剑庭安
首页
黑客安全首页全部安全栏目 黑客技术黑客技术、渗透测试、漏洞利用工具与教程 安全软件安全工具、扫描器、检测与审计软件 病毒分析恶意软件分析、样本、逆向与沙箱 CTF思路CTF 题目、writeup、解题思路与工具 防护思路防御技术、加固、检测响应与蓝队 红蓝攻防红队攻击模拟、蓝队对抗、攻防演练 漏洞知识库漏洞、CVE、PoC、EXP 与安全研究
逆向|反编译
PHP源码PHP 网站源码、程序、系统 APP源码安卓/iOS APP 源码 ASP源码ASP 网站源码与程序 NET源码.NET 网站源码与系统 小程序源码微信/支付宝小程序源码 Dedecms风格模板Dedecms 织梦风格模板 Empirecms风格模板EmpireCMS 帝国风格模板 Discuz商业模板/插件Discuz 商业模板与插件 WordPress主题/插件WordPress 主题与插件 其它源码、模板其它各类源码与模板 游戏源码游戏源码与引擎项目 加密货币源码加密货币、区块链、钱包、USDT/比特币相关源码与工具 手游源码手机游戏源码、服务端、客户端与引擎项目 传奇源码热血传奇、传奇世界、复古传奇等客户端/服务端/引擎源码 页游源码网页游戏、H5 游戏、浏览器游戏源码 端游源码电脑单机游戏、PC 网游客户端/服务端源码
最新万能免驱动支持所有型号打印机下载程序 日历天气老黄历 · 每天同步真实日期与天气
站长工具站长工具 自助开通会员浏览该分类 其他资源qtziy SEO工具SEO工具 站群源码站群源码 泛程序泛程序 蜘蛛模板蜘蛛模板 蜘蛛池蜘蛛池 外链工具外链工具
搜索 自助开通会员🔓 破甲 API
登录 注册
首页 分类列表 安全软件 awesome-ai-security-tools - …
awesome-ai-security-tools - A curated list of public-source, research, and com 安全软件 点击放大
作者：admin 发布：2026-10-05

awesome-ai-security-tools - A curated list of public-source, research, and com

项目说明Awesome AI Security Tools ![Awesome]()> A curated list of public-source, research, and commercial tools for AI security and AI-assisted cyberse…
资源可下载 免费下载 0 条讨论
会员资源
开通会员后即可下载全部资源。
登录后开通会员
会员方案
481浏览量
0讨论
2下载链接
可下载资源状态
内容可验证
更新 2026-10-05
人工审核发布
评论区答疑

awesome-ai-security-tools - A curated list of public-source, research, and com

项目说明

Awesome AI Security Tools ![Awesome]()

> A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-dri, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.

![License: CC0-1.0]()
![PRs Welcome](#contributing)

Type legend: 🟢 public source / open-source · 🔬 research (paper / benchmark / dataset / framework) · 🟠 commercial with open components · ⚠️ restricti, or unclear/no license — check before use.

GitHub-hosted entries show static ★ stars and last-commit snapshots; refresh them with python3 scripts/update_github_metrics.py before release. Most recently refreshed entry: 2026-10-05. Hugging Face model entries show license, access, and artifact metadata. Ordering within a section favors flagship and actively maintained projects.

---

Contents

  • Autotriage of Security Findings

  • AI Agent & Coding-Agent Security

    • - Scanners & Auditors
    - Frameworks, Rule Standards & Benchmarks
    - Runtime Protection & Enforcement
  • AI/ML Supply Chain & Model Security

  • Pentest & Red-Team Agents

  • AI-Powered Recon & Narrow ML Tools

    • - Subdomain & DNS Prediction
    - Recon Screenshot Triage
    - Software / Tech Fingerprinting
    - AI-Assisted Fuzzing
    - Password / Credential ML
    - Phishing Detection ( / URL)
    - AI/ML-Assisted Detection Rules & Engines
    - Defensi Detectors
  • AI-Powered SAST & Secure Code Review

  • AI-Powered Threat Modeling

  • LLM-Dri

    • - Harness / target generation
    - Fuzzing the LLM
  • Threat Intelligence

  • Log Analysis / SIEM / SOC Triage

  • Reverse Engineering

  • LLM Red-Teaming & Guardrails

    • - Scanners, Evals & Guardrails
    - Prompt-Injection Classifier Models
    - Specialty Security LLMs
  • LLM Honeypots & Deception

  • CTF / Exploit / Bug-Bounty Agents & Benchmarks

  • Cloud / IaC / DFIR / OSINT / Phishing

  • Related Awesome Lists

  • Contributing

  • Contact

  • License

    • ---

    Autotriage of Security Findings

    AI/LLM tools that triage, deduplicate, prioritize, or the output of scanners and finding sources.

  • Metis 🟢 — Security-review framework that triages external SARIF findings using source-na e, optional C/C++ code graphs, and structured LLM decisions. *(Arm)* Caveat: hosted pro recei source and e and require credentials; local pro need separately pro weights, and indexing may use a separate embedding provider. Debug traces can contain sensiti. Model are not proof of exploitability or grounds for automatic suppression. *(★ 872 · updated 2026-09-30)*

  • nuclei-autotriage 🟢⚠️ — Two-stage LLM triage (falsifier + red-team pass) of Nuclei JSONL findings endpoints (vLLM/Ollama). *(CyberOK)* — note: restricti/non-commercial EULA, not a permissive OSS license. *(★ 1 · updated 2026-05-25)*

    • - Related: agent-audit · asamm
  • seclab-taskflow-agent 🟢 — YAML-dri agent framework for triaging CodeQL/SAST alerts and filtering false positives. *(GitHub Security Lab)* *(★ 221 · updated 2026-08-17)*

    • - Related: SigmaOptimizer
  • honeyslop 🟢 — Code-canary decoys to triage AI-hallucinated ("slop") reports flooding bug-bounty programs. *(★ 97 · updated 2026-05-20)*

  • nano-analyzer 🟢🔬 — Minimal three-stage LLM pipeline (context → scan → skeptical triage) for zero-day discovery in C/C++. *(AISLE)* *(★ 307 · updated 2026-04-14)*

  • SigmaOptimizer 🟢 — Generates, tests, and refines Sigma rules from real logs with false-positi. *(★ 11 · updated 2025-08-01)*

    • - Related: soctalk · seclab-taskflow-agent
  • ai-soc-triage-assistant 🟢⚠️ — SOC alert triage assistant with prompt-injection guardrails, output , and MITRE ATT&CK mapping. *(★ 0 · updated 2026-02-23)*

    • > See also: OpenAI's *Aardvark* research preview — public references exist, but there is no standalone installable repository to badge here.

    ---

    AI Agent & Coding-Agent Security

    Securing the AI agents themselves — auditing coding agents (Claude Code, Codex, OpenClaw), scanning skills / plugins / MCP manifests, and go for agentic de. A fast-moving 2026 category, split below by role.

    Scanners & Auditors

  • Guardana 🟢 — AI artifacts, li checks, and recorded agent traces, including e of unapproved side effects, outside the request path. Caveat: beta; trace checks depend on complete, trustworthy e and do not enforce tool calls. Built-in artifact checks are local, while acti contact configured targets and optional collectors recei. Not a general SAST scanner or compliance certification. *(★ 145 · updated 2026-10-05)*

  • agent-audit 🟢 — Forensic auditor for local AI coding agents (Claude Code, Codex CLI, OpenClaw) and project-surface scanner for repos shipping skills, plugins, and MCP manifests; 296 bundled rules across native + imported detector families, with optional LLM cross-. *(CyberOK / S. Gordeychik)* *(★ 15 · updated 2026-07-15)*

    • - Sources: asamm · ATR – Agent Threat Rules · aguara · Cisco AI Defense – skill-scanner
    - Related: asamm · aguara · agentguard · agentic-radar · nuclei-autotriage
  • AI-Infra-Guard 🟢 — Full-stack AI red-teaming platform co OpenClaw security scan, agent scan, skills scan, MCP scan, AI-infra scan, and LLM jailbreak e. *(Tencent Zhuque Lab)* *(★ 6,226 · updated 2026-09-10)*

    • - Related: agent-audit · aguara · Cisco AI Defense – skill-scanner · Cisco AI Defense – mcp-scanner
  • SkillSpector 🟢 — Security scanner for AI-agent skills used by Claude Code, Codex CLI, Gemini CLI, and similar ecosystems; combines static analysis, AST/YARA/taint checks, optional LLM semantic review, MCP least-pri/tool-poisoning checks, risk scoring, and SARIF/JSON/Markdown output. *(NVIDIA)* *(★ 14,696 · updated 2026-08-15)*

    • - Related: Cisco AI Defense – skill-scanner · skilltotal · Snyk Agent Scan · Cisco AI Defense – mcp-scanner
  • Ramparts 🟢 — Rust scanner for MCP servers and agent-skill bundles with YARA rules, optional LLM analysis, OSV/C, OWASP MCP Top 10 mapping, and SARIF/JSON/Markdown reports. *(★ 96 · updated 2026-08-07)*

    • - Related: SkillSpector · Cisco AI Defense – skill-scanner · Cisco AI Defense – mcp-scanner
  • lintlang 🟢 — Local deterministic linter for AI-agent instructions, tool definitions, and system prompts that flags ambiguous descriptions, missing limits, conflicting directives, and schema gaps, with CLI and SARIF output. — note: heuristic static instruction/config review only; not runtime enforcement, prompt-injection detection, semantic-correctness proof, or a security guarantee. *(★ 134 · updated 2026-10-02)*

    • - Related: little-canary · rule-audit
  • mcp-armor 🟢 — Local MCP security scanner with auto-discovery for agentic IDE configs, tool/resource/prompt in, prompt-injection checks, rug-pull and tool-poisoning detection, baseline drift monitoring, and JSON/Markdown reports. *(Aira Security)* *(★ 120 · updated 2026-03-27)*

    • - Related: SkillSpector · Ramparts · Cisco AI Defense – mcp-scanner
  • aguara 🟢 — Single-binary static scanner (Go, no LLM) for AI-agent skills and MCP servers; multi-layer engine (pattern + NLP + taint tracking + rug-pull detection). Companion aguara-mcp exposes scanning as an MCP tool. *(★ 86 · updated 2026-08-12)*

    • - Related: aguara-mcp · agent-audit · Snyk Agent Scan · Cisco AI Defense – skill-scanner
  • agent-scan 🟢 — Security scanner for AI agents, MCP servers, and agent skills; the successor path for the original In Labs mcp-scan work. *(Snyk)* *(★ 2,913 · updated 2026-08-13)*

    • - Related: aguara · Cisco AI Defense – mcp-scanner · Cisco AI Defense – skill-scanner
  • inkog 🟠 — Commercial-backed static security scanner for AI agents across LangChain, LangGraph, CrewAI, AutoGen, and no-code workflows; Apache-2.0 CLI with proprietary deep-scan engine. *(Inkog)* *(★ 28 · updated 2026-06-07)*

    • - Related: Snyk Agent Scan · agentic-radar
  • AgentShield 🟢 — Security scanner for AI-agent configurations, MCP servers, hooks, and tool permissions with CLI, GitHub Action, and app workflows. *(★ 1,070 · updated 2026-07-22)*

    • - Related: agent-audit · Snyk Agent Scan
  • repo-forensics 🟢⚠️ — Offline scanner for AI-agent repos, skills, plugins, and MCP servers; license is PolyForm Noncommercial. *(★ 155 · updated 2026-08-08)*

    • - Related: agent-audit · aguara
  • skill-scanner 🟠 — Scanner for agent skills combining YAML + YARA patterns, LLM-as-a-judge, and beha dataflow analysis (Codex / Cursor skill formats). *(Cisco AI Defense)* *(★ 2,440 · updated 2026-08-04)*

    • - Related: defenseclaw · aguara · Cisco AI Defense – mcp-scanner
  • mcp-scanner 🟢⚠️ — Scanner for MCP servers and agentic tool surfaces, co tools, prompts, resources, package risk, malware indicators, and deployment readiness. *(Cisco AI Defense)* *(★ 1,037 · updated 2026-08-07)*

    • - Related: Cisco AI Defense – skill-scanner · Snyk Agent Scan · aguara
  • mcp-guardian 🟢 — JS/TS library and CLI for detecting prompt injection in MCP tool descriptions and pinning tool definitions. *(★ 6 · updated 2026-07-29)*

    • - Related: Cisco AI Defense – mcp-scanner · Snyk Agent Scan
  • MCP Obser 🟢🟠 — CI-nati testing tool for schema drift, safe attack simulation, record/replay , health scoring, and SARIF e before agents depend on a server. *(KryptosAI)* — note: the local e engine is open source; hosted telemetry intelligence, fleet workflows, and commercial ranking remain outside the package. *(★ 176 · updated 2026-08-15)*

    • - Related: Cisco AI Defense – mcp-scanner · skilltotal
  • agentic-radar 🟠 — CLI security scanner for agentic workflows (LangGraph, CrewAI, n8n, etc.) — maps tools/data flows and flags risks. *(SplxAI)* *(★ 1,036 · updated 2025-11-27)*

  • skilltotal 🟢 — Offline deterministic static scanner (regex + AST, no LLM, no account) for AI components — agent skills/plugins, MCP servers, npm & PyPI packages, and git repos; flags supply-chain risk, dangerous capabilities, prompt-injection surfaces, MCP tool poisoning/shadowing, and data-exfiltration paths, maps to the OWASP Agentic Skills Top 10, and emits JSON + SARIF 2.1.0. *(skilltotal.ai)* *(★ 1 · updated 2026-08-17)*

    • - Related: aguara · Snyk Agent Scan · Cisco AI Defense – skill-scanner · Cisco AI Defense – mcp-scanner
  • Sunglasses 🟢 — Local input/content scanner for AI agents that checks prompts, files, media metadata, skills, and tool descriptions against pattern and mechanism-based prompt-injection, exfiltration, command-injection, and agent-threat rules. — note: early-stage project; published precision/recall benchmark is self-reported by the project. *(★ 4 · updated 2026-08-14)*

    • - Related: skilltotal · Armorer Guard
  • trentclaw 🟠 — Client-side security auditor for OpenClaw deployments: applies pattern-based secret redaction locally, then uploads config/skill metadata and confirm-gated skill archives to Trent AI's API, which identifies misconfigurations, risky skills (prompt injection, permission escalation, data exfiltration), and chained attack paths. *(Trent AI)* — note: core detection runs ser via the Trent AI API (requires an API key); the Apache-2.0 client collects OpenClaw config/skill metadata, applies pattern-based secret redaction locally, and uploads skill archives only after an explicit in-terminal confirmation. *(★ 23 · updated 2026-07-27)*

  • A2A Security Scanner 🟢 — CLI and PyPI scanner for Agent-to-Agent (A2A) agent cards, source code, registries, and li using specification , YARA rules, heuristics, endpoint testing, and an optional LLM analyzer. *(Cisco AI Defense)* *(★ 163 · updated 2026-04-16)*

    • - Related: Cisco AI Defense – mcp-scanner · Agent Threat Rules
  • Ship Safe 🟢🟠 — Local security CLI for application code, AI-agent and MCP configuration, secrets, dependencies, CI, and cloud/IaC surfaces, with deterministic checks, optional AI-assisted analysis, and SARIF output. — note: the MIT CLI works without an account for its core checks; optional AI modes can send selected context to the configured provider, while hosted dashboards and organization workflows are separate commercial features. Co and benchmark figures are project-reported. *(★ 827 · updated 2026-08-24)*

    • - Related: SkillTotal · agent-audit
  • AgentSeal 🟠⚠️ — Agent-security CLI and runtime library for scanning MCP servers, skills, prompts, and configuration, plus local guard and monitoring workflows with optional model-assisted red teaming. — note: source-a under FSL-1.1-Apache-2.0 rather than an OSI-appro license; offline guard and MCP/skill scanning are a locally, while red-team modes require local Ollama or configured provider credentials. Catalog and co figures are project-reported. *(★ 343 · updated 2026-06-11)*

    • - Related: agent-scan · AgentLock
  • SlowMist Agent Security 🟢 — Security-review skill and workflow for auditing agent skills, MCP servers, repositories, URLs, and documents before installation or use. *(SlowMist)* — note: Markdown-based workflow skill executed by a compatible host agent, not a deterministic standalone scanner; findings depend on the selected model and its a tools. *(★ 502 · updated 2026-04-17)*

    • - Related: MCP-Security-Checklist · sast-skills
  • Sandbox Probe 🟢 — Static Go probe that measures the effecti, network, process, credential, and runtime capabilities exposed inside an AI-agent sandbox, then compares sandbox and host baselines. *(ControlPlane)* — note: boundary-measurement auditor, not an enforcement layer; some integration scripts can ask real agents to execute the probe, while deterministic model-free stubs are a for CI. *(★ 25 · updated 2026-08-25)*

    • - Related: Sandlock · AIO Sandbox

    Frameworks, Rule Standards & Benchmarks

  • RepoGuardBench 🟢🔬 — Repository prompt-injection benchmark with coding tasks, attack carriers, defenses, and separate scoring of attack attempts, obser, and task utility. Caveat: its subprocess workspace is not an OS sandbox: allowing Python or pytest does not prevent host-file access or networking. Use a separate disposable en without secrets; marker-based outcomes and model behavior are not proof of production isolation. *(★ 70 · updated 2026-10-03)*

  • Project CodeGuard 🟢⚠️ — Model-agnostic secure-coding rules and skills framework with translators for popular coding agents, , release artifacts, and an MCP server for centrally distributing the rules. *(CoSAI / OASIS)* — note: framework and ruleset, not a deterministic scanner or runtime enforcement boundary; repository content uses CC BY 4.0 rather than a con software license. *(★ 338 · updated 2026-09-18)*

    • - Related: OWASP review skill for Claude Code (model-dependent; e may require paid API) · Cisco Foundry e specification (CC BY 4.0; no implementation code)
  • asamm 🔬 — *Agentic SAMM* — an OWASP SAMM extension for AI-dri: an entry-point-based threat taxonomy plus 17 controls across 5 SAMM functions (Go, Design, Implementation, , Operations) with L1/L2/L3 maturity. License: CC BY-SA 4.0. *(CyberOK / S. Gordeychik)* *(★ 17 · updated 2026-07-26)*

