, tool-calling, MCP, CVSS/CWE, and MITRE ATT&CK workflows. (RavenX LLC / DeadByDawn101) license: Apache-2.0 · access: open · artifacts: GGUF. — note: built from an abliterated base model and marketed for autonomous security assessment; use only in authorized, sandboxed agent harnesses with tool-call validation.
Honeypots and deception that use LLMs to simulate convincing systems.
- Beelzebub 🟢
⚠️ — Low-code honeypot using LLMs to simulate SSH/HTTP/MCP services (Go). — note: GPL-3.0 licensed. (★ 2,194 · updated 2026-10-01) - DECEIVE 🟢🔬 — Proof-of-concept LLM-powered SSH honeypot that evaluates sessions as benign, suspicious, or malicious. (Cisco Talos / originally Splunk SURGe) (★ 296 · updated 2026-05-13)
- TRAP 🟢🔬 — Research code for Targeted Random Adversarial Prompt honeypots that identify black-box LLM usage through model-specific prompt suffixes (ACL 2024 Findings). (★ 15 · updated 2024-11-20)
- shelLM 🟢🔬 — LLM-powered SSH honeypot (paper "LLM in the Shell"). (★ 67 · updated 2026-06-25)
- Related: VelLMes
- VelLMes 🟢🔬 — Multi-protocol LLM honeypot framework (successor to shelLM). (★ 80 · updated 2025-02-18)
- Related: shelLM
- llm-honeypot 🔬
⚠️ — Cowrie SSH honeypot extended with prompt-injection traps to detect LLM hacker agents. (Palisade Research) (★ 65 · updated 2026-01-23)
Offensive agents and the benchmarks used to evaluate them.
- OWASP PromptMe 🟢 — Intentionally vulnerable Flask/Ollama lab with hands-on challenges based on OWASP LLM risks. (OWASP) Caveat: use a disposable isolated environment without real data: examples bind to all interfaces, contain known training secrets, fetch URLs, and deliberately include fail-open behavior. Ollama and model weights are separate dependencies. (★ 43 · updated 2026-09-10)
- Sherpa 🟢 — Hands-on MCP security lab pairing vulnerable and hardened sample servers with authentication and authorization exercises. (Microsoft Azure Samples) Caveat: use an isolated teaching environment; demonstration tokens and fixed identities are not production authentication. Azure-backed exercises require appropriate account permissions and may incur costs; sample fixes are not a complete application-security boundary. (★ 29 · updated 2026-09-14)
- ExploitGym 🟢🔬
⚠️ — Research benchmark and evaluation harness for developing exploits for known vulnerabilities across userspace programs, V8, and Linux-kernel tasks, combining flag checks with model-based trajectory assessment. Caveat: executes real exploits against vulnerable containers or VMs and can require host mitigation changes; use dedicated isolated infrastructure. Providers and model judges receive task context, task artifacts retain separate upstream licenses, and judge verdicts need review. (★ 1,163 · updated 2026-09-29) - Inspect Cyber 🟢🔬 — Installable Inspect extension for defining and running agentic cyber evaluations with standardized YAML configurations, adaptable sandboxes, scenario variants, scoring, and solvability verification. (UK AI Security Institute) — note: evaluation framework rather than a benchmark result or defensive control; Docker, Kubernetes, or other configured sandboxes can contain intentionally vulnerable targets and should remain isolated from production networks. (★ 43 · updated 2026-06-18)
- Related: inspect_evals
