Share the already authenticated session, encrypted with AES individually. The recipient joins with one click. You revoke whenever you want.
AI translation
Security projects
Loading…
Security projects
Public projects with traces of AI coding tools in their repositories, sorted by newest listing.
Security · 1,343 projectsReset filters
Logto adds multi-tenancy, enterprise SSO, and RBAC to your SaaS or AI apps. All with OIDC and OAuth 2.1 made simple, fast, and developer-friendly.
The StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides recommendations to proactively improve security by
A fruit-fly escape reflex, compiled to 173 NAND gates and 6 latches, evaluated gate by gate in your browser inside a voxel world.
A unified, one-command SSO Manager + OIDC proxy stack for home labs and small businesses. Wires together a self-hosted identity provider and a reverse proxy with one setup.sh.
Upload a photo, detect faces with multiple models, blur them, and strip metadata — privacy-first face anonymization.
Free read-only Lite lists every custom Wazuh rule that never fired and the likely reason, including rules dropped at load (7617/7619).
A web management tool that supplements the Wazuh Dashboard: agents, groups, cluster nodes, rules and decoders, ready-made detection packs, API users and logs. Bilingual English / 繁體中文, AGPL-3.0.
Translation pending
Your infrastructure, off the map. The qURL Connector hides your apps and APIs from public scans. One API call creates a private access link for a person or AI agent, with the scope, expiry, and sessio
OSS-Fuzz - continuous fuzzing for open source software.
ThreatLens simulates realistic SOC investigations across identity, endpoint, email, and cloud — and grades your investigation against a hidden ground truth. Not a SIEM. A cyber range for analysts.
Upload. Secure. Retrieve anytime. Keep a private, independent copy of the content your business depends on.
Maester is a test automation framework to help you stay in control of your Microsoft security configuration.
Evidence-first network configuration auditing: every authoritative finding cites the configuration line that proves it.
Check an OpenCloud instance for known vulnerabilities, missing hardening, weak security headers and available updates. Free to use, with no account required.
GameDay testing for MCP servers. Four named experiments over the JSON-RPC wire, in a sandbox, with scripted and local-model seats. Receipts, tapes and a dataset come out. The oracle is the wire, not t
VpnHood is a free, open-source VPN designed to be undetectable, even in restrictive networks — disguising traffic as ordinary browsing to get past firewalls.
Holdcall sits between your agent and its MCP tools. It decides every call on your machine, shows you the real arguments before anything dangerous runs, and keeps a record you can verify offline.
A small key that plugs into USB. Touch it to unlock, approve and authenticate — never a password.
🏆This is the Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)
AI translation
Verified provenance entries and immutable historical timelines on Avalanche.
Translation pending
Every connection across the organisation, wherever it runs, protected against tomorrow's decryption. Control stays in-house, always.
Translation pending
Get real SIM-based temporary phone numbers instantly. Receive SMS verification codes for 1,300+ services across 150+ countries. Pay only when a code arrives — automatic refund if it doesn't.
Translation pending
Arcjet is the AI agent runtime security platform. Discover the agents running in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence to prove what happe
Analyze JavaScript/TypeScript code in the browser to detect security vulnerabilities without uploading the code to a server.
AI translation
AI summary · website and README
Manage your Keycloak from your AI assistant: clusters, realms, apps, SSO, custom domains, WAF, webhooks and SIEM. One command, browser sign-in, no API key.
Infrastructure that turns AI agent decisions into signed records. The record stays on your machine.
Verifiable provenance on every AI verdict. Open source. On-premise. No cloud dependency.
Translation pending
Detection rules (Sigma-compatible core), real-time Endpoint Security, behavioural scoring, AI coding guardrails, and Agent Traces — W3C TRACEPARENT correlation between AI-agent activity and kernel eve
Automated data broker opt-out runner — removes your personal info from 30+ people-search sites on a monthly schedule
Agadar — scam-message detection for Sorani Kurdish and Iraqi Arabic, with the reasoning shown. Runs entirely in your browser. Python, scikit-learn, char n-grams.
Security scanner for AI agents, MCP servers and agent skills.
TrustTab verifies which of your site's forms are safe and correctly structured for AI agents to act on, and issues a badge anyone can check.
Wazuh is a free and open source security platform that unifies XDR and SIEM protection for endpoints and cloud workloads.