    • - Sources: OWASP SAMM · NIST AI RMF · NCSC Secure AI Guidelines · MCP Security Best Practices
    - Related: agent-audit · AI go crosswalk (expert review required; not certification) · AATMF threat-modeling reference (CC BY-SA 4.0; not an automated )
  • agent-threat-rules (ATR) 🟢 — Open, , machine-readable detection rules for AI-agent threats (prompt injection, tool poisoning, MCP attacks, and skill compromise) — "Sigma for agents"; 768 rules across 10 categories with integrations for Microsoft AGT, Cisco AI Defense, MISP, OWASP, FINOS, and SigmaHQ. *(★ 371 · updated 2026-08-17)*

    • - Related: agent-audit · aguara · Sigma-AI detection content (temporal/similarity extensions require a compatible engine)
  • Agent Go Toolkit 🟢 — Multi-language toolkit for policy-enforced agent tool calls and audit records, with optional identity, MCP-gateway, sandboxing, reliability, and compliance components. *(Microsoft)* — note: official public preview; APIs and deployment patterns may change before general a. *(★ 5,962 · updated 2026-08-12)*

    • - Related: ATR – Agent Threat Rules · ToolHive
  • MCP-Security-Checklist 🟢 — Security checklist for MCP clients, servers, multi-MCP deployments, lifecycle controls, authz/authn, isolation, and crypto-specific MCP integrations. *(SlowMist)* *(★ 835 · updated 2025-04-28)*

    • - Related: Cisco AI Defense – mcp-scanner · ATR – Agent Threat Rules · MCP security hardening and operations guidance (CC0; not deployment certification)
  • Anthropic-Cybersecurity-Skills 🟢 — Large community cybersecurity skill library for AI agents, mapped to MITRE ATT&CK, NIST CSF, MITRE ATLAS, D3FEND, and NIST AI RMF. — note: independent community project, not affiliated with Anthropic. *(★ 28,060 · updated 2026-08-08)*

    • - Related: sast-skills · Cisco AI Defense – skill-scanner
  • Claude-BugHunter 🟢 — Claude Code / agent-skill bundle for authorized bug hunting and external red-team workflows across web, API, identity, cloud, recon, reporting, Burp MCP, slash commands, and the cbh CLI. — note: skill bundle and workflow knowledge base, not a standalone scanner. *(★ 3,630 · updated 2026-08-17)*

    • - Related: sast-skills · Anthropic-Cybersecurity-Skills
  • AgentDojo 🟢🔬 — Benchmark en for prompt-injection attacks and defenses in tool-using LLM agents. *(★ 753 · updated 2026-06-02)*

    • - Related: agent-audit · ATR – Agent Threat Rules
  • Agent3Sigma-Canary 🟢🔬 — Sandboxed research framework for e AI-agent security o execution trajectories, co direct/indirect injection, skill and memory poisoning, and practical risk outcomes. *(Ant Group)* — note: research framework that requires Docker plus target and auxiliary LLM configuration; use only in controlled en. *(★ 35 · updated 2026-08-09)*

    • - Related: AgentDojo · HarmBench
  • Agent Security Bench (ASB) 🟢🔬 — Official ICLR 2025 benchmark for e attacks and defenses in LLM-based agents across ten scenarios, including direct and indirect prompt injection, memory poisoning, and defensi. — note: research benchmark rather than a production control; reproducing e requires configured target and e models. *(★ 285 · updated 2026-04-16)*

    • - Related: AgentDojo · Agent3Sigma-Canary
  • Skill-Inject 🟢🔬 — Benchmark for measuring prompt-injection carried by agent skill files across Claude Code, Codex CLI, and Gemini CLI under multiple safety-policy conditions. — note: benchmark artifact that executes controlled malicious skill scenarios; run only in an isolated test en with synthetic data and accounts. *(★ 91 · updated 2026-07-01)*

    • - Related: SkillSpector · AgentDojo
  • AI Security Standard (AISVS) 🔬⚠️ — Stable standard defining testable security requirements for AI applications across model lifecycle, supply chain, data handling, agentic systems, and MCP integrations. *(OWASP)* — note: security standard and checklist, not an executable scanner; share-alike terms apply to adapted material. *(★ 429 · updated 2026-07-30)*

    • - Related: asamm · Agent Threat Rules · GenAI data-security guidance (CC BY-SA 4.0; separate scanner not included) · OWASP LLMS documentation project; CC BY-SA 4.0)
  • OWASP Agent Security Regression Harness 🟢 — harness for running repeatable agent and MCP abuse scenarios, e policy assertions o traces, and emitting machine-readable regression results for local de and CI. *(OWASP)* — note: early OWASP Incubator project; it is a regression harness for known abuse cases, not a scanner, leaderboard, general benchmark, or guarantee of agent security. *(★ 49 · updated 2026-07-27)*

    • - Related: Agent Security Bench (ASB) · AgentDojo

    Runtime Protection & Enforcement

  • Spring MCP Security 🟢 — Spring security components for MCP authentication, JWT audience , principal-bound sessions, and transport Origin/Host checks. *(Spring AI Community)* Caveat: match library and Spring AI and the supported transport/stack combination. Operators must configure issuers, scopes, and application authorization; these controls do not detect prompt injection. *(★ 117 · updated 2026-09-20)*

    • - Related: .NET MCP OAuth/Entra/DPoP samples (configured identity provider and compatible clients required)
  • yoloAI 🟢 — Coding-agent sandbox runner with multiple backends, credential-brokering integrations, and a copy/diff/apply workflow for re workspace changes. Caveat: public beta; isolation depends on the backend and configuration. Select network isolation explicitly, avoid pri modes, and review mounts; agents without broker support recei credentials, and hosted agents still send context to their pro. *(★ 216 · updated 2026-08-21)*

  • Jailoc 🟢 — Container launcher for OpenCode with configurable workspace mounts, network/DNS policy, resource limits, and secret references. *(Seznam)* Caveat: Docker and the agent image remain trusted dependencies; extra mounts, SSH-agent forwarding, optional Docker access, and supplied credentials expand the boundary. Container configuration is not a guarantee against escape or data disclosure to model pro. *(★ 32 · updated 2026-09-24)*

  • Agent Sandbox (agentbox) 🟢 — Container-based coding-agent en with proxy-mediated egress policies and ser credential injection. Caveat: the re firewall permits the detected Docker host subnet, not only the proxy, and has no IPv6 rules; proxy enforcement is inacti enforce mode. Review IPv6, neighboring services, writable mounts, and the IDE/control plane rather than assuming complete network or host isolation. *(★ 208 · updated 2026-09-26)*

  • Crust 🟢⚠️ — Local Go gateway that extracts tool calls from supported model API responses and applies rules before forwarding them to an agent. Caveat: source-a under Elastic License 2.0, including managed-service restrictions, not a permissive OSS license. Only intercepted supported paths are covered; parse failures can pass the original body through. The sample forwards to OpenRouter, disables local telemetry, and leaves the storage encryption key empty; review provider disclosure and any enabled local records. *(★ 440 · updated 2026-03-30)*

  • Agent Safehouse 🟢 — macOS launcher that assembles Seatbelt sandbox-exec profiles to scope coding agents' filesystem and integration access. Caveat: macOS-only hardening, not a VM or prompt-injection detector. The default profile permits inbound and outbound networking; exfiltration pre is explicitly out of scope. Granted workspaces and integrations remain accessible, and launched agents retain their own credential, billing, and network behavior. *(★ 2,092 · updated 2026-09-30)*

  • OpenShell 🟢 — Policy-go runtime for autonomous and coding agents with container or micro sandboxes, filesystem/process/network controls, endpoint-bound credential injection, and audit logs. *(NVIDIA)* — note: pre-release runtime whose effecti depends on the selected compute driver and policy; Kubernetes and GPU paths are experimental. Anonymous operational telemetry is enabled by default but can be disabled at deployment time or compiled out. *(★ 8,715 · updated 2026-09-21)*

    • - Sources: NVIDIA agent-stack security model
  • Numbat 🟢 — Endpoint-local and detection for AI-agent activity across hooks, plugins, OTLP, and on-disk artifacts, with CEL rules, multi-step sequence detections, and forensic reconstruction. *(Perplexity AI)* — note: monitoring is the default posture; blocking is opt-in, limited to supported synchronous pre-action hooks, and the shipped rules are monitor-only until operators explicitly configure enforcement. *(★ 1,069 · updated 2026-09-15)*

  • agentsh 🟢 — Execution-layer policy shell for AI agents that intercepts file, network, process, signal, and selected database activity and emits structured audit events. *(Canyon Road)* — note: the shell shim bypasses policy for non-TTY stdin unless --force is used, which is critical for headless agents and CI. Linux is the production target; nati enforcement is alpha and nati drivers are not yet production-ready. *(★ 385 · updated 2026-09-15)*

  • brood-box 🟢 — Experimental runner for coding agents in hardware-isolated microVMs with copy-on-write workspace snapshots, egress profiles, selecti forwarding, and file-by-file review before applying changes. *(Stacklok)* — note: APIs and behavior are explicitly experimental; workspace-mode=direct bypasses snapshot isolation and writes directly to the workspace, so it is suitable only for already-trusted interactive work. *(★ 72 · updated 2026-09-18)*

  • Greywall 🟢 — Kernel-enforced filesystem, network, syscall, and command-policy wrapper for coding agents on Linux and macOS, with a separate traffic-obser mode and least-pri profile generation. *(Greyhaven)* — note: deny-by-default applies to greywall; greywatch is intentionally permissive and records rather than blocks activity. the effecti backend and selected mode before treating it as an enforcement boundary. *(★ 298 · updated 2026-08-13)*

  • nono 🟢 — Least-pri sandbox for AI coding agents that isolates the agent and delegated tools with composable filesystem, network, credential-proxy, and command policies. *(NoLabs)* — note: APIs are still stabilizing ahead of the 1.0 release; review every pulled profile before use. *(★ 3,687 · updated 2026-08-17)*

    • - Related: microsandbox · ToolHive
  • Coi 🟢 — Incus-based session manager for coding agents with protected workspace mounts, configurable network policy, optional host-side monitoring, and persistent or ephemeral Linux containers. — note: shared-kernel containers are not a micro; workspace writes reach the host and configured credentials can be copied into the container. Default restricted networking allows public-internet egress and monitoring is off. The hardened profile enables monitoring and reduces kernel attack surface, but is not a general exfiltration or hostile-agent containment guarantee. *(★ 733 · updated 2026-10-02)*

    • - Sources: Containment threat model · Re defaults
  • cplt 🟢 — Kernel-backed sandbox wrapper for AI coding agents that applies Seatbelt on macOS or Landlock and seccomp on Linux, content-pins approvals for repository policy, filters en and resource access, and gates selected git and GitHub commands. *(NA Labour and Welfare Administration))* — note: no nati backend; the standard posture permits outbound HTTPS on port 443 and warns rather than blocks git push, while stricter egress and push blocking require explicit configuration. Linux has documented limitations around Git metadata, localhost, and SSH-agent isolation, so review the threat model and effecti for the target platform. *(★ 114 · updated 2026-09-06)*

    • - Related: nono · microsandbox
  • Arcjet Guard 🟢🟠 — Ja runtime guard for AI-agent tool calls and MCP handlers, with prompt-injection detection, sensiti detection/redaction, and custom local policy rules. *(Arcjet)* — note: open SDK packages integrate with Arcjet's hosted platform; assess the service, account, and data-processing requirements for the protections you enable. *(★ 681 · updated 2026-08-15)*

    • - Related: LLM Guard · AgentLock · Arcjet Python SDK (hosted rules send inputs, require key; core fail-open, helpers fail-closed; configure tool co)
  • ToolHive 🟢 — Platform for running MCP servers in isolated containers with per-request identity/access policy, registry and gateway workflows, audit logs, Kubernetes operator support, and obser hooks. *(Stacklok)* *(★ 2,019 · updated 2026-08-14)*

    • - Related: microsandbox · defenseclaw
  • Pipelock 🟢 — AI-agent firewall and egress-control layer mediating HTTP, WebSocket, CONNECT, MCP, and A2A traffic to detect prompt injection, secret exfiltration, SSRF, and suspicious outbound actions. — note: open-source core is Apache-2.0; commercial reporting/features are also ad. *(★ 796 · updated 2026-08-17)*

    • - Related: ToolHive · mcp-context-protector
  • node9 🟢 — Local policy and human-approval gate for supported coding-agent tool calls routed through agent hooks or an MCP wrapper, with credential-path checks, secret detection, and audit logging. *(Node9)* — note: cooperati/MCP enforcement, not process isolation or a complete credential boundary; scripts are judged by their command line rather than their contents, and the egress allowlist is opt-in. Local use needs no account; optional hosted team features can transmit operational data. node9 init asks before sending an install ping, with Yes preselected; the payload includes a persistent machine ID, detected agents, OS, and , so it is pseudonymous rather than anonymous. *(★ 216 · updated 2026-09-27)*

    • - Related: Pipelock · agentsh
  • SourceryKit 🟠⚠️ — Python SDK for agent guardrails that intercepts outbound HTTP calls, enforces trusted-endpoint policies, logs requests, and checks agent handoff claims against a Provably backend before propagation. *(Pro)* — note: BSL-1.1 licensed; requires Provably backend/API credentials and database setup. *(★ 18 · updated 2026-08-12)*

    • - Related: Pipelock · mcp-context-protector
  • emisar 🟠⚠️ — Agent-infrastructure control plane that exposes declared, typed actions through MCP, applies policy and appro before dispatch, re calls on an outbound-only host runner, and records separate control-plane and host audit trails. — note: runner, MCP bridge, and packs are Apache-2.0; the hosted portal/control plane is BSL-1.1 and converts to Apache-2.0 on 2029-07-26. Connecting a runner requires an emisar account and outbound HTTPS to the control plane. *(★ 416 · updated 2026-08-17)*

  • mcp-context-protector 🟢 — MCP security wrapper that sits in front of downstream MCP servers, scans tool responses with guardrail pro, and supports quarantine/review workflows for desktop and coding-agent MCP configs. *(Trail of Bits)* *(★ 222 · updated 2026-02-13)*

    • - Related: Cisco AI Defense – mcp-scanner · ToolHive · Pipelock
  • MCP Defender 🟢⚠️ — Desktop app that proxies MCP tool-call requests and responses for Cursor, Claude, VS Code, and Windsurf, checks intercepted traffic against signatures, and prompts users to allow or block suspicious calls. — note: AGPL-3.0 licensed; project has been acquired by Docker. *(★ 255 · updated 2026-06-05)*

    • - Related: ToolHive · mcp-context-protector
  • MCP Gateway 🟢 — Plugin-based MCP gateway that proxies configured MCP servers, sanitizes sensiti/response data, supports guardrail plugins such as basic masking and Presidio, and runs a ser/risk check before loading MCP servers. *(Lasso Security)* *(★ 385 · updated 2026-01-22)*

    • - Related: ToolHive · Pipelock · mcp-context-protector · Claude PostToolUse hook sample (pattern warnings; not isolation or guaranteed context cleanup)
  • Parallax 🟢 — Rust runtime policy engine for AI agents: e lifecycle events with regex, keyword, Sigma, CEL, and SQL rules to block or redact prompt injection, data exfiltration, dangerous tool calls, and secret leakage. — note: early-stage project with limited adoption signal. *(★ 35 · updated 2026-06-05)*

    • - Related: Pipelock · Armorer Guard
  • Armorer Guard 🟢 — Local Rust scanner and MCP proxy for AI-agent prompt injection, credential leakage, exfiltration, and risky tool-call arguments, with structured reasons and no scanner network calls. — note: young project with limited independent adoption signal. *(★ 42 · updated 2026-08-09)*

    • - Related: agentguard · ATR – Agent Threat Rules
  • onecli 🟢 — Credential gateway and encrypted vault for AI agents; injects real API credentials at the gateway so agents only see placeholder keys. *(★ 3,104 · updated 2026-07-31)*

    • - Related: agentguard · defenseclaw
  • microsandbox 🟢 — Local-first, micro programmable sandboxes for AI agents with SDKs, CLI, MCP support, and rootless hardware isolation. *(★ 7,569 · updated 2026-08-17)*

    • - Related: agentguard · defenseclaw · agents-sandbox launcher for microsandbox (GPL-3.0)
  • agentguard 🟢 — Real-time security layer for coding agents: hooks scan every new skill, block dangerous actions before execution, run daily posture patrols, and track which skill triggered each action (incl. Web3-specific checks). *(★ 456 · updated 2026-06-25)*

    • - Related: agent-audit · defenseclaw
  • AgentAegis 🟢 — OpenClaw security plugin that observes or blocks selected prompt, tool-call, memory, exfiltration, and protected-path risks through configurable agent lifecycle hooks. *(Ant Group)* — note: the code defaults blocking defenses to enforce; the README's observe configuration is an optional staged-rollout example. Co depends on enabled hooks, modes, and protected assets; this is OpenClaw-specific defense in depth, not a general sandbox or injection-proof boundary, and published effecti demonstrations are project-operated. *(★ 199 · updated 2026-06-26)*

    • - Sources: Configuration defaults
  • defenseclaw 🟠 — Enforcement and e layer for agentic deployments: static CodeGuard checks, sandboxing, registry ingestion with SSRF guards, and audit/obser. *(Cisco AI Defense)* *(★ 819 · updated 2026-08-17)*

    • - Related: Cisco AI Defense – skill-scanner · agentguard
  • clawsec 🟢⚠️ — Security skill suite for OpenClaw-family agents; AGPL-3.0 licensed. *(Prompt Security)* *(★ 1,083 · updated 2026-08-05)*