- GenAI Red Team Lab 🟢🔬 — Collection of intentionally vulnerable GenAI sandboxes, exploitation examples, and tutorials for prompt injection, memory poisoning, orchestration attacks, guardrail bypass, and related red-team exercises. (OWASP GenAI Security Project) — note: training and research lab, not a scanner; it contains exploitation code and deliberately vulnerable services that should run only in disposable isolated environments. (★ 59 · updated 2026-09-20)
- SWE-agent (EnIGMA) 🟢🔬 — EnIGMA offensive-CTF mode; SOTA on NYU CTF, InterCode-CTF, and Cybench (v0.7 branch). (★ 20,542 · updated 2026-07-16)
- Related: Cybench · NYU CTF Bench · InterCode
- Cybench 🔬 — 40 professional CTF tasks across 4 competitions; widely used by AI safety institutes. (★ 341 · updated 2026-09-24)
- NYU CTF Bench 🔬 — Dockerized CSAW CTF challenges for LLM-agent evaluation. (★ 180 · updated 2025-09-22)
- CTFTiny 🔬
⚠️ — Lightweight CTF benchmark from the NYU LLM CTF group; GPL-2.0 licensed. (★ 20 · updated 2026-03-10)- Related: NYU CTF Bench
- InterCode 🔬 — Interactive-coding benchmark incl. InterCode-CTF. (★ 257 · updated 2024-05-05)
- inspect_evals 🟢🔬
⚠️ — Maintained Inspect AI evaluation suite containing multiple cyber benchmarks and tasks. (UK AI Security Institute) — note: benchmark-specific licenses apply; AgentHarm uses MIT with an additional restriction permitting its dataset and benchmark only for improving AI safety and security, and its scores are not an overall measure of agent safety. (★ 717 · updated 2026-10-23) - BountyBench 🔬 — 25 real systems / 40 bug bounties for Detect-Exploit-Patch evaluation. (★ 111 · updated 2025-06-22)
- Cyber-Zero 🔬 — Trains cybersecurity agents without runtime; ships an EnIGMA+ scaffold. (Amazon Science) — note: archived research artifact retained as a historical reference for training cybersecurity agents without a live runtime. (★ 101 · updated 2025-09-02)
- ExploitBench 🔬 — Measures AI-agent progress on V8/Chromium exploit ladders. (★ 428 · updated 2026-07-04)
- AI Goat 🟢🔬
⚠️ — Vulnerable-by-design local LLM CTF for learning prompt injection, insecure output handling, data leakage, excessive agency, and related LLM app risks. — note: GPL-2.0 licensed. (★ 368 · updated 2024-08-22) - AIGoat 🟢🔬
⚠️ — Local-first vulnerable LLM security playground with guided OWASP LLM Top 10 attack labs, CTF challenges, progressive defenses, and an Ollama-backed AI shopping-assistant target. — note: platform code is Apache-2.0, but training/challenge content is CC BY-NC-SA-4.0 and requires permission for commercial workshops. (★ 144 · updated 2026-10-10) - LLMVault 🟢🔬 — Intentionally vulnerable LLM security-training platform with OWASP LLM Top 10 labs, CTF-style challenges, hints, scoring, and mitigation guidance. — note: deliberately vulnerable training target; run only in an isolated, authorized environment. Live Mode optionally requires Ollama or provider credentials. (★ 337 · updated 2026-09-28)
- Damn Vulnerable LLM Agent 🟢🔬 — Deliberately vulnerable LangChain ReAct agent for practicing prompt-injection and Thought/Action/Observation injection attacks. (ReversecLabs / WithSecure) (★ 530 · updated 2025-06-25)
- Related: spikee
- Agentic Bug Hunter (formerly claude-bug-bounty) 🟢 — Claude Code plugin and standalone CLI for model-assisted bug-bounty reconnaissance, vulnerability testing, and reporting. (★ 5,331 · updated 2026-10-09)
- Bug-Bounty-Agents 🟢 — 43 AI agent personas for Claude Code / Copilot / Cursor across the bug-bounty lifecycle. (★ 446 · updated 2026-04-30)
- ai-exploits 🟢 — Real-world AI/ML exploits (Metasploit modules + Nuclei templates) for MLflow, Ray, H2O. (Protect AI) (★ 1,754 · updated 2024-10-23)
