Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Visa Vulnerability Agentic Harness
| Date | Stars |
|---|---|
| 2026-07-31 | 2303 |
| 2026-08-03 | 2416 |
| 2026-08-06 | 2416 |
| 2026-08-12 | 2530 |
| 2026-08-18 | 2565 |
| 2026-08-19 | 2569 |
| 2026-08-20 | 2571 |
| 2026-08-21 | 2579 |
| 2026-08-22 | 2583 |
| 2026-08-23 | 2586 |
| 2026-08-24 | 2590 |
| 2026-08-25 | 2595 |
| 2026-08-26 | 2600 |
| 2026-08-27 | 2601 |
| 2026-08-28 | 2634 |
| 2026-08-29 | 2650 |
| 2026-08-30 | 2656 |
| 2026-08-31 | 2662 |
| 2026-09-01 | 2679 |
| 2026-09-02 | 2699 |
| 2026-09-03 | 2706 |
| 2026-09-04 | 2712 |
| 2026-09-05 | 2721 |
| 2026-09-06 | 2727 |
| 2026-09-07 | 2739 |
| 2026-09-08 | 2747 |
| 2026-09-09 | 2751 |
| 2026-09-10 | 2756 |
| 2026-09-11 | 2759 |
| 2026-09-12 | 2764 |
| 2026-09-13 | 2766 |
| 2026-09-14 | 2770 |
| 2026-09-15 | 2780 |
| 2026-09-16 | 2785 |
| 2026-09-17 | 2788 |
| 2026-09-18 | 2789 |
| 2026-09-19 | 2791 |
| 2026-09-20 | 2792 |
Today
+1 stars today
This week
+26 stars this week
This month
+213 stars this month
Momentum
65.0
growth rate 0.94%/day
<!--
Copyright 2026 Visa, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
# Visa Vulnerability Agentic Harness — Agentic Vulnerability Discovery, Remediation, and Validation
VVAH is Visa's open-source harness for autonomous vulnerability discovery,
remediation, and validation using large language models, built on learnings from
[Project Glasswing](https://www.anthropic.com/glasswing) (Anthropic's
initiative for AI-assisted vulnerability research).
VVAH supports a four-phase pipeline: an S0 static seed followed by detection
and reporting (S1–S9), with optional remediation and validation (S10–S11).
The shipped `default.yaml` and `full.yaml` profiles derive that seed from the
model; `taint.yaml` uses rules mode, which needs operator-supplied source/sink
YAML. The four phases:
- **Phase 1 — Discovery & Modeling (S1–S3)**: map the attack surface and build a
threat-aware plan.
- **Phase 2 — Deep Dive & Verification (S4–S6)**: run multi-lens analysis and
adversarial verification to assess likely exploitability.
- **Phase 3 — Synthesis & Reporting (S7–S9)**: deduplicate, chain, and emit
structured findings (Markdown + SARIF).
- **Phase 4 — Remediation & Validation (S10–S11, optional)**: propose candidate
fixes and adversarially validate them before adoption. Disabled in the shipped
default profile, which stops after Phase 3 (S9). See
[Run your first scan](#run-your-first-scan) for how to enable these stages.
Three design choices drive finding quality: threat modeling before analysis
focuses the attack surface; multi-agent deterministic voting reduces false
positives; and structured triage artifacts compress the lifecycle from
AI-discovered weakness to actionable finding. The bottleneck in AI-assisted
vulnerability management is triage speed, not discovery. VVAH is designed
around that constraint. The primary effectiveness metric is **Mean Time to
Adapt (MTTA)**: elapsed time from AI-discovered exploitability to a validated
fix in production.
**Multi-model by design.** Every model-driven role — S0 through S11 — can be
pointed at its own model and provider:
- **Anthropic Claude** — native route
- **OpenAI-compatible** — OpenAI models and any OpenAI-compatible gateway
- **Open-weight** — served over Chat Completions-compatible endpoints
No single provider is a hard dependency. Detection and remediation/validation
draw on the same set; see [docs/models.md](docs/models.md) for the per-role
matrix.
For setup, see [`docs/SETUP_GUIDE.md`](docs/SETUP_GUIDE.md). GitHub Issues are
open for bug, documentation, setup, and feature-request reports — see
[Reporting issues](#reporting-issues). This repository is not currently
accepting external code contributions; see
[`CONTRIBUTING.md`](CONTRIBUTING.md) for details.
> **Authorized use only.** Run scans only against code you own or have explicit
> permission to test. Findings and fixes are LLM-generated triage candidates
> that require human review — see [Limitations](#limitations-read-before-you-trust-output).
>
> **Data egress warning.** Any role routed to `via: cli`, `via: sdk`,
> `via: openai`, or `via: deepagents` sends prompt data to that model provider
> endpoint (Anthropic/OpenAI or your configurExcerpt of 20,255 characters
Read on GitHub
16
3
2
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:0f11108e48801c0d, name:agentic, desc:agentic