    • - Related: agentguard · Cisco AI Defense – skill-scanner
  • AgentLock 🟢🔬⚠️ — Pre-action authorization gate for LLM agent tool calls that decides from session pro rather than content, with deny-by-default tool permissions, parameter lineage, Ed25519 signed receipts, and a hash-chained audit log; AGPL-3.0 licensed with commercial options. — note: e on AgentDojo with predictions pre-registered before the runs; the published results include a suite where the defense costs more utility than the attack it prevents. *(★ 19 · updated 2026-08-12)*

  • h5i 🟢 — Local Rust CLI for auditable coding-agent workspaces: per-agent worktrees with sandbox policies, pro capture, peer review, neutral , secret/prompt-injection audit signals, and refs/h5i/* run metadata. — note: security-adjacent agent-workspace go tool, not a scanner or sandbox. *(★ 531 · updated 2026-08-16)*

    • - Related: microsandbox · defenseclaw
  • D 🟢 — Local-first AI coding agent with runtime go controls: org/repo policy gates for tools, models, MCP servers, paths, and commands, plus provider/shell/MCP egress controls and hash-chained audit logs. — note: young project with limited independent adoption signal. *(★ 112 · updated 2026-08-17)*

    • - Related: h5i · Pipelock · Armorer Guard
  • TAP 🟢🟠 — Credential-isolation proxy and MCP server for AI agents: agents send placeholder credentials, TAP injects real secrets ser after per-action policy checks, with optional human approval on sensiti. *(human.tech)* — note: Apache-2.0 runtime is self-hostable, but the hosted dashboard and managed-service deployment glue are proprietary; self-hosting puts credential/key isolation and policy-engine hardening on the operator. *(★ 12 · updated 2026-07-23)*

  • Agent Memory Guard 🟢 — Runtime middleware for AI-agent memory reads and writes, screening prompt injection, memory poisoning, secret/PII leakage, protected-key tampering, and size anomalies before persisted memory is reused. *(OWASP)* — note: OWASP Incubator project; published benchmark numbers are project-reported and should be independently reproduced before production enforcement. *(★ 125 · updated 2026-08-16)*

  • AIO Sandbox 🟢⚠️ — All-in-one Docker workspace for AI agents with browser, shell, file, code-execution, MCP, and interfaces, plus API-key/JWT controls and pri guidance. — note: the public repository ships SDKs, integrations, and docs rather than the core runtime service; official Chromium-enabled deployments use seccomp=unconfined. Treat it as a trusted execution en, not a hardened isolation boundary; use separate VMs or a hardened runtime plus network policy for hostile workloads. *(★ 5,727 · updated 2026-08-17)*

    • - Related: Kubernetes Agent Sandbox · microsandbox · EdgeBox desktop sandbox (GPL-3.0; README recommends a successor; escape resistance un) · Ephemeral cooperati isolation (shared sandbox/provider trust; not hostile-tenant containment)
  • Agentgateway 🟢 — Agent-nati and gateway for MCP and A2A traffic with OAuth/JWT/API-key authentication, CEL-based RBAC policies, TLS, rate limiting, and OpenTelemetry obser. *(★ 4,385 · updated 2026-08-14)*

    • - Related: MCP Gateway · Pipelock
  • Kubernetes Agent Sandbox 🟢 — Kubernetes CRDs and controllers for isolated, stateful singleton agent workloads, delegating low-le to configured runtimes such as gVisor or Kata Containers. *(Kubernetes SIG Apps)* — note: sandbox orchestrator, not an isolation runtime itself; security depends on the selected RuntimeClass, network policy, and workload configuration. *(★ 3,544 · updated 2026-08-16)*

    • - Sources: Kubernetes announcement
    - Related: AIO Sandbox
  • Prismor 🟢 — Self-hosted runtime control plane for coding agents with pre-tool-call hooks, policy-dri/appro decisions, an MCP gateway, secret and egress controls, and tamper-e audit e. *(★ 291 · updated 2026-08-16)*

    • - Related: Armorer Guard · AgentLock
  • Gram 🟢🟠⚠️ — Open-source stack behind Speakeasy's AI control plane that centrally manages MCPs, Skills, and Assistants with granular permissions, policy enforcement, threat detection, and obser. *(Speakeasy)* — note: AGPL-3.0 copyleft license; Gram is also a as Speakeasy's hosted commercial control plane, while local de uses a full Docker/Mise stack. *(★ 266 · updated 2026-09-09)*

  • tirith 🟢⚠️ — Terminal guard for de and AI coding agents that intercepts homograph and terminal-injection tricks, obfuscated execution chains, pipe-to-shell patterns, credential exfiltration, and malicious skill/config files. — note: AGPL-3.0 with a separate commercial license; shell interception is a host-side guard, not a substitute for sandboxing or least-pri tool access. *(★ 2,664 · updated 2026-08-13)*

    • - Related: nono · gate.cat
  • ADR 🟢🔬 — Agentic AI Detection and Response system combining cross-client agent telemetry, ADR-Bench security scenarios, and a dual-agent detector for suspicious intent, tool use, and execution traces. *(Uber)* — note: deployed at Uber and published with an MLSys 2026 paper; the open release includes the Sensor, benchmark, and Detector, but not ADR Pre or the offline ADR Explorer. Default detector configurations require model-provider credentials. *(★ 1,442 · updated 2026-08-16)*

    • - Related: Pipelock · AgentLock
  • xaidr 🟢 — In-process runtime security sensor for AI agents that inspects input, tool calls, output, and agent-to-agent en inside the agent process, with structured shell-command classification, YAML policy, pri tiers, an opt-in circuit breaker, and OpenTelemetry export. *(Delphi Security)* — note: early-stage in-process sensor, not an isolation boundary; monitor mode is the default and unexpected scan failures fail open while emitting degraded telemetry. Published detection and false-positi are project-reported on its committed corpus. *(★ 22 · updated 2026-08-17)*

    • - Related: agentguard · defenseclaw
  • Agentmetry 🟢 — Local-first flight recorder for AI coding agents and MCP servers that writes a hash-chained JSONL trail with RFC 6962 Merkle roots, applies MITRE-mapped sequence detection across a session, attests every 300s which agent surfaces are covered, uncovered, absent or unknown, and forwards to Splunk HEC, Elastic ECS, Google SecOps UDM or CloudEvents. — note: young project with limited independent adoption signal; it records and detects rather than blocks, and its README states that hooks are cooperative and that tamper-e is not the same as attributable. *(★ 12 · updated 2026-08-24)*

    • - Related: HOL Guard · ADR
  • piighost 🟢 — Local runtime pseudonymization layer that replaces detected PII with stable placeholders before model calls and restores the original in responses and selected tool arguments, with integrations for LangChain, Pydantic AI, LlamaIndex, and OpenAI-compatible clients. — note: re de-identification, not anonymization; the placeholder mapping remains sensiti tool arguments can contain the original PII, and optional LLM-backed detectors may send content to the configured model provider. *(★ 11 · updated 2026-08-23)*

    • - Related: Kiji · onecli
  • HOL Guard 🟢🟠 — Local-first runtime security layer for coding agents that e commands, package installs, skills, MCP configuration, and sensiti through policy, approval, e, and audit workflows. *(Hashgraph Online)* — note: integrations are cooperati rather than a hard isolation boundary, and documented hook failures can fail open; synchronized e, team policy, and fleet workflows use the optional hosted service. *(★ 466 · updated 2026-08-24)*

    • - Related: emisar · Prismor
  • StackOne Defender 🟢 — Offline TypeScript runtime guard for indirect prompt injection in tool results, using bundled ONNX classifiers, deterministic checks, sanitization, and allow/block . *(StackOne)* — note: blocking high-risk results is opt-in by default; missing Tier-2 dependencies can fall back to simpler Tier-1 detection unless strict mode is enabled, so configure fail behavior explicitly for enforcement use. *(★ 117 · updated 2026-08-19)*

    • - Related: LLM Guard · little-canary
  • Earl 🟢 — Capability proxy for AI agents that exposes appro names while keeping request templates and credentials outside the model, with HCL policy, audit, and egress controls. *(Mathematic)* — note: operation templates and policy configuration form part of the trusted boundary and require review; the proxy reduces credential and request-construction exposure but is not a sandbox for the agent process. *(★ 113 · updated 2026-08-23)*

    • - Related: onecli · agentgateway
  • Bifrost 🟢🟠 — Apache-licensed AI and MCP gateway with multi-provider routing, access controls, budgets, rate limits, MCP aggregation, OAuth, automatic fallbacks, and load balancing. *(Maxim)* — note: model-provider credentials and proxied request/response data are sensiti and authenticate the gateway and admin interface, use TLS, and load only trusted plugins. Content guardrails, RBAC/SSO, clustering, and other ad go controls require Bifrost Enterprise. *(★ 7,548 · updated 2026-08-25)*

    • - Related: Portkey AI Gateway · Agentgateway
  • Portkey AI Gateway 🟢🟠 — Open AI gateway with provider routing, fallback and retry controls, guardrail integrations, obser, and MCP traffic support for model and agent applications. *(Portkey)* — note: the gateway is general infrastructure rather than a standalone security scanner; model-provider credentials are required, and some RBAC, analytics, and managed control-plane capabilities belong to Portkey's hosted or enterprise products. *(★ 12,815 · updated 2026-05-25)*

    • - Related: agentgateway · Pipelock
  • Casbin AI Gateway 🟢 — Local gateway and policy layer for model-provider and MCP traffic, combining pro mediation, access control, prompt records, and configurable request handling. *(Apache Casbin)* — note: binds to localhost by default because its local UI can exercise administrati and the relay can access stored provider keys; do not expose it beyond a trusted host without adding authentication and re prompt-recording settings. *(★ 570 · updated 2026-08-24)*

    • - Related: agentgateway · Portkey AI Gateway
  • Adrian 🟢🟠 — Runtime monitoring and inter layer that correlates agent actions with a reasoning traces through Python and TypeScript SDKs, a Claude Code integration, and managed or self-hosted deployments. *(Secure Agentics)* — note: the bundled self-hosted stack requires Docker, substantial disk space, and an NVIDIA GPU for the recommended local classifier; the README's +35% and 4x headline extrapolates cited third-party research rather than an Adrian benchmark. *(★ 552 · updated 2026-08-20)*

    • - Related: Agentic Radar · Armorer Guard
  • Sandlock 🟢 — Unpri Linux process sandbox using Landlock, seccomp-BPF, and seccomp user notification to apply per-process filesystem, network, syscall, and execution policies without a container or VM. *(Multikernel)* — note: Linux-kernel process isolation rather than prompt-injection detection; protection depends on a Landlock and seccomp features and is not a multi-tenant . *(★ 381 · updated 2026-08-23)*

    • - Related: Sandbox Probe · AIO Sandbox
  • Lunar 🟢🟠 — API and MCP gateway combining outbound-traffic , policy enforcement, rate limits, retries, circuit breakers, and centralized MCP ser for agent workloads. *(Lunar.dev)* — note: the repository is active but its latest formal GitHub release is from 2024; the README positions the open core for non-production or personal use and directs production deployments to commercial platform tiers. *(★ 485 · updated 2026-08-28)*

    • - Related: agentgateway · Bifrost
  • Norviq 🟢 — Kubernetes policy enforcement point for LLM agent tool calls that content-hash pins each tool definition at discovery and e every tools/call against OPA/Rego policy before the upstream MCP ser it. — note: ships in audit mode — the installed baseline records what it would ha and lets the call proceed, and all shipped policy presets default to allow, so enforcement starts with the first rule an operator writes. The disco description scanner is a documented heuristic and the project publishes the payloads that defeat it. Young project with limited independent adoption signal. *(★ 24 · updated 2026-09-01)*

    • - Related: Prismor · mcp-context-protector
  • sofagent 🟢 — Commit-time audit and go suite for AI coding agents that scans git diffs against deterministic rules, records local audit history, and exposes MCP tools for go aggregation. — note: HMAC signing is optional, while local hooks, configuration, and key material remain accessible to same-user agents; the default setup is not fail-closed and Git hooks can be bypassed, so treat the history as local audit e rather than a hardened tamper-proof boundary. *(★ 42 · updated 2026-09-03)*

    • - Related: Pipelock
  • Tenuo 🟢🟠 — Capability-based authorization for agent tool calls using signed, holder-bound warrants that constrain tools and arguments, locally, and narrow authority across delegation. — note: the Rust core, SDKs, and authorizer sidecar are Apache-2.0; the managed control plane is commercial. Enforcement requires trusted on every effecting tool path, outside agent control when bypass is possible; this is not a sandbox. The stateless core permits identical-call replay within its proof-of-possession window, so state-changing operations need application-le or idempotency controls. *(★ 100 · updated 2026-10-03)*

    • - Related: Agentgateway · AgentLock

    ---

    AI/ML Supply Chain & Model Security

    Tools for securing model artifacts, serialized ML files, AI/ML supply-chain surfaces, and malicious-package detection datasets/benchmarks.

  • MindArmour 🟢🔬 — MindSpore toolkit for ad robustness and model-privacy research, including gradient-based targeted and untargeted attacks. *(MindSpore)* Caveat: requires a compatible MindSpore, hardware, model, and dataset stack; package metadata points to Gitee for source and issue tracking. Model-specific e are not robustness guarantees. *(★ 92 · updated 2026-02-25)*

  • FedREDefense 🟢🔬 — ICML 2024 research implementation of federated-learning model-poisoning defense using reconstruction error of client updates. Caveat: an experimental training/e pipeline, not a production federation security layer; GPU, datasets, and attack configuration affect results. Consult the published erratum for the FLTrust baseline rather than copying the original comparison figures. *(★ 31 · updated 2026-09-16)*

    • - Related: FLDetector poisoning-detection research (historical; no root license, legacy MXNet 1.9.1) · FL-WBC client-side poisoning defense (historical; no root license, legacy PyTorch 1.2) · NDSS21 model-poisoning research (historical; no root license, legacy datasets/frameworks) · ModelPoisoning FL research (historical; no root license, legacy TensorFlow 1.8)
  • ModelAudit 🟢 — Model-artifact scanner with format-specific static parsers, a Rust-backed pickle-analysis companion, metadata checks, and JSON/SARIF reporting. *(Promptfoo)* Caveat: installed usage enables telemetry by default; disable with PROMPTFOO_DISABLE_TELEMETRY=1 or NO_ANALYTICS=1. Local scans need no hosted LLM, while remote sources need network access and sometimes credentials. Reports can retain raw secrets; optional metadata --trust-loaders can deserialize artifacts. A clean static scan does not establish model safety. *(★ 76 · updated 2026-10-04)*

  • AI BOM 🟢 — In models, agents, tools, MCP clients and servers, datasets, prompts, guardrails, secrets, and cloud AI resources, with CycloneDX 1.6 output and policy workflows. *(Cisco AI Defense)* — note: core in is distinct from the narrower model-file AIsbom already listed; the extended analyze pipeline requires an external LLM provider and can send analysis context off-host. Optional sanitized Galileo telemetry is separately configurable. *(★ 110 · updated 2026-09-17)*

    • - Sources: Cisco announcement
    - Related: AIsbom
  • Fraim 🟢 — Framework for AI-powered security workflows including LLM SAST and IaC analysis with SARIF/HTML output. *(★ 160 · updated 2025-12-01)*

    • - Related: sast-skills
  • Ad Robustness Toolbox (ART) 🟢 — Flagship machine-learning security library for e and defending models against e, poisoning, extraction, and inference attacks across major ML frameworks. *(LF AI & Data / IBM)* *(★ 6,179 · updated 2025-11-13)*

    • - Related: Foolbox · Pri · XLab ad course (incomplete sections; no root license, external models/cloud Colab) · Machine Learning Security course (no root license; separate dependencies/datasets) · OWASP ML Security Top 10 (CC BY-SA 4.0 risk reference, not certification)
  • Foolbox 🟢 — Classic Python toolbox for generating ad examples and benchmarking robustness of PyTorch, TensorFlow, and JAX models. *(★ 2,972 · updated 2024-03-04)*

    • - Related: Ad Robustness Toolbox
  • modelscan 🟢 — Scans ML model files for unsafe serialization patterns and embedded code, with a focus on model serialization attacks. *(Protect AI)* *(★ 762 · updated 2026-02-18)*

    • - Related: Fickling · picklescan · ai-exploits
  • Fickling 🟢 — Python pickle decompiler, rewriter, and static analyzer for inspecting and detecting malicious pickle/PyTorch payloads. *(Trail of Bits)* *(★ 662 · updated 2026-08-13)*

    • - Related: modelscan · picklescan
  • picklescan 🟢 — Lightweight CLI/library for detecting suspicious Python pickle operations in ML and model artifacts. *(★ 418 · updated 2026-07-01)*

    • - Related: modelscan · Fickling
  • AIsbom 🟢 — AI software bill of materials tooling for AI/ML supply-chain in and pro metadata. *(★ 76 · updated 2026-08-17)*

    • - Related: modelscan · model-pro
  • model-pro 🟢 — Toolkit for model-family pro and fingerprinting across model weights, tokenizers, and architecture signals. *(Cisco AI Defense)* *(★ 101 · updated 2026-08-12)*

    • - Related: AIsbom
  • pickle-fuzzer 🟢 — Structure-aware fuzzer for pickle scanners, useful for hardening tools such as modelscan, Fickling, and picklescan. *(Cisco AI Defense)* *(★ 17 · updated 2026-08-03)*

    • - Related: modelscan · Fickling · picklescan
  • Medusa 🟢⚠️ — AI-first security scanner for AI/ML repos, agents, and MCP surfaces; AGPL-3.0 licensed. *(Pantheon Security)* *(★ 964 · updated 2026-06-24)*

    • - Related: agent-audit · modelscan
  • Pri 🟢🔬 — Pri library for deep-learning systems, co model extraction and membership-inference style attacks. *(Trail of Bits)* — note: archi project, but still a useful reference implementation. *(★ 214 · updated 2025-09-05)*

    • - Related: Ad Robustness Toolbox
  • gym-malware 🟢🔬 — OpenAI Gym en for reinforcement-learning agents that mutate PE malware to evade static ML malware detectors. *(★ 636 · updated 2018-06-15)*