- CyberGym 🟢🔬 — Large-scale evaluation framework for AI-agent vulnerability analysis on real-world tasks, with locally deployed challenge infrastructure, task generation, and proof-of-concept validation. (UC Berkeley / Sunblaze) — note: deploy only in an isolated local environment; the full benchmark runtime is extremely large (documentation cites up to ~10 TB) and must not be exposed to the public internet. (★ 950 · updated 2026-08-28)
- SEC-bench 🟢🔬 — Research framework for constructing reproducible real-world software vulnerability instances from CVE/OSV reports and evaluating LLM agents on proof-of-concept generation and patching. (UIUC / Purdue University) — note: requires Docker, configured model/API credentials, and substantial storage (>200 GB recommended); executes vulnerable code and generated PoCs, so use isolated authorized environments and review what source/report content is sent to model providers. (★ 104 · updated 2026-01-27)
- Sources: SEC-bench paper
- Related: CVE-Bench · Cybench
- CVE-Bench 🟢🔬 — ICML 2025 benchmark that evaluates AI agents against reproducible Docker environments for real critical-severity web-application CVEs and exploit objectives. — note: runs intentionally vulnerable services and should be used only in isolated environments; arm64 support is experimental. (★ 298 · updated 2026-09-24)
- Related: CyberGym · BountyBench
- SCAM 🟢🔬 — Benchmark for measuring whether tool-using agents recognize and resist realistic scams, social engineering, credential requests, impersonation, and unsafe multi-turn instructions across 30 scenarios and nine threat categories. (1Password) — note: evaluation requires at least one configured model provider; leaderboard results and reported safety improvements from the optional skill are project-reported, with raw result artifacts published for inspection. (★ 136 · updated 2026-02-12)
- Related: AgentDojo · Agent Security Bench
- AIRTBench-Code 🟢🔬 — Research harness and dataset for evaluating autonomous AI red-team agents on AI/ML security CTF challenges, with published task definitions and result artifacts. (Dreadnode) — note: the public code and dataset accompany arXiv 2506.14682, but reproducing the full evaluation depends on Dreadnode's hosted Strikes environment, platform access, model credentials, and containerized challenge infrastructure. (★ 112 · updated 2026-04-26)
- AI-Goat (Orca Security) 🟢🔬 — Deliberately vulnerable AWS and Terraform lab for learning AI/ML infrastructure risks such as model supply-chain compromise, data poisoning, insecure output handling, and integrity failures. (Orca Security Research) — note: distinct from the local LLM playgrounds with similar names; deploys intentionally vulnerable cloud resources and can incur AWS costs, so use only in an isolated authorized account and remove resources after each lab. (★ 291 · updated 2025-09-16)
- LivePI 🔬
⚠️ — Reproducibility artifact for a production-like indirect prompt-injection benchmark spanning live but test-controlled email, chat, web, local-file, repository, and wallet surfaces. — note: benchmark setup interacts with live test accounts and services and includes attack scenarios capable of exfiltration, unsafe execution, security-control changes, and value transfer; reproduce only in isolated infrastructure with synthetic credentials and explicit authorization. (★ 10 · updated 2026-06-08)- Related: LivePI paper · AgentDojo
AI tooling for cloud/IaC security, digital forensics, OSINT, and phishing detection.
- AWS AI/ML Security Assessment 🟢 — Security-posture assessment of AWS AI/ML services, including Bedrock, SageMaker, and AgentCore configurations. (AWS Samples) Caveat: requires AWS IAM permissions and deployed resources, with possible service costs; reports can expose sensitive infrastructure details. A configured prompt-attack filter is not evidence of attack resistance, and standards mappings are not compliance certification. (★ 47 · updated 2026-10-09)
- AIFT 🟢
⚠️ — Python forensic-triage application that parses disk images and collected Windows/Linux artifacts with Dissect, then produces model-assisted reports through GUI, CLI, REST, or MCP interfaces. Caveat: AGPL-3.0 licensed. Hosted providers receive parsed evidence; local models require separately supplied runtimes and weights. Use evidence copies and independent integrity controls, and keep API access trusted. Outputs are investigation leads requiring examiner verification, not final forensic conclusions. (★ 50 · updated 2026-06-13) - Valhuntir 🟢 — Analyst-directed incident-response platform combining a Python case-management CLI with SIFT MCP services for evidence processing, draft findings, human review, and report generation. Caveat: alpha; full deployment needs companion SIFT MCP packages and optional forensic VMs or OpenSearch. Loaded evidence may reach configured model providers. Lite has no sandbox or deny rules, tools can execute on the host, and evidence integrity and findings require independent examiner controls. (★ 110 · updated 2026-10-11)
- Related: SIFT MCP backend
- EscalateGPT 🟢 — GPT-based discovery of privilege-escalation paths in AWS IAM policies. (Tenable) (★ 123 · updated 2024-01-17)
- Cynative 🟢 — Local AI security research agent for cloud, code, and runtime environments across GitHub, GitLab, AWS, GCP, Azure, and Kubernetes, with read-only action gates, sandboxed code execution, evidence-backed verification, and audit logs. (★ 222 · updated 2026-10-11)
- Related: Fraim · EscalateGPT
- Julius 🟢 — Local Go tool that fingerprints LLM service infrastructure on authorized endpoints, identifies 60+ serving, gateway, MCP, and RAG platforms, and can enumerate exposed models. (Praetorian) — note: use only against endpoints you own or are authorized to assess. (★ 246 · updated 2026-10-03)
- Related: AI-Infra-Guard · ai_osint
- MemoryInvestigator 🔬 — Volatility 3 + LLM + RAG for memory-forensic triage. (★ 13 · updated 2025-09-16)
- Related: Volatility-MCP-Server
- Volatility-MCP-Server 🟢 — MCP exposing Volatility 3 plugins for natural-language memory forensics. (★ 41 · updated 2025-07-07)
- Related: MemoryInvestigator
- llm_osint 🟢🔬 — Proof-of-concept LLM OSINT framework using knowledge and web agents for internet research workflows. (★ 318 · updated 2024-11-02)
- ai_osint 🟢 — Curated AI-OSINT dorks, queries, and techniques for discovering exposed LLM and AI infrastructure. (★ 168 · updated 2026-06-19)
- PhishVLM (formerly PhishLLM) 🔬
⚠️ — Research phishing detector using vision-language models for brand recognition and credential-page analysis, extending the authors' USENIX Security 2024 PhishLLM work. Caveat: the documented setup requires Chrome, OpenAI and Google Search credentials; page imagery and search context can reach external services. Model-dependent classifications require validation. No root license was found; confirm reuse terms. (★ 40 · updated 2026-06-04) - mcp-dnstwist 🟢 — MCP server for dnstwist DNS fuzzing to support typosquatting, phishing, and lookalike-domain analysis. (★ 51 · updated 2026-10-13)
- osintgpt 🟢
⚠️ — OpenAI embeddings + Qdrant over OSINT corpora. (★ 533 · updated 2026-10-07)
- Awesome GUI Agent Security — Focused bibliography of GUI, computer-use, and browser-agent security research, organized by attack surface and defense layer with Chinese-language annotations. (★ 77 · updated 2026-10-03)
- Jailbreak Observatory — Classified bibliography and visualizations of LLM jailbreak research; no root license was found, and publication labels are not independently verified. (★ 23 · updated 2026-10-01)
- Awesome Agentic Security — Survey bibliography covering agent attacks, defenses, and security applications; an MIT badge is present but no root license file was found. (★ 59 · updated 2026-08-24)