  • deep-pwning 🟢🔬 — Historical "Metasploit for machine learning" framework for experimenting with ad robustness of ML models. *(★ 571 · updated 2022-05-17)*

  • open-malicious-code-benchmark 🟢🔬 — OMCBench benchmark suite for malicious-code/package detection: labeled Python and Ja package archives, common runners, and published precision/recall/F1 metrics. *(False Positi)* — note: e an unreleased commercial ML detector (MOLOT / PT Application Inspector) alongside open-source baselines. *(★ 17 · updated 2026-06-09)*

    • - Related: GuardDog · OSSGadget · malicious-code-ruleset · bandit4mal
  • malicious-software-packages-dataset 🟢🔬 — Human- dataset of malicious software packages across npm, PyPI, IDE extensions, and AI Skills, useful for detector training and e. *(Datadog Security Labs)* — note: contains real malware samples; Datadog notes selection bias because many samples were identified by GuardDog. *(★ 372 · updated 2026-08-17)*

    • - Related: GuardDog · pypi_malregistry
  • GuardDog 🟢 — CLI for detecting malicious PyPI, npm, Go, RubyGems, GitHub Actions, and extension packages using Semgrep rules and package-metadata heuristics. *(Datadog)* *(★ 1,184 · updated 2026-08-14)*

    • - Related: malicious-software-packages-dataset · Packj
  • package-analysis 🟢🔬 — Sandboxed static/dynamic analysis pipeline for open-source packages, capturing filesystem, process, and network behavior and publishing data for malicious-package research. *(OpenSSF)* *(★ 903 · updated 2026-07-21)*

    • - Related: malicious-packages · package-feeds
  • malicious-code-ruleset 🟢 — Focused Semgrep ruleset for malicious-code patterns such as dynamic execution and obfuscation, used as an OMCBench baseline. *(Apiiro)* *(★ 149 · updated 2025-02-24)*

    • - Related: open-malicious-code-benchmark
  • pypi_malregistry 🔬⚠️ — ASE'23 / USENIX Security'26 malicious-PyPI dataset with more than 10k malicious package . — note: no LICENSE file found and the repository contains malware samples; handle in an isolated en. *(★ 129 · updated 2026-07-21)*

    • - Related: malicious-software-packages-dataset
  • Acti Model Scanner (AMS) 🟢🔬 — PyPI scanner that uses safety-related acti fingerprints to detect degraded or remo training and compare an open-weight model with a known baseline. *(Google Cloud Platform)* — note: unofficial and unsupported Google research-deri; GPU execution is recommended, calibration covers a limited set of model families, and the documented method can miss modifications that preser safety directions. *(★ 32 · updated 2026-08-27)*

    • - Related: AASE research · model-pro

    ---

    Pentest & Red-Team Agents

    Autonomous and semi-autonomous AI agents for penetration testing, exploitation, and attack simulation.

  • Cairn 🟢🔬⚠️ — Fact-intent graph coordinator that schedules Claude Code, Codex, or Pi workers for penetration-testing and CTF exploration through a shared persistent blackboard. Caveat: workers can execute arbitrary tools; Docker mode exposes the host Docker socket and local mode has no OS sandbox. Configured pro recei context; use a dedicated isolated host. Root license is AGPL-3.0; README describes personal/educational use and offers a separate commercial license for use without AGPL obligations. *(★ 3,198 · updated 2026-09-07)*

  • PentestGPT 🟢🔬 — The original USENIX'24 LLM pentest agent; re-released as an autonomous pipeline with strong benchmark results. *(★ 14,906 · updated 2026-07-14)*

  • PentAGI 🟢 — Fully autonomous multi-agent pentest framework with Docker sandboxing. *()* *(★ 21,860 · updated 2026-08-06)*

  • CAI – Cybersecurity AI 🟢🟠 — Modular, bug-bounty-ready agent framework supporting 300+ LLM models. MIT for research; separate commercial license for production/on-prem. *(Alias Robotics)* *(★ 9,745 · updated 2026-07-14)*

  • Strix 🟢 — Autonomous "AI hackers" that dynamically run code and with PoCs (Apache-2.0). *(★ 53,569 · updated 2026-08-17)*

  • hackingBuddyGPT 🟢🔬 — Minimal (~50 LOC) research framework for LLM-dri priv-esc and web pentesting (FSE'23). *(★ 1,209 · updated 2026-08-10)*

  • Nebula 🟢🟠 — AI pentesting CLI assistant with local-LLM support (Llama-3.1, Mistral, DeepSeek). *(★ 1,087 · updated 2026-07-26)*

  • HexStrike-AI 🟢 — MCP ser 150+ security tools (nmap, gobuster, nuclei, …) to AI agents (MIT). *(★ 11,116 · updated 2026-08-03)*

  • Deep Eye 🟢 — AI-assisted penetration-testing scanner that orchestrates multiple LLM pro for payload generation, 45+ checks, C testing, AI triage, scan diffing, browser automation, proxying, and multi-format reports. — note: MIT-licensed; authorized use only. Hea surface: optional browser automation/proxying, plaintext API-key config, plugins with full OS access, and pickle model files called out in SECURITY.md. *(★ 1,972 · updated 2026-08-14)*

    • - Related: HexStrike-AI · pentest-ai
  • Burp Suite MCP Server 🟢⚠️ — Official Burp Suite extension exposing Burp to AI clients through MCP. *(PortSwigger)* — note: GPL-3.0 licensed. *(★ 1,071 · updated 2026-08-12)*

    • - Related: HexStrike-AI · Burp MCP workflow helpers (Burp/Claude required; payloads and tokens may enter model context)
  • pentest-ai 🟢 — Offensi MCP server with 200+ wrapped tools, specialist agents, and OWASP-oriented probes for authorized testing. *(★ 1,598 · updated 2026-08-17)*

    • - Related: pentest-ai-agents
  • Transilience Community Tools 🟢 — Claude Code skill and coordination-role bundle with supporting tools for authorized penetration testing, reconnaissance, source review, and AI threat testing. *(Transilience AI)* — note: agent-interpreted workflows, not a deterministic scanner or enforcement boundary; results depend on the configured coding agent/model, and published CTF results are maintainer-run after iterati tuning. The Docker helper uses host networking and --dangerously-skip-permissions, while en.py prints requested secrets. Review and pin content, use disposable en and scoped test credentials, and treat transcripts and context sent to model pro as sensitive. *(★ 555 · updated 2026-07-29)*

    • - Sources: Container helper · Credential helper
  • pentest-ai-agents 🟢 — Collection of Claude Code offensi subagents for authorized penetration-testing research. *(★ 2,132 · updated 2026-08-16)*

    • - Related: pentest-ai
  • DarkMoon 🟢⚠️ — Autonomous AI penetration-testing platform that orchestrates specialized web, AD, Kubernetes, CMS, and framework agents through an MCP-controlled Docker toolbox with local pri for sensiti data. — note: GPL-3.0 licensed; hea/LLM stack, use only for authorized testing. *(★ 843 · updated 2026-08-06)*

    • - Related: PentAGI · HexStrike-AI · pentest-ai
  • T3MP3ST 🟢⚠️ — Autonomous offensi meta-harness that wraps local or API-backed coding agents into a multi-agent recon-to-exploit workflow with MCP/API, War Room UI, tool arsenal, and committed benchmark artifacts. — note: very new AGPL-3.0 project with bold benchmark claims; use only for authorized testing and independently before operational use. *(★ 5,596 · updated 2026-08-12)*

    • - Related: PentAGI · HexStrike-AI · pentest-ai
  • Shannon 🟢🟠⚠️ — White-box autonomous AI pentester with strong XBOW-benchmark results. *Shannon Lite is AGPL-3.0; Shannon Pro is commercial.* *(★ 46,882 · updated 2026-08-12)*

  • AIDA 🟢⚠️ — Model-agnostic autonomous pentest agent running inside an isolated Docker en; AGPL-3.0 licensed. *(★ 471 · updated 2026-07-19)*

  • HackSynth 🟢🔬⚠️ — Planner/summarizer LLM-agent framework for autonomous penetration testing and benchmark e; AGPL-3.0 licensed. *(★ 314 · updated 2025-06-24)*

  • 🟢🔬 — Multi-agent collaborati framework with RAG support. *(★ 185 · updated 2025-04-07)*

  • PentestAgent 🟢 — Black-box AI pentest framework with MCP, multi-agent spawning, and persistent sessions. *(★ 2,958 · updated 2026-08-04)*

  • cyber-security-llm-agents 🟢⚠️ — AutoGen-based agents for cybersecurity tasks (shown at RSAC 2024). *(NVISO)* *(★ 388 · updated 2024-05-07)*

  • Pentest-Swarm-AI 🟢 — Swarm-intelligence multi-agent pentest with stigmergic blackboard coordination (Go). *(★ 2,205 · updated 2026-08-04)*

  • hackGPT 🟢⚠️ — LLM offensi toolkit. *(★ 1,199 · updated 2026-08-12)*

  • ShiftGrid 🟢 — Prompt engine that turns Claude Code into a transparent, human-in-the-loop pentester, structuring engagements through checklists, obser, and notes exposed via an agent-facing API. — note: early-stage local Docker application with no built-in authentication; keep its API and UI ports bound to localhost. *(★ 39 · updated 2026-08-02)*

  • BugTraceAI 🟢⚠️ — Self-hosted autonomous web-application security scanner that combines reconnaissance, specialist exploit agents, Go fuzzers, and Playwright to produce e findings. *(BugTraceAI)* — note: AGPL-3.0 licensed and beta; use only for authorized testing. Requires an LLM provider or local Ollama endpoint and a substantial Docker/Playwright/Go runtime. *(★ 174 · updated 2026-07-30)*

    • - Related: Project o · Web dashboard · Docker launcher
  • HunterX 🟢 — AI-assisted offensi engine that orchestrates reconnaissance, security-tool coordination, detection and , e collection, and report-ready findings in one workflow. *(NullC0d3)* — note: early-stage and tool-orchestration-heavy; run only in an isolated, authorized assessment en. *(★ 12 · updated 2026-08-16)*

  • MCP Security Hub 🟢 — Collection of Dockerized MCP servers that expose offensi tools such as Nmap, Nuclei, SQLMap, Ghidra, Hashcat, and related assessment utilities to MCP-capable assistants. *(FuzzingLabs)* — note: orchestration and wrapper collection rather than a security boundary; its containers invoke offensi and must be used only in isolated, explicitly authorized en. *(★ 761 · updated 2026-04-08)*

    • - Related: pentest-ai · Burp Suite MCP Server
  • Forefy .context 🟢 — MIT-licensed collection of AI-agent Skills, Goals, and Dynamic Workflows for security auditing, authorized penetration testing, and research across web, cloud, blockchain, and defensi. *(Forefy)* — note: agent-interpreted skill and workflow bundle rather than a deterministic scanner; includes acti procedures, so review and pin content before use and run it only in isolated, authorized assessments. The hosted AI Security Registry is a separate SaaS-backed catalog that publishes commit pro and project-generated scan/audit metadata. *(★ 133 · updated 2026-08-31)*

    • - Related: AI Security Registry · Review methodology · OpenAPI schema
  • RedAmon 🟢⚠️ — Self-hosted AI pentest framework combining reconnaissance, a Neo4j attack-surface graph, Kali-based tooling, configurable human approvals, and agent-assisted remediation pull requests, with MCP client and ser. — note: authorized testing only, on a dedicated isolated host. The hea stack includes seccomp-unconfined components and services with Docker-socket access; appro are configurable, not an una boundary. Cloud LLMs recei context; local inference avoids that provider transfer but does not disable external reconnaissance or other configured services. Bundled tools retain separate licenses, including copyleft and WPScan restrictions. *(★ 2,906 · updated 2026-10-02)*

    • ---

    AI-Powered Recon & Narrow ML Tools

    Hyper-specific AI/ML tools for a single offensi, recon, or detection step — the subwiz/eyeballer pattern rather than broad autonomous agents. 🅐 = self-contained trained model or learned model/pattern engine; 🅑 = LLM wrapper that calls an external API.

    Subdomain & DNS Prediction

  • subwiz 🟢 — 🅐 Lightweight nanoGPT model that predicts resolvable subdomains via beam search; model weights are published on Hugging Face. *(Hadrian Security)* *(★ 388 · updated 2025-12-18)*

    • - Related: HadrianSecurity/subwiz model
  • regulator 🟢⚠️ — 🅐 Learns and ranks regex-like naming patterns from known subdomains to generate likely new candidates. — note: no LICENSE file found; treat as source-a until clarified. *(★ 392 · updated 2023-02-18)*

    • - Related: subwiz

    Recon Screenshot Triage

  • eyeballer 🟢⚠️ — 🅐 Con neural network that classifies pentest/recon screenshots (login pages, webapps, old-looking sites, parked domains, and custom 404s) for attack-surface triage. *(Bishop Fox)* — note: GPL-3.0 licensed. *(★ 1,290 · updated 2024-02-19)*

    • Software / Tech Fingerprinting

  • GyoiThon 🟢🔬 — 🅐 Machine-learning-assisted web intelligence tool that fingerprints products, , CVEs, login pages, debug messages, and related web-ser from HTTP responses. — note: historical research reference; Apache-2.0 licensed, but maintenance is low. *(★ 826 · updated 2021-06-29)*

    • AI-Assisted Fuzzing

  • ffufai 🟢⚠️ — 🅑 AI wrapper around the ffuf web fuzzer that suggests file extensions and paths from the target URL and headers using OpenAI or Anthropic models. *(Joseph Thacker)* — note: requires an LLM API key; README states MIT but no LICENSE file was found. *(★ 801 · updated 2025-12-04)*

    • Password / Credential ML

  • PassGPT 🔬⚠️ — 🅐 GPT-style password model trained on leaked passwords for research on password generation and strength estimation. *(Rando et al.)* *license: CC BY-NC-4.0 · access: open 10-char model; 16-char gated · artifacts: PyTorch/Safetensors.* Research-only / non-commercial use; related code: ja/passgpt.

  • PassGAN 🔬 — 🅐 WGAN that learns password distributions from leaks to generate guesses; historical reference implementation of the PassGAN paper (MIT). — note: historical research reference; not an actively maintained password-auditing product. *(★ 2,009 · updated 2018-09-30)*

  • neural_network_cracking 🔬 — 🅐 RNN password-guessing model from *Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks* (USENIX Security 2016); Apache-2.0 licensed. *(CMU CUPS Lab)* — note: historical USENIX research implementation, not a maintained password-auditing product. *(★ 243 · updated 2018-11-30)*

    • - Related: PassGPT · PassGAN

    Phishing Detection ( / URL)

  • phishing-url-detection 🟢 — 🅐 Packaged URL phishing classifier with ONNX and pickle artifacts. *license: MIT · access: open · artifacts: ONNX, pickle.* Model card recommends ONNX o for safer inference.

  • Phishing Email Detection DistilBERT v2.4.1 🟢 — DistilBERT text-classification model for email and URL phishing detection, trained on a public Hugging Face phishing-email dataset. *license: Apache-2.0 · access: open · artifacts: Safetensors.* — note: strong download signal, but independently the very high published metrics before production use.

  • PhishIntention 🔬 — 🅐 Deep- phishing detector that infers both brand intention and credential-taking intention from webpage appearance and dynamics (USENIX Security 2022). — note: CC0-1.0 licensed. *(★ 263 · updated 2026-06-04)*

  • 🔬⚠️ — 🅐 Triplet CNN for zero-day phishing detection by similarity to trusted websites (ACM CCS 2020). *(CISPA)* — note: no LICENSE file found; dataset access is research-request based. *(★ 30 · updated 2022-02-09)*

    • AI/ML-Assisted Detection Rules & Engines

  • SYARA 🟢🔬 — 🅐 Semantic YARA-like rule engine for text and multimodal signals, adding embedding similarity, classifier-backed rules, LLM e, and pHash matching to familiar YARA-style syntax. — note: early-stage engine; useful for LLM-era intent signals such as phishing, prompt injection, jailbreaks, hallucination, and disinformation rather than classic binary-only YARA matching. *(★ 18 · updated 2026-03-05)*

  • AutoYara 🟢🔬 — 🅐 Research implementation of automatic YARA rule generation over byte n-grams for malware-family samples. — note: Apache-2.0 research code from the ACM AISec 2020 paper; README explicitly says it comes with no warranty or support. *(★ 79 · updated 2025-10-08)*

    • - Related: Automatic Yara Rule Generation Using Biclustering
  • yaraml_rules 🟢🔬 — Research code that trains scikit-learn classifiers on malware and benign corpora, then compiles the learned model into deployable YARA rules. *(Sophos)* — note: historical research reference; the maintained value is the ML-to-YARA technique, not a current detection product. *(★ 215 · updated 2020-12-18)*

  • RuleLLM 🟢🔬 — 🅑 LLM-assisted malware-rule generator that clusters malicious code samples and produces/refines/ YARA and Semgrep rules. — note: MIT-licensed research prototype; requires OpenAI-compatible API access plus YARA/Semgrep . *(★ 12 · updated 2025-04-25)*

    • Defensi Detectors

  • open-appsec 🟢🟠⚠️ — ML-based web application and API firewall combining an offline-trained model with en traffic learning and block/log decisions. Caveat: the bundled Apache-2.0 basic model is recommended for monitor/test use; the production-oriented ad model is a separate portal download with its own terms. Review standalone SaaS management, telemetry/data flows, and deployment pri such as host IPC; detection claims are not a security guarantee. *(★ 1,718 · updated 2026-09-01)*

    • - Related: Open-appsec HTTP attachment (requires separate agent/models/configuration; review their terms)
  • DeepSQLi 🟢⚠️ — 🅐 Deep-learning SQL-injection detector with dataset, trained models, and a Flask Prediction API for GatewayD IDS/IPS integration. *(GatewayD)* — note: AGPL-3.0 licensed; defensi rather than offensi. *(★ 7 · updated 2026-02-21)*

  • deepsecrets 🟢 — Semantic secrets scanner using lexing/parsing, entropy checks, and hashed-known-secret matching across 500+ languages. — note: useful narrow detector, but not a trained ML model. *(★ 172 · updated 2026-06-04)*

  • VLAI Se Classifier 🟢🔬 — RoBERTa-based classifier trained on CIRCL scores to assist triage before manual C. *(CIRCL)* *license: CC-BY-4.0 · access: open · artifacts: Safetensors.*

    • ---

    AI-Powered SAST & Secure Code Review

    Static analysis and secure code review enhanced with LLMs.