- Awesome LLMSecOps — Resource directory covering LLM architecture, operations, threat modeling, and security; no root license was found. (★ 164 · updated 2026-09-27)
- Awesome GenAI Security — GPL-3.0 collection of GenAI and agentic-security references, tutorials, labs, and testing resources; linked artifacts retain their own terms. (★ 82 · updated 2026-10-11)
- Awesome Hacking with AI — Directory of AI-assisted security and AI-system security resources covering agent safety, MCP, red teaming, and detection engineering; linked projects require separate review. (★ 38 · updated 2026-10-02)
- AI/ML Security and Prompt-Injection Resources — AI-security learning roadmap and resource directory that distinguishes historical and unverified material; no root license was found. (★ 807 · updated 2026-09-19)
- Awesome AI Security TR — Turkish-language annotated directory of prompt-injection, red-teaming, guardrail, agent, MCP, and RAG security resources under CC BY 4.0; link checks do not validate security claims. (★ 14 · updated 2026-10-06)
- Awesome Prompt Injection — CC0 resource list focused on prompt injection and related machine-learning security references. (★ 682 · updated 2026-09-11)
- Awesome AI Red Teaming JP — CC0 collection of Japanese-language AI red-teaming and safety resources. (★ 13 · updated 2026-06-20)
- Arcanum AI Security Resources — Categorized directory of AI-security labs and competitions; no root license was found, and external availability or free access is not guaranteed. (★ 517 · updated 2026-07-03)
- Awesome Agentic MCP Security — CC0 collection of agentic-AI and MCP security resources. (★ 23 · updated 2026-09-26)
- Awesome Agent Sandbox — Directory of agent sandbox runtimes and comparisons; no root license was found, and performance or security comparisons are not independently verified. (★ 21 · updated 2026-07-07)
- Awesome Agent Sandboxes — Directory of self-hosted and cloud code-execution sandboxes for AI agents; no root license was found, and listed products offer differing isolation boundaries. (★ 51 · updated 2026-08-19)
- Awesome LM Safety, Security, and Privacy — Apache-2.0 bibliography of language and multimodal model safety, security, and privacy research; linked publications, models, and datasets retain their own licenses. (★ 2,085 · updated 2026-09-02)
- Awesome AI Security (DeepSpaceHarbor) — Historical collection of adversarial examples, evasion, poisoning, and ML-security research code; no root license was found, and recent commits do not establish the currency of linked material. (★ 1,680 · updated 2026-03-08)
- Awesome LLM Agent Security — Unlicense bibliography of LLM-agent security research, attacks, and vulnerabilities; linked papers and code retain their own terms. (★ 59 · updated 2026-07-11)
- Awesome MLLM/LLM Guardrails — Focused research index of text and multimodal guardrail models, moderation datasets, jailbreak studies, evaluation resources, and runtime frameworks; linked artifacts retain their own terms. (★ 36 · updated 2026-10-07)
- awesome-security-agent-harnesses — Focused CC0 catalog of vulnerability-discovery and pentest agent harnesses, security skills, sandboxes, MCP integrations, benchmarks, and evaluation research. (★ 28 · updated 2026-10-04)
- awesome-llm-cybersecurity-tools — Tenable's list (archived but a strong reference). (★ 483 · updated 2024-04-08)
- Awesome-LLM4Cybersecurity — 600+ papers on LLMs for cybersecurity. (★ 1,786 · updated 2026-08-20)
- awesome-ai-cybersecurity — Broad AI-for-security collection. (★ 159 · updated 2026-10-07)
- awesome-genai-cyberhub — GenAI-driven cybersecurity resources. (★ 59 · updated 2026-10-11)
- awesome-ai-security — For pentesters, bug hunters, and researchers. (★ 57 · updated 2026-10-12)
- awesome-ai-security — AI security resources. (★ 1,542 · updated 2026-10-12)
- Awesome-AI-Security — AI security resources. (★ 883 · updated 2026-07-18)
- Awesome-AI-For-Security — AI-for-security tools, papers, and datasets. (★ 150 · updated 2026-10-05)
- awesome-cybersecurity-agentic-ai — Agentic-AI cybersecurity tools and security MCP servers. (★ 603 · updated 2026-10-10)