  • Symfony Security Auditor 🟢 — Symfony-aware source-audit package with attacker/re model passes, confidence filtering, baseline deduplication, and budget-bounded partial results. Caveat: re findings are model judgments, not confirmed exploitation. Offline-only mode defaults to false, so hosted pro recei source; local inference needs separately pro models. Requires PHP 8.3+ and a compatible Symfony . *(★ 95 · updated 2026-10-04)*

  • Clearwing 🟢 — Agent-dri research pipeline that ranks files, coordinates hunting and , optionally generates patches, and exports SARIF, JSON, and Markdown findings. Caveat: can compile untrusted targets and execute generated proofs or exploits; use isolated authorized en and explicit spending limits. Hosted models recei context; local pro are supported. Optional OTLP/Phoenix tracing can export run metadata. Findings need independent , and released packages can lag main. *(★ 1,072 · updated 2026-10-02)*

  • Cloudflare Security Audit Skill 🟢 — Coding-agent skill for a multi-phase source-security audit with reconnaissance, co hunting, independent , structured findings, and a separate record- pass. *(Cloudflare)* — note: workflow skill, not a standalone scanner; it requires a capable coding agent with parallel subagents and an OS-enforced sandbox. Results are nondeterministic, and Cloudflare reports that one run finds only about half of the found across repeated runs. *(★ 18,424 · updated 2026-09-14)*

    • - Sources: Cloudflare write-up
  • Mantis 🟢🔬 — Security-review skills and an ADK reference harness for discovery, triage, reproduction, patching, and deterministic gates. *(Google)* — note: can generate and execute code while reproducing findings; use only on authorized source in an isolated restricted en. Model output and proposed findings still require expert . *(★ 1,678 · updated 2026-09-18)*

    • - Sources: Google Cloud announcement
  • (Capital One) 🟢 — Attacker-oriented source-review workflow with forward analysis from exposed entry points, a finding-falsification pass, e remediation, and a separate fix- flow. *(Capital One)* — note: built and optimized for Claude Code with an Opus-class model, so source context is processed under the selected provider's terms and results remain model-dependent. Use only on code you are authorized to assess. *(★ 1,016 · updated 2026-08-15)*

    • - Sources: Capital One announcement
  • 🟢 — Zero-shot discovery in Python repos via LLM call-chain analysis; credited with a 0-day RCE in Ragflow. *(Protect AI)* *(★ 2,741 · updated 2025-02-06)*

    • - Related: IRIS
  • deepsec 🟢 — Agent-powered security harness for scanning large codebases with coding agents, resumable parallel runs, custom matchers, and optional re. *( Labs)* *(★ 7,695 · updated 2026-08-13)*

    • - Related: claude-code-security-review · sast-skills
  • Codex Security 🟠 — CLI and TypeScript SDK that use Codex Security to find, , and help fix in a codebase, with scan comparison and containerized bulk-scan support. *(OpenAI)* — note: the CLI/SDK are open source, but scans require Codex Security access and, for best results, OpenAI Trusted Access. *(★ 9,911 · updated 2026-08-16)*

    • - Related: deepsec · defending-code-reference-harness
  • open·kritt 🟢⚠️ — Self-hosted platform that orchestrates Codex or Claude Code across focused workflows, then , de-duplicates, ranks, and reports resulting findings. *(Kritt AI)* — note: jobs run as root in disposable Docker containers with writable target copies and direct internet access; the stack has no application auth by default and sends scanned code to the configured model provider. Deploy only on a dedicated, access-controlled host and scan authorized targets. *(★ 1,877 · updated 2026-08-16)*

    • - Related: deepsec · Visa Agentic Harness
  • Visa Agentic Harness 🟢 — Agentic SAST pipeline for autonomous discovery, exploitability , SARIF/Markdown reporting, remediation, and using frontier AI models. *(Visa)* — note: Apache-2.0; authorized use only. The default scan profile can continue into remediation and edit target source files; use --stop-after s9 for detection-only runs. *(★ 2,556 · updated 2026-08-04)*

    • - Related: deepsec · defending-code-reference-harness
  • defending-code-reference-harness 🟢 — Reference Claude Code skills and autonomous pipeline for threat modeling, static scanning, triage, execution- C/C++ memory-bug discovery, reporting, and patch generation. *(Anthropic)* — note: official reference implementation, not maintained as a product; the autonomous pipeline executes target code and should be run only inside the documented gVisor sandbox. *(★ 7,270 · updated 2026-08-06)*

    • - Related: deepsec · claude-code-security-review
  • rust-in-peace 🟢 — Rust-security fork of Anthropic's defending-code reference harness, adding a Rust profile for agentic review of unsafe/FFI memory bugs, panic-DoS, deserialization-trust issues, and Miri/ASan/panic/hang- findings. *(Sergey Gordeychik)* — note: very new Apache-2.0 fork; autonomous runs execute target code and should use the documented sandbox. *(★ 14 · updated 2026-08-11)*

    • - Related: defending-code-reference-harness · deepsec
  • Reproof 🟢 — Multi-language Kimi Code port of rust-in-peace, orchestrating agentic discovery, PoC replay in fresh containers, comparison with known bugs, and patch re-testing. *(Sergey Gordeychik)* Caveat: newly published, maintainer-authored project; benchmark results are project-reported, not independently reproduced here. The autonomous pipeline executes target code and generated PoCs; use the documented Linux/Docker/gVisor setup on authorized targets. The configured model provider recei and execution context and may incur costs; review generated patches and sensiti before use or disclosure. *(★ 1 · updated 2026-10-05)*

    • - Related: rust-in-peace · defending-code-reference-harness
  • claude-code-security-review 🟠 — Official Claude-based semantic SAST GitHub Action that reviews PR diffs. *(Anthropic)* *(★ 5,866 · updated 2026-02-11)*

  • IRIS 🟢🔬 — Neurosymbolic SAST combining LLMs with CodeQL for Ja detection (MIT). *(★ 413 · updated 2026-07-02)*

  • sast-skills 🟢 — Agent skills that turn AI coding assistants into a multi-agent SAST scanner. *(★ 1,276 · updated 2026-04-08)*

    • - Related: Fraim · llm-sast-scanner · AWS MCP code-scanning sample (external scanners; not MCP protocol analysis)
  • llm-sast-scanner 🟢 — SAST skill for AI coding agents with structured source-to-sink analysis across 34 classes. *License: MIT stated in README.* *(★ 274 · updated 2026-04-07)*

    • - Related: sast-skills
  • sast-ai-workflow 🟢 — LangGraph workflow for re static-analysis findings, reducing false positives, and producing review output. *(Red Hat Ecosystem AppEng)* *(★ 20 · updated 2026-06-29)*

    • - Related: seclab-taskflow-agent · Fraim
  • llm-security-scanner 🟢⚠️ — LLM-powered code scanner that opens GitHub issues for findings. *(★ 22 · updated 2025-04-02)*

  • Trail of Bits Skills 🟢⚠️ — Claude Code- and Codex-compatible security workflow skills for code review, differential review, false-positi, supply-chain checks, GitHub Actions auditing, Semgrep rule generation, and research. *(Trail of Bits)* — note: reusable agent workflow instructions rather than a standalone deterministic scanner; share-alike terms apply to adapted material. *(★ 6,624 · updated 2026-08-14)*

    • - Related: sast-skills · Claude-BugHunter · Claude Code cybersecurity skills (host permissions govern execution) · Defensi Code playbooks (host/model-dependent; production claims un)
  • OpenHack 🟢 — File-based source-guided white-box security-review workspace that orchestrates agents through reconnaissance, hunting, , e capture, and reporting. *(Hadrian Security)* — note: requires an external coding harness/model and can consume substantial model tokens; OpenHack provides workflow state and review artifacts, not sandboxing or an execution-security boundary. Use only on authorized targets. *(★ 730 · updated 2026-06-01)*

    • - Related: deepsec · rust-in-peace
  • Buttercup 🟢🔬⚠️ — Multi-component cyber reasoning system for finding, , and patching software with coordinated agent workflows. *(Trail of Bits)* — note: AGPL-3.0 research/competition system rather than a lightweight scanner; deployment uses multiple services, Docker, and configured model pro. *(★ 1,676 · updated 2026-08-10)*

    • - Related: OpenHack · Visa Agentic Harness

    ---

    AI-Powered Threat Modeling

    Architecture-le model generation and design-phase risk analysis driven by LLM reasoning.

  • ThreatForest 🟢🔬 — Strands-based threat-modeling pipeline that analyzes repositories, generates attack trees and mitigations, and maps attack steps to ATT&CK and other TTP frameworks through an embedding service. *(AWS Samples)* Caveat: sends project context to configured model pro and requires separately licensed embedding weights; optional Langfuse export defaults off. Keep its unauthenticated API on loopback. Generated paths and embedding-based TTP mappings require expert review, not automatic acceptance as demonstrated attack paths. *(★ 80 · updated 2026-08-01)*

  • tachi 🟢 — Threat modeling and AI-reasoning detection harness for Claude Code that dispatches 14 specialized threat agents (6 STRIDE, 5 LLM, 3 agentic) against an architecture description in Mermaid, C4, PlantUML, ASCII, or free text, producing SARIF 2.1.0 for code scanning, MAESTRO se classification, attack trees, C composite risk scores, compensating-controls analysis of the target codebase, and a PDF report. *(Da)* — note: runs inside Claude Code; architecture descriptions are processed by the configured Claude model. *(★ 89 · updated 2026-08-13)*

    • - Related: STRIDE GPT · defending-code-reference-harness
  • STRIDE GPT 🟢 — LLM-powered threat modeling tool that generates STRIDE threat models, attack trees, data flow diagrams, DREAD risk scores, mitigations, and Gherkin test cases from application descriptions, architecture diagrams, or codebases (agentic analysis mode), with OWASP LLM Top 10 and Agentic (ASI) co, MITRE ATT&CK/ATLAS mapping, Markdown/JSON/SARIF/HTML output, and broad LLM provider support including local hosting. *(Matthew Adams)* *(★ 1,101 · updated 2026-08-12)*

    • - Related: tachi

    ---

    LLM-Dri

    Two families: (a) LLMs generating harnesses/targets for traditional fuzzing, and (b) fuzzing the LLM itself.

    Harness / target generation

  • seclab-taskflows-fuzzing 🟢 — Taskflow package for LLM-assisted C/C++ fuzz-harness generation and repair, AFL++ campaigns, co feedback, and crash triage. *(GitHub Security Lab)* Caveat: requires a configured model provider and a Linux build/fuzzing toolchain; pro analysis can disclose source code. Host-shell and file-write tools are not a sandbox, and setup can install system tools. Use a disposable isolated en for authorized targets. *(★ 20 · updated 2026-09-21)*

    • - Related: seclab-taskflow-agent
  • Ultrafuzz 🟢 — Agentic smart-contract fuzzing orchestrator that generates tests, coordinates analysis campaigns, and collects findings and reports. *(Monad Foundation)* Caveat: agents deliberately bypass permission and sandbox approvals and can access host files and the network. Run only on an ephemeral isolated unrelated credentials; review a published release rather than the default unstable branch. Model/provider configuration determines cost and data disclosure; the harness is not an isolation boundary. *(★ 98 · updated 2026-10-02)*

  • PromeFuzz 🟢🔬 — Research framework for C/C++ fuzz-harness generation using code metadata, documentation, API relationships, iterati repair, and crash analysis (CCS 2025). Caveat: requires target build metadata, a native LL toolchain, and configured generation/embedding models. Hosted pro recei and documentation context; generated harnesses and target code execute during campaigns. Use isolated authorized en and do not generalize the paper's co or bug-finding results to arbitrary targets. *(★ 61 · updated 2026-07-30)*

  • oss-fuzz-gen 🟢 — LLM-dri generation for OSS-Fuzz; reported 26 real (incl. C in OpenSSL). *(Google)* *(★ 1,430 · updated 2026-03-02)*

  • PromptFuzz 🟢🔬⚠️ — LLM-mutated prompts to generate fuzz drivers for C/C++ libraries (Rust). *(★ 342 · updated 2026-05-15)*

  • Fuzz4All 🟢🔬 — "Uni" LLM-based fuzzer across compilers/languages (ICSE 2024). *(★ 336 · updated 2025-08-11)*

  • ChatAFL 🟢🔬 — LLM-guided protocol fuzzing extending AFLNet (NDSS'24). *(★ 392 · updated 2025-06-20)*

  • TitanFuzz 🟢🔬⚠️ — First LLM-based fuzzer for PyTorch/TensorFlow (ISSTA'23). *(★ 94 · updated 2023-09-10)*

    • Fuzzing the LLM

  • LLMFuzzer 🟢🔬 — First open-source fuzzing framework for LLM API integrations. — note: historical research reference; maintenance appears low compared with current LLM security scanners. *(★ 377 · updated 2024-02-12)*

  • ps-fuzz 🟠 — System-prompt hardening fuzzer; 16 attacks × 16 pro. *(Prompt Security)* *(★ 703 · updated 2026-02-16)*

  • FuzzyAI 🟠 — Automated LLM fuzzer for jailbreaks/prompt injection. *(CyberArk)* *(★ 1,563 · updated 2026-02-06)*

  • spikee 🟢 — Prompt-injection e and exploitation kit with dataset generation, Burp integration, and pluggable judges. *(Re / WithSecure)* *(★ 263 · updated 2026-09-11)*

    • - Related: promptmap
  • promptmap 🟢⚠️ — Prompt-injection scanner for custom LLM applications in white-box and black-box modes; GPL-3.0 licensed. *(★ 1,250 · updated 2025-12-01)*

    • - Related: spikee
  • ai-prompt-fuzzer 🟢 — Burp Suite extension fuzzing GenAI/LLM prompts. *(PortSwigger)* *(★ 36 · updated 2025-09-04)*

    • ---

    Threat Intelligence

    AI/LLM tooling for CTI gathering, IOC/TTP extraction, and analysis.

  • ZettelForge 🟢 — CTI in memory with entity and IOC extraction, graph and retrieval, local storage, and an MCP interface. Caveat: core storage and retrieval are local, but embedding models require an initial download and optional remote LLM pro recei content. Rich extraction and synthesis depend on the configured model; synthesis without an LLM is a placeholder, not a completed analysis. Generated links and attribution need analyst . *(★ 64 · updated 2026-07-10)*

  • 🟢 — OSINT and CTI pipeline combining source collection, IOC/entity extraction, enrichment, relationship analysis, and intelligence exports. Caveat: collection contacts external and potentially hostile sources; Tor is not an anonymity guarantee. Cloud model adapters disclose submitted content, while local models are configurable. Neural embeddings are optional and the SHA-256 fallback is not semantic ML; generated attribution and detection rules require analyst review. *(★ 770 · updated 2026-08-04)*

  • cti-skills 🟢 — CTI workflow skills and integration clients for source assessment, IOC in, ATT&CK mapping, detection-rule drafting, and MISP/OpenCTI workflows. *(Liberty91)* Caveat: skills guide a host agent rather than provide an independent detection engine. Li need provider credentials and can disclose intelligence; some clients can create, modify, or delete records. Confirmation instructions are not enforced authorization, so scope credentials and review writes separately. *(★ 25 · updated 2026-09-30)*

  • trs 🟢 — LLM + ChromaDB tool to summarize threat reports and extract MITRE TTPs and IOCs. *(★ 10 · updated 2023-11-15)*

  • TI-Mindmap-GPT 🟢 — Streamlit app: AI summaries, mindmaps, IOC/TTP extraction, and ATT&CK Na layers. *(★ 111 · updated 2026-02-16)*

  • aiocrioc 🟢 — LLM + OCR IOC extraction (pulls IOCs from images/PDFs). *(★ 38 · updated 2024-12-04)*

  • ThreatIngestor 🟢 — Extracts/aggregates IOCs from feeds; integrates with MISP/ThreatKB (pairs well with LLM post-processing). *(★ 922 · updated 2026-05-26)*

  • IATelligence 🟢 — Explains imported Windows APIs in PE files via GPT and maps to MITRE ATT&CK. *(★ 384 · updated 2022-12-09)*

    • - Related: MCP_Security
  • MCP_Security 🟢⚠️ — MCP server (ORKL) for querying the ORKL threat-intel API. *(★ 51 · updated 2025-01-22)*

    • - Related: IATelligence
  • threat-intelligence-cti-analysis 🟢 — NLP/LLM pipeline for IOC extraction, MITRE ATT&CK mapping, and knowledge-graph generation from unstructured CTI. *(★ 4 · updated 2025-11-03)*

    • - Related: soctalk
  • CTINexus 🟢🔬 — LLM-assisted framework for data-efficient extraction of cyber-threat intelligence and construction of structured cybersecurity knowledge graphs from unstructured reports. — note: ships tests, releases, Docker configuration, and a Python package; extraction workflows require a configured supported LLM provider. *(★ 85 · updated 2026-02-25)*

    • - Related: threat-intelligence-cti-analysis · CTIBench
  • CTIBench 🔬⚠️ — NeurIPS 2024 Spotlight benchmark with 4,610 examples across CTI knowledge, CWE root-cause mapping, C, ATT&CK technique extraction, and threat-actor attribution. — note: non-commercial research benchmark; the repository publishes data, e notebooks, model outputs, and raw logs rather than a production CTI service. *(★ 92 · updated 2026-05-07)*

    • - Related: CTINexus · CTI-BERT
  • CTI-BERT 🟢🔬 — BERT model pretrained from scratch on a large cybersecurity text corpus for downstream CTI extraction, classification, and question-answering tasks. *(IBM Research)* *license: Apache-2.0 · access: open · artifacts: PyTorch.*

    • ---

    Log Analysis / SIEM / SOC Triage

    AI agents for SOC alert triage, in, and incident response.

  • AI-SOC-Agent 🟢 — Black Hat 2025 MCP ser security-in tools (ELK, IRIS). *(★ 47 · updated 2025-12-28)*

  • soctalk 🟢 — LangGraph SOC automation agent with MCP integrations for Wazuh, Cortex, TheHive, and MISP plus mock-agent test lab. *(★ 78 · updated 2026-08-12)*

    • - Related: SigmaOptimizer
  • Vigil SOC 🟢 — Open-source AI SOC with readable Python agents, Markdown playbooks, and MCP integrations for triage, in, hunting, response, reporting, and forensics. *(Vigil SOC)* *(★ 247 · updated 2026-08-17)*

    • - Related: soctalk
  • agentic-soc-platform 🟢 — Agentic SOC platform (LangGraph/Dify) with local-LLM support. *(★ 1,144 · updated 2026-08-05)*

  • SigmAIQ 🟢⚠️ — pySigma wrapper and LangChain toolkit for automatic Sigma rule creation and translation; LGPL-2.1 licensed. *(AttackIQ)* *(★ 97 · updated 2025-11-03)*

    • - Related: SigmaOptimizer
  • RulePilot 🟢🔬 — LLM-powered security-rule generation agent for Splunk, Microsoft Sentinel, and Elastic, with field detection from log samples, multi-stage refinement, and cross-platform rule con. — note: MIT-licensed ICSE 2026 research prototype; requires an OpenAI API key. *(★ 15 · updated 2025-10-20)*

    • - Related: SigmAIQ · SigmaOptimizer
  • SOCGPT 🟢 — LLM log summarization, se triage, MITRE mapping, and Q&A. *(★ 7 · updated 2025-06-11)*

  • AttackGen 🟢 — LLM-dri scenario generator using MITRE ATT&CK + ATLAS. *(★ 1,234 · updated 2026-08-13)*

  • Google Security Operations and Threat Intelligence MCP Server 🟢 — MCP servers and packages that let MCP clients access Google Security Operations, SOAR, Google Threat Intelligence, and Security Command Center for in, hunting, and security automation workflows. *(Google Cloud)* — note: integration layer rather than an MCP-defense tool; requires Google credentials and access to the connected security products/services. *(★ 517 · updated 2026-04-29)*

    • - Related: MCP_Security · Vigil SOC
  • ExCyTIn-Bench (SecRL) 🟢🔬 — ICML 2026 benchmark for e LLM agents on cyber-threat in and threat hunting through security question-answering o anonymized incident databases. *(Microsoft)* — note: e requires model-provider credentials, Dockerized MySQL incident databases, and roughly 10 GB for the standard eight-container setup (up to 33 GB for the combined database). *(★ 143 · updated 2026-08-03)*

    • - Related: CTIBench · Google Security Operations MCP

    ---

    Reverse Engineering

    LLM-assisted binary analysis and traffic inspection.

  • IDAssist 🟢 — Native IDA Pro plugin for LLM-assisted function explanation, symbol renaming, binary knowledge graphs, document retrieval, and tool-dri through local or hosted model pro. Caveat: requires separately licensed IDA Pro; hosted models recei context, optional SymGraph sharing exports symbols and graph data, and MCP tools can modify the IDB or start local processes. Findings require analyst . *(★ 729 · updated 2026-09-20)*

  • DeepZero 🟢🔬 — Resumable Windows dri framework combining Ghidra decompilation, static analysis, and optional LLM assessment through YAML pipelines. — note: the Windows-dri requires an operator-provided Ghidra installation and optional LLM-provider credentials; analyze only drivers you are authorized to research. *(★ 712 · updated 2026-09-10)*

  • Gepetto 🟢 — IDA Pro plugin: GPT adds comments and meaningful names. *(★ 3,457 · updated 2026-08-15)*

  • ida-pro-mcp 🟢 — MCP bridge for IDA Pro exposing decompile, disassemble, xref, rename, and debugging workflows to LLM clients. *(★ 11,393 · updated 2026-08-17)*

  • GhidraMCP 🟢 — MCP ser Ghidra re ops to any MCP-capable LLM. *(★ 9,805 · updated 2025-06-23)*

    • - Related: GhidrOllama · OGhidra
  • ReVa 🟢 — Ghidra-focused re assistant with MCP support, Claude Skills integration, and long-form analysis workflows. *(★ 805 · updated 2026-07-28)*

    • - Related: GhidraMCP · GhidrAssistMCP
  • GhidrAssistMCP 🟢 — Nati MCP extension with broad tool co, headless support, and security-sensitive tool gating. *(★ 719 · updated 2026-08-02)*

    • - Related: ReVa · ghidra-mcp
  • ghidra-mcp 🟢 — Ghidra MCP server with large tool co, GUI plugin, headless server, and lazy tool loading. *(★ 3,333 · updated 2026-08-12)*

    • - Related: GhidrAssistMCP
  • GhidrOllama 🟢⚠️ — Ghidra script using the Ollama API for function analysis/renaming. *(★ 154 · updated 2024-11-29)*

    • - Related: OGhidra · GhidraMCP
  • GhidraGPT 🟢 — Ghidra plugin that integrates LLMs for automated code refactoring and analysis. *(★ 658 · updated 2026-07-22)*

    • - Related: GhidraMCP · ReVa
  • LLM4Decompile 🟢🔬⚠️ — Research project for binary-to-C decompilation with LLMs; code is MIT, but model weights use a more restricti. *(★ 6,965 · updated 2026-02-12)*

  • x64dbg_mcp 🟢 — MCP ser x64dbg debugging and re operations to AI clients. *(★ 104 · updated 2026-06-08)*

  • binaryninja-mcp 🟢 — MCP server for Binary Ninja-assisted reverse engineering. *(★ 47 · updated 2025-05-13)*

  • OGhidra 🟢 — Natural-language Ghidra analysis . *(Lawrence Li National Lab)* *(★ 410 · updated 2026-08-14)*

    • - Related: GhidrOllama · GhidraMCP
  • ghidra_tools (G-3PO) 🟢 — Ghidra plugin for AI-assisted decompiled-code analysis. *(Tenable)* *(★ 312 · updated 2023-05-10)*

  • gpt-wpre 🔬 — Whole-program reverse engineering with GPT-3. *(★ 407 · updated 2022-12-31)*

  • burpgpt 🟢 — Burp Suite extension integrating GPT for passi. *(★ 2,347 · updated 2024-06-09)*

    • - Related: Burp-extension-for-GPT
  • Burp-extension-for-GPT 🟢 — Burp extension to analyze HTTP traffic with GPT. *(Tenable)* *(★ 116 · updated 2023-05-01)*

    • - Related: burpgpt
  • REA 🟢 — Local CLI and MCP toolkit for agent-assisted reverse engineering of nati, managed PE/CLI files, Ja/Electron apps, and browser runtimes, using Hopper or an operator-provided Ghidra installation. — note: deep nati uses separately licensed Hopper or operator-installed Ghidra. Setup can modify agent MCP registrations after interacti, and dynamic pro run with the current user's permissions; analyze only authorized artifacts. *(★ 346 · updated 2026-08-14)*

    • - Related: GhidraMCP · ReVa
  • Open-Re 🟢⚠️ — Agent-nati workspace and MCP ser Ghidra headless analysis with Frida, x64dbg, Rizin, YARA, and a runnable CTF/APK/PE knowledge base. — note: the repository additionally asserts a mandatory disclaimer with use, redistribution, deri, and indemnification terms beyond GPL-3.0. Optional installers download and execute numerous third-party offensi, sometimes from latest or moving upstream refs without checksums; review them before use and run only in an isolated, authorized lab. *(★ 1,101 · updated 2026-09-08)*

    • - Related: GhidraMCP · ReVa

    ---

    LLM Red-Teaming & Guardrails

    Tools for attacking and defending LLM applications themselves.

    Scanners, Evals & Guardrails

  • DrAttack 🟢🔬 — Research jailbreak implementation that decomposes requests, searches prompt substitutions, and e target-model responses. Caveat: historical defaults use the old OpenAI ChatCompletion API and gpt-3.5-turbo-0613, requiring compatible dependencies or adaptation. Refusal-prefix and model-judge heuristics do not pro success; configured generation and embedding APIs recei inputs. *(★ 69 · updated 2026-09-12)*

  • RL-Hammer (rl-injector) 🔬⚠️ — Research training pipeline for prompt-injection attacker models, with InjecAgent tool-response substitution and target-based reward computation. *(Meta)* Caveat: noncommercial code; GPU resources, models, and data are separate dependencies. Hosted targets recei contexts, and the re tokenizer path enables trust_remote_code, so model repositories require separate review. Published outcomes are not independently reproduced here. *(★ 57 · updated 2025-11-24)*

  • Prompt Injection as Role Confusion 🟢🔬⚠️ — Research code for probing role representations and studying prompt injection through confusion between instruction and data roles. Caveat: the root license contains the MIT permission text without a copyright header. Experiments require compatible model weights and GPU resources; some configurations are marked untested, and API-backed paths disclose inputs to pro. This is not a production guardrail. *(★ 134 · updated 2026-05-31)*

  • GuidedBench 🟢🔬 — Guideline-grounded jailbreak e that scores sa responses against case-specific criteria using configurable judge backends. Caveat: the bundled dataset integration is gated and needs appro; dataset and model terms are separate from the code license. Judge models can disagree or fail, and hosted backends recei content; this is an e, not an attack generator or ground-truth oracle. *(★ 32 · updated 2026-08-31)*

  • OpenART 🟢🔬⚠️ — Research benchmark and Docker-based runtime for red-teaming tool-using agents through ad changes to stateful, long-running task en. Caveat: bundled runnable tasks are a subset of the paper's broader e, not the entire headline corpus. Model-backed attackers, targets, and judges require configured pro and can disclose e content. Executable e, container mounts, and network access require disposable authorized en; this is not a production guardrail or independently containment layer. *(★ 229 · updated 2026-10-03)*

  • ZeroLeaks 🟠⚠️ — Source-a TypeScript library and CLI for model-based system-prompt extraction and injection testing with adapti and configurable pro. Caveat: FSL restricts competing commercial use before the future Apache con. The public package tests a model plus system prompt, not a deployed application's actual tools, memory, or side effects; hosted deployed-agent testing is separate and paid. Hosted pro recei material and require credentials, while local compatible endpoints are supported. Model-graded results are not proof of exploitation. *(★ 733 · updated 2026-09-26)*

  • RAMPART 🟢 — Pytest-nati for repeatable ad and benign safety regression tests against AI agents, with statistical trials and e for responses, tool calls, and external side effects. *(Microsoft)* — note: test framework built on PyRIT, not a runtime protection layer; users must supply target adapters and model credentials, and passing its scenarios does not establish production safety beyond the tested behaviors. *(★ 414 · updated 2026-09-18)*

    • - Sources: Microsoft Security announcement
    - Related: PyRIT
  • Agent OPFOR 🟢 — Ad toolkit for AI agents, LLM applications, and MCP servers with multi-turn attack templates, tool and memory tests, trace-aware e, CLI, SDK, browser, MCP, and skill interfaces. *(KeyValue Software Systems)* — note: attacker and judge workflows depend on configured LLM pro and add inference cost; trace integrations can expose internal agent data to the selected obser service. Use only against systems you own or are authorized to test. *(★ 580 · updated 2026-09-13)*

  • NuGuard 🟢 — Generates an AI-SBOM, statically analyzes agentic applications, red-teams li for prompt injection/tool misuse/data exfiltration, and beha policy compliance with SARIF, JSON, and Markdown reports. *(NuGuard AI)* — note: beta project; li scans actively probe the target and require authorization. LLM-assisted features need provider credentials, and the optional NuGuard.ai hosted offering adds commercial features. *(★ 23 · updated 2026-08-14)*

    • - Related: garak · Medusa
  • garak 🟢 — The LLM scanner — probes for prompt injection, jailbreaks, data leakage, and more. *(NVIDIA)* *(★ 8,834 · updated 2026-08-14)*

    • - Related: PyRIT · promptfoo
  • PyRIT 🟢 — Python Risk Identification Tool; battle-tested across 100+ GenAI red-team operations. *(Microsoft)* *(★ 4,316 · updated 2026-08-14)*

    • - Related: Arcanum prompt-injection taxonomy (CC BY 4.0 reference, not a detector)
  • promptfoo 🟢 — LLM eval + red-teaming/pentesting CLI with 50+ attack plugins (MIT). *Note: OpenAI announced an acquisition agreement in March 2026; remains MIT-licensed — track go.* *(★ 24,302 · updated 2026-08-17)*

    • - Related: Promptfoo CI Action (checkout e, not base/head diff; defaults to latest, sharing possible; review permissions/data policy)
  • Augustus 🟢 — Single-binary LLM security testing framework for prompt injection, jailbreaks, and ad attacks across many pro. *(Praetorian)* *(★ 280 · updated 2026-08-17)*

    • - Related: garak · PyRIT
  • agentic_security 🟢 — Agentic LLM scanner and AI red-team kit for jailbreaks, prompt injection, fuzzing, and API stress testing. *(★ 1,966 · updated 2026-07-31)*

    • - Related: garak · spikee
  • HackAgent 🟢 — Python SDK and CLI for red-teaming AI agents with research-backed attacks such as Ad, AutoDAN-Turbo, PAIR, TAP, FlipAttack, BoN, and static templates across agent frameworks. — note: works locally without an API key; optional cloud reporting is a. *(★ 358 · updated 2026-08-15)*

    • - Related: PyRIT · garak · agentic_security
  • wallbreaker 🟢🔬⚠️ — Claude-Code-style terminal and red-team harness for authorized LLM safety testing, with HarmBench, PAIR/TAP, Crescendo, GCG-style workflows, Parseltongue transforms, MCP tooling, LLM judges, and reproducible run artifacts. — note: offensi toolkit for authorized testing only; AGPL-3.0 licensed and NOTICE flags external jailbreak corpora with their own or missing upstream licenses. *(★ 1,208 · updated 2026-08-11)*

    • - Related: HarmBench · PyRIT · garak
  • Hi Red 🟢 — Early-stage LLM red-teaming framework with 80+ attack templates, async e pipelines, WildGuard e, multi-provider support, and HTML reporting. — note: young project with limited independent adoption signal. *(★ 29 · updated 2026-08-13)*

    • - Related: garak · PyRIT · promptfoo
  • DeepTeam 🟢 — Open-source framework for red-teaming LLMs and LLM systems across jailbreaks, prompt injection, data leakage, and safety risks. *(★ 2,451 · updated 2026-08-12)*

  • Moonshot 🟢 — Modular tool for benchmarking, red-teaming, and e LLM applications with custom connectors and recipes. *(AI Foundation)* *(★ 347 · updated 2026-02-05)*

  • Guardrails AI 🟢 — Python framework for adding input/output guards, , structured-output controls, and Guardrails Hub checks to LLM applications. *(Guardrails AI)* *(★ 7,294 · updated 2026-08-14)*

    • - Related: NeMo Guardrails · LLM Guard · Pydantic AI Shields integration (README recommends a successor)
  • Giskard 🟢 — Open-source e, testing, and red-teaming framework for LLM agents, including agent scanning and RAG e workflows. *(Giskard AI)* *(★ 5,755 · updated 2026-08-17)*

    • - Related: Moonshot · promptfoo
  • LangKit 🟢 — LLM monitoring toolkit extracting safety/security signals such as jailbreak similarity, prompt-injection similarity, hallucination checks, PII patterns, toxicity, and refusal metrics. *(WhyLabs)* *(★ 994 · updated 2024-11-22)*

  • LLM Guard 🟢 — Suite of input/output scanners (PII, prompt injection, etc.). *(Protect AI)* — note: archived by the maintainer; retained as a historical reference for local input/output guardrails. *(★ 3,201 · updated 2026-07-08)*

    • - Related: Rebuff · Pytector prompt-injection classifier integration
  • Rebuff 🟢 — Archi detector (heuristics + LLM + DB + canary tokens). *(Protect AI)* — note: archived by the maintainer; retained as a historical prompt-injection defense reference. *(★ 1,520 · updated 2024-01-25)*

    • - Related: LLM Guard
  • NeMo Guardrails 🟢 — Programmable guardrails (input/output/dialog/retrie) for LLM apps. *(NVIDIA)* *(★ 6,965 · updated 2026-08-17)*

    • - Related: Backtranslation-defense reproduction (historical; legacy FastChat/GPU and model judges, separate bundled-code terms) · Jailbreak-defense research library (historical; local models or OpenAI, not an authority boundary)
  • PurpleLlama 🟢 — Llama Guard classifiers, CodeShield, and CyberSecEval. *(Meta)* *(★ 4,355 · updated 2026-08-14)*

  • LLAMATOR 🟢⚠️ — Red-teaming framework for chatbots and GenAI systems; CC BY-NC-SA 4.0 licensed. *(★ 215 · updated 2026-01-15)*

  • Vigil 🟢🔬 — Library/REST API to scan prompts and responses for prompt injection. *(★ 496 · updated 2024-01-31)*

  • Counterfit 🟢 — ML/AI penetration-testing automation tool. *(Microsoft)* *(★ 935 · updated 2025-07-18)*

  • AI-Red-Teaming-Playground-Labs 🟢 — CTFd-based AI red-team training challenges. *(Microsoft)* *(★ 2,046 · updated 2025-10-07)*

  • EasyJailbreak 🟢🔬 — Framework for building and testing ad jailbreak prompts. *(★ 886 · updated 2026-03-30)*

  • TextAttack 🟢🔬 — Python framework for ad attacks, data augmentation, and training for NLP models; useful for robustness testing beyond chat-only LLM scanners. *(★ 3,467 · updated 2026-08-15)*

  • GPTFuzz 🟢🔬 — Research framework for red-teaming LLMs with auto-generated jailbreak prompts. *(★ 604 · updated 2026-02-27)*