- awesome-ai-agents-security — Focused map of AI-agent security resources across runtime protection, red-teaming scanners, static analysis, sandboxing, guardrails, benchmarks, and identity. (★ 75 · updated 2026-06-12)
- Awesome-Offensive-AI-Agentic-Landscape — Offensive AI-agent landscape covering open-source pentest/red-team agents, offensive/security-specialized models, papers, benchmarks, and commercial tools. (★ 356 · updated 2026-09-10)
- awesome-ai-agent-attacks — Sourced timeline of real AI-agent security incidents, breaches, vulnerabilities, and attack techniques. (★ 81 · updated 2026-10-05)
- AI Security Repository Radar — Daily-updated AI/LLM/MCP/RAG security repository radar with category, license, stars, and quality/relevance metadata. (★ 10 · updated 2026-10-12)
- awesome-MLSecOps — Curated MLSecOps resources spanning adversarial ML, LLM security, AI red teaming, model scanning, supply-chain protection, and MLOps pipeline security. (★ 475 · updated 2026-10-12)
- awesome-ai-guardrails — Catalog of AI guardrail models, tools, organizations, datasets, and papers, with useful Hugging Face model coverage. (★ 107 · updated 2026-07-30)
- open-source-llm-scanners — Open-source LLM scanners and testing tools. (★ 109 · updated 2026-02-05)
- awesome-mcp-security — MCP security resources, tools, writeups, and server/client risk references. (★ 743 · updated 2026-03-03)
- awesome-ml-security — Trail of Bits' curated machine-learning security resources. (★ 170 · updated 2026-02-06)
- awesome-ml-privacy-attacks — Machine-learning privacy-attack papers and resources. (★ 643 · updated 2024-03-18)
- awesome-ml-for-cybersecurity — Large classic list of machine-learning-for-cybersecurity resources (stale-ish but still useful). (★ 9,473 · updated 2024-04-11)
- Awesome-AI4DevSecOps — Taxonomy of AI-driven security solutions for DevSecOps. (★ 20 · updated 2025-07-02)
- awesome-llm-security — Securing LLMs. (★ 1,711 · updated 2025-08-20)
- awesome-gpt-security — GPT/LLM security tools and cases. (★ 673 · updated 2026-07-24)
- awesome-threat-intelligence — Classic CTI list (pairs with the AI-CTI section). (★ 10,726 · updated 2026-05-31)
- awesome-threat-modelling — General-purpose threat modeling list — methodologies and non-AI tools (Threat Dragon, pytm, Threagile); dormant since 2023 but a solid reference. (★ 1,828 · updated 2023-07-15)
- Awesome-LLMs-for-Vulnerability-Detection — Focused, continuously updated index of LLM-based software-vulnerability detection research across function, repository, agentic, and smart-contract analysis, including datasets, benchmarks, and surveys. (★ 1,485 · updated 2026-10-13)
Contributions are welcome! This README is generated from structured data.
- Edit
data/sections.json(validated bydata/schema.json). - Use structured fields such as
status,flags, andlicense; do not paste rendered emoji tags into the data. - Regenerate and check the README:
python3 scripts/update_github_metrics.py
python3 gen_readme.py
python3 gen_readme.py --checkExample entry:
{
"name": "ExampleTool",
"repo": "OWNER/REPO",
"status": ["open_source"],
"license": "MIT",
"flags": ["early_stage"],
"desc": "One factual sentence about what the tool does.",
"related": [
{"label": "Sibling tool", "url": "https://github.com/OWNER/SIBLING"}
]
}Status values: open_source, research, commercial_open. Common flags: license_caveat, early_stage, archived, heavy_runtime, requires_api_key, authorized_testing_only, commercial_features, telemetry, model_dependent, research, no_license, noncommercial, copyleft, abliterated_or_uncensored.
Guidelines: link the canonical upstream repo (not a fork); verify the URL resolves; tag the correct type and add a caveat flag/note for non-permissive, non-commercial, unclear, missing, or restrictive licenses; prefer real, installable projects over blog-only references.
For Hugging Face model entries, include the model id, license, access status (open/gated), and artifact formats (for example Safetensors or ONNX).
Maintained by Sergey Gordeychik — [email protected] · blog · @scadasl.
To the extent possible under law, the contributors have waived all copyright and related rights to this list (CC0-1.0). Linked projects retain their own licenses — check each before use.