  • HarmBench 🟢🔬 — ICML 2024 standardized e framework for automated red-teaming and robust-refusal benchmarking. *(Center for AI Safety)* *(★ 1,029 · updated 2024-08-05)*

    • - Related: JailbreakBench · JailBreakV-28K (historical benchmark; no root license, education/research scope; separate image/model terms)
  • llm-attacks (GCG) 🟢🔬 — Canonical Greedy Coordinate Gradient ad attack implementation for transferable attacks on aligned language models. *(★ 4,761 · updated 2024-08-02)*

    • - Related: nanoGCG · LLM embedding-attack research (white-box embeddings, not an ordinary text API)
  • nanoGCG 🟢 — Fast, lightweight PyTorch implementation of the GCG ad algorithm. *(★ 346 · updated 2025-05-13)*

    • - Related: llm-attacks (GCG)
  • JailbreakBench 🟢🔬 — NeurIPS 2024 open robustness benchmark and leaderboard for generating and defending against LLM jailbreaks. *(★ 654 · updated 2025-03-31)*

    • - Related: MEGA security e artifacts (limited experiments, not independent rankings) · Chasing Shadows e artifacts (external data/models; some API/GPU experiments)
  • Open-Prompt-Injection 🟢🔬 — Open-source toolkit and benchmark for implementing and e prompt-injection attacks, defenses, and LLM-integrated applications. *(★ 479 · updated 2025-10-29)*

    • - Related: PromptInject (historical prompt-injection research)
  • PINT Benchmark 🟢🔬 — Prompt-injection test benchmark for e detectors and guardrails across multilingual prompt injection, jailbreak, benign, and hard-negati. *(Lakera)* — note: archi retained as a historical research reference; use newer maintained corpora for current detector comparisons. *(★ 198 · updated 2026-04-02)*

    • - Related: Open-Prompt-Injection · Prompt Guard 86M · Tensor Trust game/data tooling (historical; separate data, dependencies and deployment need review)
  • PIArena 🟢🔬 — ACL 2026 toolbox and benchmark for prompt-injection attacks and defenses, with ready-to-use attacks/defenses, e pipelines, agent benchmarks, a Hugging Face dataset, and leaderboard. *(★ 47 · updated 2026-04-20)*

    • - Related: PINT Benchmark · Open-Prompt-Injection
  • Whistleblower 🟢⚠️ — Offensi tool for inferring system prompts and disco capabilities of LLM applications exposed through APIs. *(Repello AI)* — note: no LICENSE file found. *(★ 177 · updated 2025-10-27)*

  • LLMmap 🟢🔬 — Minimal-query fingerprinting tool for identifying LLMs from beha traces, with a pretrained open-set inference model. *(★ 424 · updated 2025-07-24)*

  • llm-security 🔬 — Original PoC for indirect prompt-injection attacks. *(★ 2,128 · updated 2025-07-17)*

    • - Related: Dropbox LLM extraction research (historical code and results) · PIPE threat-model primer (2023 reference, not current API guidance; no root license) · HouYi (historical prompt-injection research) · RAG poisoning teaching PoC (AGPL-3.0; embedding weights/model endpoint required; not a benchmark)
  • JailbreakLLMs 🔬⚠️ — Research dataset of 6,387 ChatGPT prompts, including in-the-wild jailbreak prompts from Reddit, Discord, websites, and open datasets. *(★ 23 · updated 2024-02-21)*

  • Do-Not-Answer 🟢🔬 — Dataset for e LLM safeguards on unsafe or policy-sensiti. *(★ 341 · updated 2024-06-07)*

  • prompt-injection-defenses 🟢⚠️ — Curated catalog of practical defenses against prompt injection. *(★ 724 · updated 2025-02-22)*

  • little-canary 🟢🔬 — Prompt-injection preflight sensor that probes untrusted input with a powerless canary model and returns PASS, FLAG, or BLOCK with explicit co state before primary-agent action; includes opt-in Claude Code prompt-submission and OpenAI Agents SDK input-boundary adapters. — note: experimental sensing layer, not a security guarantee or runtime containment. A failed canary can return a routing with explicit degraded co; remote/OpenAI-compatible canary or judge endpoints receive raw input. *(★ 30 · updated 2026-09-14)*

    • - Related: Rebuff · prompt-injection-defenses
  • Kiji Privacy Proxy 🟢 — Local privacy proxy for OpenAI-compatible AI API traffic that detects and masks 26 PII types with an ONNX model before forwarding requests, then restores mappings in responses. *(Dataiku 575 Lab)* — note: protects configured proxied traffic, not every path by which an application or agent can disclose data; operators retain responsibility for proxy routing and local mapping storage. *(★ 422 · updated 2026-07-27)*

    • - Related: LLM Guard · Kiji PII model
  • Anamorpher 🟢🔬 — Research tool with a frontend and Python API for crafting and image-scaling attacks that reveal hidden prompt injections to multimodal AI systems after downscaling. *(Trail of Bits)* — note: active beta research tool for authorized testing; generated payloads are sensitive to the target's image-resampling implementation and preprocessing pipeline. *(★ 1,076 · updated 2026-02-19)*

    • - Sources: Trail of Bits research announcement
    - Related: PromptFuzz · promptfoo · In prompt-injection fixtures (hidden-content samples)
  • Prompt SIREN 🟢🔬 — Research workbench for de and e prompt-injection attacks and defenses with state-machine agent control, AgentDojo/SWE-bench integrations, configuration sweeps, and reproducible result aggregation. *(Meta AI)* — note: experiment harness; running target e requires model-provider credentials and may need Docker or browser extras depending on the selected en. *(★ 61 · updated 2026-05-18)*

    • - Related: AgentDojo · PyRIT
  • Argus 🟢🔬 — Black-box red-team framework for LLM applications and agents with target adapters, attack probes, deterministic and model-assisted judging, and SARIF, JUnit, HTML, and JSON reporting. — note: pre-1.0 project; full deployments use an orchestrator and PostgreSQL, while model-assisted judges require provider credentials. Attack-success and guardrail-impro figures are project-reported; probe only authorized targets. *(★ 204 · updated 2026-08-14)*

    • - Related: PyRIT · promptfoo
  • Cryptex OSS 🟢🟠 — Browser-based and self-hostable ad prompt workbench with transformation pipelines, campaign workflows, TAP/PAIR/Crescendo methods, and HarmBench/JailbreakBench-style corpora. — note: authorized-testing toolkit; provider keys are supplied by the operator and retained in browser storage. Included benchmark scoring is explicitly heuristic rather than paper-accurate, and the separate production product is closed-source. *(★ 339 · updated 2026-06-09)*

    • - Related: wallbreaker · HarmBench
  • API Relay Audit 🟢⚠️ — Local audit CLI for third-party LLM relays and proxies, testing prompt injection, model substitution, tool-call rewriting, streaming behavior, and relay-specific trust assumptions. — note: sends the supplied API credential to the relay being tested, so use a scoped disposable key and only assess services you are authorized to probe. Results identify suspicious behavior but do not certify a relay as safe. *(★ 803 · updated 2026-08-15)*

    • - Related: garak · LLMmap
  • AIDR Bastion 🟢🟠⚠️ — Runtime input-protection service combining detection rules, similarity search, classifiers, optional LLM analysis, and code-oriented checks to allow, block, or notify on suspicious GenAI traffic. *(SOC Prime)* — note: multi-service deployment can require OpenSearch/Elasticsearch, Qdrant, Kafka, and an optional local or hosted model; some rule and integration workflows connect to SOC Prime services. Treat it as a layered signal source, not a complete isolation boundary. *(★ 107 · updated 2026-08-20)*

    • - Related: LLM Guard · NeMo Guardrails
  • CaMeL 🟢🔬 — Research implementation of the capability-based CaMeL interpreter architecture for separating trusted control flow from untrusted data while e prompt-injection defenses on AgentDojo. *(Google Research / Google DeepMind / ETH Zurich)* — note: unsupported paper-reproduction artifact whose maintainers explicitly warn that the interpreter may contain bugs and may not be fully secure; do not treat it as a production guardrail. *(★ 379 · updated 2025-06-20)*

    • - Related: Defeating Prompt Injections by Design · AgentDojo · Agent-security lecture demos (no root license; CaMeL and external models required)
  • Meta SecAlign 🔬⚠️ — Research code, training recipe, and e harness for prompt-injection-resistant Meta SecAlign models across six security and eight utility benchmarks. *(Meta / UC Berkeley)* — note: most repository code is non-commercial while published model weights use separate Llama community terms; reproducing training or the full e requires substantial GPU capacity and optional provider credentials. *(★ 70 · updated 2026-06-11)*

    • - Related: AgentDojo · Meta SecAlign models · SecAlign (historical predecessor; CC BY-NC 4.0, noncommercial) · StruQ predecessor research (CC BY-NC 4.0; trained models/GPU, OpenAI utility e)

    Prompt-Injection Classifier Models

  • Wolf Defender Prompt Injection 🟢 — Hugging Face text-classification model for prompt-injection detection in agents, chatbots, and CI workflows. *(Patronus Studio / Casdo Labs)* *license: Apache-2.0 · access: open · artifacts: Safetensors, ONNX.*

  • DeBERTa v3 Prompt Injection v2 🟢 — Apache-licensed prompt-injection classifier usable pipelines and ONNX. *(Protect AI)* *license: Apache-2.0 · access: open · artifacts: Safetensors, ONNX.*

  • PromptGuard 🟢⚠️ — ModernBERT-based prompt-injection and jailbreak classifier. *(CodeIntegrity AI)* *license: Apache-2.0 · access: gated auto · artifacts: Safetensors.*

  • Prompt Guard 86M 🟠⚠️ — Meta prompt-injection and jailbreak classifier from the Llama Guard family. *(Meta)* *license: Llama 3.1 · access: gated manual · artifacts: Safetensors.*

  • prompt-injection-sentinel 🔬⚠️ — ModernBERT-large classifier for prompt-injection and jailbreak detection. *(Qualifire)* *license: other · access: gated auto · artifacts: Safetensors.*

    • Specialty Security LLMs

  • Foundation-Sec-8B-Reasoning 🟠⚠️ — Downloadable Llama-3.1-derived 8B reasoning model for cybersecurity analysis, threat intelligence, and multi-step security workflows. *(Cisco Foundation AI)* *license: Llama 3.1 Community License (base materials); Apache-2.0 (Cisco changes) · access: open · artifacts: Safetensors.* Caveat: not an Apache-only model; retain the base-model license and NOTICE obligations. Local inference needs a separate runtime and substantial memory, but no mandatory Cisco service. Security analysis can hallucinate; this is not a scanner or guardrail, and any tool-executing wrapper needs independent authorization and isolation.

  • SecGPT 🟢 — Open cybersecurity-tuned LLM family for analysis, log/traffic in, anomaly detection, attack/defense reasoning, command analysis, and security Q&A. *(Clouditera)* *(★ 3,099 · updated 2025-06-25)*

    • - Related: SecGPT model
  • Antares-1B 🟢⚠️ — Open-weight security SLM specialized for agentic localization: it explores repository snapshots through a terminal-style loop and ranks likely files for analyst review. *(Cisco Foundation AI)* *license: Apache-2.0 · access: gated manual · artifacts: Safetensors + CLI ZIP.* — note: HF access is gated/manual; related smaller model: Antares-350M, benchmark: VLoc Bench.

  • Trendyol Cybersecurity LLM v2 70B 🟢 — Defense-focused cybersecurity LLM based on Llama-3.3-70B, trained on an alignment-safe security instruction dataset for SOC, cloud, AppSec, detection, and workflows. *(Trendyol Group Security Team)* *license: Apache-2.0 · access: open · artifacts: GGUF.*

  • WhiteRabbitNeo 2.5 Qwen Coder 7B 🟢⚠️ — Cybersecurity-oriented Qwen2.5-Coder fine-tune positioned for offensive and defensi assistance. *(WhiteRabbitNeo)* *license: Apache-2.0 + WhiteRabbitNeo restrictions · access: open · artifacts: Safetensors.*

  • Lily-Cybersecurity-7B-v0.2 🟢 — Mistral-7B-Instruct fine-tune for cybersecurity assistance, trained on hand-crafted security and hacking-related instruction pairs. *(Segolily Labs)* *license: Apache-2.0 · access: open · artifacts: Safetensors.*

  • RavenX CyberAgent 35B Q4_K_M 🟢⚠️ — GGUF security-specialized text-generation model positioned for pentest, bug-bounty, tool-calling, MCP, CVSS/CWE, and MITRE ATT&CK workflows. *(RavenX LLC / DeadByDawn101)* *license: Apache-2.0 · access: open · artifacts: GGUF.* — note: built from an abliterated base model and marketed for autonomous security assessment; use only in authorized, sandboxed agent harnesses with tool-call .

    • ---

    LLM Honeypots & Deception

    Honeypots and deception that use LLMs to simulate con systems.

  • Beelzebub 🟢⚠️ — Low-code honeypot using LLMs to simulate SSH/HTTP/MCP services (Go). — note: GPL-3.0 licensed. *(★ 2,148 · updated 2026-08-11)*

  • DECEIVE 🟢🔬 — Proof-of-concept LLM-powered SSH honeypot that e sessions as benign, suspicious, or malicious. *(Splunk)* *(★ 288 · updated 2026-05-13)*

  • TRAP 🟢🔬 — Research code for Targeted Random Ad Prompt honeypots that identify black-box LLM usage through model-specific prompt suffixes (ACL 2024 Findings). *(★ 15 · updated 2024-11-20)*

  • shelLM 🟢🔬 — LLM-powered SSH honeypot (paper *"LLM in the Shell"*). *(★ 64 · updated 2026-06-25)*

    • - Related:
  • 🟢🔬 — Multi-protocol LLM honeypot framework (successor to shelLM). *(★ 78 · updated 2025-02-18)*

    • - Related: shelLM
  • llm-honeypot 🔬⚠️ — Cowrie SSH honeypot extended with prompt-injection traps to detect LLM hacker agents. *(Palisade Research)* *(★ 60 · updated 2026-01-23)*

    • ---

    CTF / Exploit / Bug-Bounty Agents & Benchmarks

    Offensi and the benchmarks used to e them.

  • OWASP PromptMe 🟢 — Intentionally Flask/Ollama lab with hands-on challenges based on OWASP LLM risks. *(OWASP)* Caveat: use a disposable isolated en without real data: examples bind to all interfaces, contain known training secrets, fetch URLs, and deliberately include fail-open behavior. Ollama and model weights are separate dependencies. *(★ 43 · updated 2026-09-10)*

  • Sherpa 🟢 — Hands-on MCP security lab pairing and hardened sample servers with authentication and authorization exercises. *(Microsoft Azure Samples)* Caveat: use an isolated teaching en; demonstration tokens and fixed identities are not production authentication. Azure-backed exercises require appropriate account permissions and may incur costs; sample fixes are not a complete application-security boundary. *(★ 29 · updated 2026-09-14)*

  • ExploitGym 🟢🔬⚠️ — Research benchmark and e harness for de exploits for known across userspace programs, V8, and Linux-kernel tasks, combining flag checks with model-based trajectory assessment. Caveat: executes real exploits against containers or VMs and can require host mitigation changes; use dedicated isolated infrastructure. Pro and model judges receive task context, task artifacts retain separate upstream licenses, and judge need review. *(★ 1,135 · updated 2026-09-29)*

  • Inspect Cyber 🟢🔬 — Installable Inspect extension for defining and running agentic cyber e with standardized YAML configurations, adaptable sandboxes, scenario , scoring, and sol . *(UK AI Security Institute)* — note: e framework rather than a benchmark result or defensi; Docker, Kubernetes, or other configured sandboxes can contain intentionally targets and should remain isolated from production networks. *(★ 40 · updated 2026-06-18)*

    • - Related: inspect_evals
  • GenAI Red Team Lab 🟢🔬 — Collection of intentionally GenAI sandboxes, exploitation examples, and tutorials for prompt injection, memory poisoning, orchestration attacks, guardrail bypass, and related red-team exercises. *(OWASP GenAI Security Project)* — note: training and research lab, not a scanner; it contains exploitation code and deliberately services that should run only in disposable isolated en. *(★ 53 · updated 2026-09-20)*

    • - Related: agent samples (CC BY-SA 4.0; isolated lab use, separate APIs/models) · Aembit agent-security control samples (teaching examples, not a production platform) · GenAI training labs (CC BY-NC notice plus go restriction; commercial/go reuse requires permission)
  • SWE-agent (EnIGMA) 🟢🔬 — EnIGMA offensi mode; SOTA on NYU CTF, InterCode-CTF, and Cybench (v0.7 branch). *(★ 20,069 · updated 2026-07-16)*

    • - Related: Cybench · NYU CTF Bench · InterCode
  • Cybench 🔬 — 40 professional CTF tasks across 4 competitions; widely used by AI safety institutes. *(★ 311 · updated 2026-07-09)*

  • NYU CTF Bench 🔬 — Dockerized CSAW CTF challenges for LLM-agent e. *(★ 170 · updated 2025-09-22)*

  • CTFTiny 🔬⚠️ — Lightweight CTF benchmark from the NYU LLM CTF group; GPL-2.0 licensed. *(★ 18 · updated 2026-03-10)*

    • - Related: NYU CTF Bench
  • InterCode 🔬 — Interacti benchmark incl. InterCode-CTF. *(★ 254 · updated 2024-05-05)*

  • inspect_evals 🟢🔬 — Maintained Inspect AI e suite containing multiple cyber benchmarks and tasks. *(UK AI Security Institute)* *(★ 627 · updated 2026-08-17)*

  • BountyBench 🔬 — 25 real systems / 40 bug bounties for Detect-Exploit-Patch e. *(★ 102 · updated 2025-06-22)*

  • Cyber-Zero 🔬 — Trains cybersecurity agents without runtime; ships an EnIGMA+ scaffold. *(Amazon Science)* — note: archi artifact retained as a historical reference for training cybersecurity agents without a li. *(★ 101 · updated 2025-09-02)*

    • - Sources: SWE-agent
    - Related: SWE-agent
  • ExploitBench 🔬 — Measures AI-agent progress on V8/Chromium exploit ladders. *(★ 344 · updated 2026-07-04)*

  • AI Goat 🟢🔬⚠️ — local LLM CTF for learning prompt injection, insecure output handling, data leakage, excessi, and related LLM app risks. — note: GPL-2.0 licensed. *(★ 355 · updated 2024-08-22)*

  • AIGoat 🟢🔬⚠️ — Local-first LLM security playground with guided OWASP LLM Top 10 attack labs, CTF challenges, progressi, and an Ollama-backed AI shopping-assistant target. — note: platform code is Apache-2.0, but training/challenge content is CC BY-NC-SA-4.0 and requires permission for commercial workshops. *(★ 76 · updated 2026-04-24)*

  • LLMVault 🟢🔬 — Intentionally LLM security-training platform with OWASP LLM Top 10 labs, CTF-style challenges, hints, scoring, and mitigation guidance. — note: deliberately training target; run only in an isolated, authorized en. Live Mode optionally requires Ollama or provider credentials. *(★ 296 · updated 2026-08-10)*

  • Damn LLM Agent 🟢🔬 — Deliberately LangChain ReAct agent for practicing prompt-injection and Thought/Action/Obser injection attacks. *(Re / WithSecure)* *(★ 505 · updated 2025-06-25)*

    • - Related: spikee
  • claude-bug-bounty 🟢 — Claude Code plugin orchestrating recon → vuln classes → reporting. *(★ 4,236 · updated 2026-08-10)*

  • Bug-Bounty-Agents 🟢 — 43 AI agent personas for Claude Code / Copilot / Cursor across the bug-bounty lifecycle. *(★ 369 · updated 2026-04-30)*

  • ai-exploits 🟢 — Real-world AI/ML exploits (Metasploit modules + Nuclei templates) for MLflow, Ray, H2O. *(Protect AI)* *(★ 1,745 · updated 2024-10-23)*

  • CyberGym 🟢🔬 — Large-scale e framework for AI-agent analysis on real-world tasks, with locally deployed challenge infrastructure, task generation, and proof-of-concept . *(UC Berkeley / Sunblaze)* — note: deploy only in an isolated local en; the full benchmark runtime is extremely large (documentation cites up to ~10 TB) and must not be exposed to the public internet. *(★ 737 · updated 2026-08-04)*

    • - Related: Cybench · C
  • C 🟢🔬 — ICML 2025 benchmark that e AI agents against reproducible Docker en for real critical-se web-application CVEs and exploit objectives. — note: runs intentionally services and should be used only in isolated en; arm64 support is experimental. *(★ 271 · updated 2026-01-14)*

    • - Related: CyberGym · BountyBench
  • SCAM 🟢🔬 — Benchmark for measuring whether tool-using agents recognize and resist realistic scams, social engineering, credential requests, impersonation, and unsafe multi-turn instructions across 30 scenarios and nine threat categories. *(1Password)* — note: e requires at least one configured model provider; leaderboard results and reported safety impro from the optional skill are project-reported, with raw result artifacts published for inspection. *(★ 136 · updated 2026-02-12)*

    • - Related: AgentDojo · Agent Security Bench
  • AIRTBench-Code 🟢🔬 — Research harness and dataset for e autonomous AI red-team agents on AI/ML security CTF challenges, with published task definitions and result artifacts. *(Dreadnode)* — note: the public code and dataset accompany arXiv 2506.14682, but reproducing the full e depends on Dreadnode's hosted Strikes en, platform access, model credentials, and containerized challenge infrastructure. *(★ 107 · updated 2026-04-26)*

    • - Related: Cybench · CyberGym
  • AI-Goat (Orca Security) 🟢🔬 — Deliberately AWS and Terraform lab for learning AI/ML infrastructure risks such as model supply-chain compromise, data poisoning, insecure output handling, and integrity failures. *(Orca Security Research)* — note: distinct from the local LLM playgrounds with similar names; deploys intentionally cloud resources and can incur AWS costs, so use only in an isolated authorized account and remo after each lab. *(★ 284 · updated 2025-09-16)*

    • - Related: AIGoat · AI Goat
  • LivePI 🔬⚠️ — Reproducibility artifact for a production-like indirect prompt-injection benchmark spanning live but test-controlled email, chat, web, local-file, repository, and wallet surfaces. — note: benchmark setup interacts with live test accounts and services and includes attack scenarios capable of exfiltration, unsafe execution, security-control changes, and value transfer; reproduce only in isolated infrastructure with synthetic credentials and explicit authorization. *(★ 9 · updated 2026-06-08)*

    • - Related: LivePI paper · AgentDojo

    ---

    Cloud / IaC / DFIR / OSINT / Phishing

    AI tooling for cloud/IaC security, digital forensics, OSINT, and phishing detection.

  • AWS AI/ML Security Assessment 🟢 — Security-posture assessment of AWS AI/ML services, including Bedrock, SageMaker, and AgentCore configurations. *(AWS Samples)* Caveat: requires AWS IAM permissions and deployed resources, with possible service costs; reports can expose sensiti details. A configured prompt-attack filter is not e of attack resistance, and standards mappings are not compliance certification. *(★ 47 · updated 2026-10-04)*

  • AIFT 🟢⚠️ — Python forensic-triage application that parses disk images and collected Windows/Linux artifacts with Dissect, then produces model-assisted reports through GUI, CLI, REST, or MCP interfaces. Caveat: AGPL-3.0 licensed. Hosted pro recei e; local models require separately supplied runtimes and weights. Use e copies and independent integrity controls, and keep API access trusted. Outputs are in leads requiring examiner , not final forensic conclusions. *(★ 48 · updated 2026-06-13)*

  • 🟢 — Analyst-directed incident-response platform combining a Python case-management CLI with SIFT MCP services for e processing, draft findings, human review, and report generation. Caveat: alpha; full deployment needs companion SIFT MCP packages and optional forensic VMs or OpenSearch. Loaded e may reach configured model pro. Lite has no sandbox or deny rules, tools can execute on the host, and e integrity and findings require independent examiner controls. *(★ 106 · updated 2026-10-04)*

    • - Related: SIFT MCP backend
  • EscalateGPT 🟢 — GPT-based discovery of pri paths in AWS IAM policies. *(Tenable)* *(★ 122 · updated 2024-01-17)*

  • Cynative 🟢 — Local AI security research agent for cloud, code, and runtime en across GitHub, GitLab, AWS, GCP, Azure, and Kubernetes, with read-only action gates, sandboxed code execution, e , and audit logs. *(★ 190 · updated 2026-08-14)*

    • - Related: Fraim · EscalateGPT
  • Julius 🟢 — Local Go tool that fingerprints LLM service infrastructure on authorized endpoints, identifies 60+ serving, gateway, MCP, and RAG platforms, and can enumerate exposed models. *(Praetorian)* — note: use only against endpoints you own or are authorized to assess. *(★ 208 · updated 2026-08-06)*

    • - Related: AI-Infra-Guard · ai_osint
  • MemoryIn 🔬 — 3 + LLM + RAG for memory-forensic triage. *(★ 13 · updated 2025-09-16)*

    • - Related:
  • 🟢 — MCP exposing 3 plugins for natural-language memory forensics. *(★ 39 · updated 2025-07-07)*

    • - Related: MemoryIn
  • llm_osint 🟢🔬 — Proof-of-concept LLM OSINT framework using knowledge and web agents for internet research workflows. *(★ 317 · updated 2024-11-02)*

  • ai_osint 🟢 — Curated AI-OSINT dorks, queries, and techniques for disco exposed LLM and AI infrastructure. *(★ 154 · updated 2026-06-19)*

  • PhishLLM 🔬⚠️ — Reference-less phishing detection via LLM brand recognition (USENIX'24). *(★ 39 · updated 2026-06-04)*

    • - Related: PhishVLM
  • mcp-dnstwist 🟢 — MCP server for dnstwist DNS fuzzing to support typosquatting, phishing, and lookalike-domain analysis. *(★ 51 · updated 2025-03-03)*

  • osintgpt 🟢⚠️ — OpenAI embeddings + Qdrant o corpora. *(★ 525 · updated 2023-12-11)*

    • ---

    Related Awesome Lists

  • Jailbreak Obser — Classified bibliography and of LLM jailbreak research; no root license was found, and publication labels are not independently . *(★ 23 · updated 2026-10-01)*

  • Awesome Agentic Security — Sur co agent attacks, defenses, and security applications; an MIT badge is present but no root license file was found. *(★ 57 · updated 2026-08-24)*

  • Awesome LLMSecOps — Resource directory co LLM architecture, operations, threat modeling, and security; no root license was found. *(★ 162 · updated 2026-09-27)*

  • Awesome GenAI Security — GPL-3.0 collection of GenAI and agentic-security references, tutorials, labs, and testing resources; linked artifacts retain their own terms. *(★ 78 · updated 2026-09-29)*

  • Awesome Hacking with AI — Directory of AI-assisted security and AI-system security resources co agent safety, MCP, red teaming, and detection engineering; linked projects require separate review. *(★ 28 · updated 2026-10-02)*

  • AI/ML Security and Prompt-Injection Resources — AI-security learning roadmap and resource directory that distinguishes historical and un material; no root license was found. *(★ 801 · updated 2026-09-19)*

  • Awesome AI Security TR — Turkish-language annotated directory of prompt-injection, red-teaming, guardrail, agent, MCP, and RAG security resources under CC BY 4.0; link checks do not security claims. *(★ 13 · updated 2026-08-28)*

  • Awesome Prompt Injection — CC0 resource list focused on prompt injection and related machine-learning security references. *(★ 666 · updated 2026-09-11)*

  • Awesome AI Red Teaming JP — CC0 collection of Japanese-language AI red-teaming and safety resources. *(★ 13 · updated 2026-06-20)*

  • Arcanum AI Security Resources — Categorized directory of AI-security labs and competitions; no root license was found, and external a or free access is not guaranteed. *(★ 513 · updated 2026-07-03)*

  • Awesome Agentic MCP Security — CC0 collection of agentic-AI and MCP security resources. *(★ 21 · updated 2026-09-26)*

  • Awesome Agent Sandbox — Directory of agent sandbox runtimes and comparisons; no root license was found, and performance or security comparisons are not independently . *(★ 18 · updated 2026-07-07)*

  • Awesome Agent Sandboxes — Directory of self-hosted and cloud code-execution sandboxes for AI agents; no root license was found, and listed products offer differing isolation boundaries. *(★ 49 · updated 2026-08-19)*

  • Awesome LM Safety, Security, and Privacy — Apache-2.0 bibliography of language and multimodal model safety, security, and privacy research; linked publications, models, and datasets retain their own licenses. *(★ 2,082 · updated 2026-09-02)*

  • Awesome AI Security (DeepSpaceHarbor) — Historical collection of ad examples, e, poisoning, and ML-security research code; no root license was found, and recent commits do not establish the currency of linked material. *(★ 1,680 · updated 2026-03-08)*

  • Awesome LLM Agent Security — Unlicense bibliography of LLM-agent security research, attacks, and ; linked papers and code retain their own terms. *(★ 58 · updated 2026-07-11)*

  • Awesome MLLM/LLM Guardrails — Focused research index of text and multimodal guardrail models, moderation datasets, jailbreak studies, e resources, and runtime frameworks; linked artifacts retain their own terms. *(★ 31 · updated 2026-09-03)*

  • awesome-security-agent-harnesses — Focused CC0 catalog of and pentest agent harnesses, security skills, sandboxes, MCP integrations, benchmarks, and e research. *(★ 22 · updated 2026-09-04)*

  • awesome-llm-cybersecurity-tools — Tenable's list (archived but a strong reference). *(★ 488 · updated 2024-04-08)*

  • Awesome-LLM4Cybersecurity — 600+ papers on LLMs for cybersecurity. *(★ 1,748 · updated 2026-07-08)*

  • awesome-ai-cybersecurity — Broad AI-for-security collection. *(★ 151 · updated 2026-08-13)*

  • awesome-genai-cyberhub — GenAI-dri resources. *(★ 54 · updated 2026-08-07)*

  • awesome-ai-security — For pentesters, bug hunters, and researchers. *(★ 39 · updated 2026-08-17)*

  • awesome-ai-security — AI security resources. *(★ 1,397 · updated 2026-08-16)*

  • Awesome-AI-Security — AI security resources. *(★ 853 · updated 2026-07-18)*

  • Awesome-AI-For-Security — AI-for-security tools, papers, and datasets. *(★ 146 · updated 2026-08-13)*

  • awesome-cybersecurity-agentic-ai — Agentic-AI cybersecurity tools and security MCP servers. *(★ 536 · updated 2026-06-28)*

  • awesome-ai-agents-security — Focused map of AI-agent security resources across runtime protection, red-teaming scanners, static analysis, sandboxing, guardrails, benchmarks, and identity. *(★ 63 · updated 2026-06-12)*

  • Awesome-Offensi — Offensi landscape co open-source pentest/red-team agents, offensi models, papers, benchmarks, and commercial tools. *(★ 214 · updated 2026-07-20)*

  • awesome-ai-agent-attacks — Sourced timeline of real AI-agent security incidents, breaches, , and attack techniques. *(★ 65 · updated 2026-08-11)*

  • AI Security Repository Radar — Daily-updated AI/LLM/MCP/RAG security repository radar with category, license, stars, and quality/relevance metadata. *(★ 5 · updated 2026-08-17)*

  • awesome-MLSecOps — Curated MLSecOps resources spanning ad ML, LLM security, AI red teaming, model scanning, supply-chain protection, and MLOps pipeline security. *(★ 450 · updated 2026-08-15)*

  • awesome-ai-guardrails — Catalog of AI guardrail models, tools, organizations, datasets, and papers, with useful Hugging Face model co. *(★ 64 · updated 2026-07-30)*

  • open-source-llm-scanners — Open-source LLM scanners and testing tools. *(★ 109 · updated 2026-02-05)*

  • awesome-mcp-security — MCP security resources, tools, writeups, and ser risk references. *(★ 729 · updated 2026-03-03)*

  • awesome-ml-security — Trail of Bits' curated machine-learning security resources. *(★ 170 · updated 2026-02-06)*

  • awesome-ml-pri — Machine-learning pri papers and resources. *(★ 640 · updated 2024-03-18)*

  • awesome-ml-for-cybersecurity — Large classic list of machine-learning-for-cybersecurity resources (stale-ish but still useful). *(★ 9,290 · updated 2024-04-11)*

  • Awesome-AI4De — Taxonomy of AI-dri solutions for De. *(★ 19 · updated 2025-07-02)*

  • awesome-llm-security — Securing LLMs. *(★ 1,683 · updated 2025-08-20)*

  • awesome-gpt-security — GPT/LLM security tools and cases. *(★ 669 · updated 2026-07-24)*

  • awesome-threat-intelligence — Classic CTI list (pairs with the AI-CTI section). *(★ 10,541 · updated 2026-05-31)*

  • awesome-threat-modelling — General-purpose threat modeling list — methodologies and non-AI tools (Threat Dragon, pytm, Threagile); dormant since 2023 but a solid reference. *(★ 1,793 · updated 2023-07-15)*

  • Awesome-LLMs-for- — Focused, continuously updated index of LLM-based software- detection research across function, repository, agentic, and smart-contract analysis, including datasets, benchmarks, and surveys. *(★ 1,239 · updated 2026-08-16)*

    • ---

    Contributing

    Contributions are welcome! This README is generated from structured data.

    1. Edit data/sections.json ( by data/schema.json).
    2. Use structured fields such as status, flags, and license; do not paste rendered emoji tags into the data.
    3. Regenerate and check the README:

    Example entry:

    Status : open_source, research, commercial_open. Common flags: license_caveat, early_stage, archived, hea, requires_api_key, authorized_testing_only, commercial_features, telemetry, model_dependent, research, no_license, noncommercial, copyleft, abliterated_or_uncensored.

    Guidelines: link the canonical upstream repo (not a fork); the URL resolves; tag the correct type and add a caveat flag/note for non-permissi, unclear, missing, or restricti; prefer real, installable projects o references.

    For Hugging Face model entries, include the model id, license, access status (open/gated), and artifact formats (for example Safetensors or ONNX).

    Contact

    Maintained by Sergey Gordeychik — scadastrangelo.com · blog · .

    License

    To the extent possible under law, the contributors ha all copyright and related rights to this list (CC0-1.0). Linked projects retain their own licenses — check each before use.

    项目信息

    开发语言：Python

    Star 数：1582

    技术要点

    该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

    从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

    使用与学习建议

    1. 下载源码压缩包，解压到本地环境。

    2. 根据项目类型准备对应的运行环境与依赖。

    3. 按照 README 中的步骤完成配置与部署。

    4. 在隔离的测试环境中运行验证，避免影响生产系统。

    免责声明

    本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

    资源标题awesome-ai-security-tools - A curated list of public-source, research, and com
    所属分类安全软件
    发布作者admin
    发布时间2026-10-05 22:31:10
    下载权限 免费下载
    附件数量2 个下载链接
    浏览次数481
    讨论数量0
    主题状态正常讨论中

    本资源免费，登录后即可在本页「下载链接」区域获取全部附件。

    请在评论区留言说明具体链接，或联系作者补档。楼主更新后本页会同步最新的下载地址。

    请先阅读正文中的授权说明；未注明的默认仅限站内学习交流，禁止直接搬运到其他站点二次售卖。
    还没有讨论，快来抢沙发～
    登录 后才能参与讨论
    下载链接
    会员才能下载
    登录后开通会员
    同分类推荐
    暂无同类资源
    免费登录即可下载
    查看会员
    放大预览

    © 2026 剑庭安 - 网站开发定制 SEO 优化蜘蛛池代做 在线看手相算命. 保留所有权利。

    Powered by 酷像SEOv3.0

    网站地图 Sitemap.xml
    首页 全部分类 黑客安全 逆向|反编译 精品源码 站长工具自助开通会员其他资源SEO工具站群源码泛程序蜘蛛模板蜘蛛池外链工具创意乐园 搜索 会员服务 登录 注册