An open standard letting a nonprofit publish, from its own domain, a machine-readable declaration of the giving destinations it authorizes. Consumed by AI agents through W3C WebMCP.
13 layers of defense in depth, subscription metadata encryption, zero frontend frameworks, and a Lite edition of only 8MB. Built on Tauri v2 + Rust, open source and free.
AI translation
A multi-client subscription conversion backend evolved from subconverter, focused on enhancing Mihomo Provider, remote resources, security, and multi-platform deployment.
AI translation
Działa na Twoim komputerze. 98,9% pełnych nazwisk, 23 rodzaje numerów, podmiany odwracalne.
Translation pending
Lightweight, fast web security proxy built in Rust. Capture, replay, fuzz, and scan.
DIY airgapped hardware wallet that uses QR codes for communication with the host
See where any domain stands in the BlackVeil Global Security Index, or run 17 NIST-aligned checks free — then verify, fix and continuously monitor it.
Cognitive Deterministic Memory Security OS for Agentic AI that reaches backward through time to find the quiet change behind today's failure, not the lookalike. Intelligence is not a cloud subscriptio
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills befo
Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Ubuntu. Limited
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
An execution-authority gateway for AI agents and APIs. It intercepts consequential HTTP actions, asks Decionis whether they are authorized, and forwards exactly the authorized request once on a single
pinact is a CLI to edit GitHub Workflow and Composite action files and pin versions of Actions and Reusable Workflows. pinact can also update their versions and verify version annotations.
A maritime monitoring system for the waters around Taiwan based on CSIS methodology, integrating SAR satellite and AIS data to track dark vessels and suspicious maritime activities
AI translation
Single-file browser client for the Have I Been Pwned API. No API key, no backend. Passwords are hashed locally and only a 5-character SHA-1 prefix is ever sent.
Vero is a verifiable credibility layer for people and organisations publishing online, built on Midnight. Prove a relevant credential or accountability claim — and choose what you reveal.
Online signature verification from stroke dynamics, benchmarked on SVC2004.
Translation pending
Recover ZecWallet Lite seeds, zcashd wallet.dat files, and standalone Sapling or Sprout keys with a local-first desktop flow.
Free sanctions screening, PEP checks, and adverse media search tool. Plus a comprehensive AML Knowledge Hub covering MLR 2017, POCA 2002, and FCA compliance. Built for compliance professionals.
Scan any Base coin for rugs before you buy: a 0–100 safety score in the feed.
Something feels off? Check the vibe. A second opinion for messages, profiles, invitations and offers: warning signs of scams, grooming, coercion and exploitation, and where to get help.
Live in-browser multi-person pose tracking and zone-based behavior detection. It runs entirely client-side with no backend and no uploads required.
AI translation
106 curated security scans of open-source AI agents, MCP servers and LLM apps - 24 confirmed fixes, run local-first with Semgrep, Gitleaks, Trivy and pip-audit.
Plataforma SaaS completa para adequação à Lei Geral de Proteção de Dados
Translation pending
The Kubernetes-native policy enforcement plane for MCP. Deterministic admission and egress policy, attributable audit, and SIEM export — MIT, self-hosted, no SaaS.
Sandboxes isolados e descartáveis para agentes de IA: MCP, CLI, dashboard web e app nativo de macOS. Rede desligada por padrão, allowlist de domínios e trilha de auditoria. Go + SwiftUI.
Translation pending
Detect and anonymize sensitive entities in text using LLM-powered workflows
Replays sandbox test results comparing how different Git workflow setups resist attacks
Translation pending
AI summary · revised during review
Face ID-style unlock for Omarchy: the infrared camera recognises you at the lock screen, at sudo and in polkit, while your password stays the real key.
Open-source Aadhaar, PAN, GSTIN & UPI detection and reversible masking for AI prompts. Runs on your infrastructure. MIT.
Not everyone is a developer. Not everyone has to be.
Translation pending
The primary threat is accidental destruction — an agent that misreads a path and deletes the wrong folder — not a determined attacker. Network isolation is secondary and off by default; an AI CLI that
Agentic AI Platform for Enterprises. Securely connect all your data and systems. Operate trusted AI with built-in security and governance.
CI/lock collects trusted telemetry across every checkpoint between commit and production — CI/CD builds, security scans (SAST/DAST/SBOM), runtime + cluster integrity (Falco, Linkerd mTLS, kube-bench),
Translation pending
The local-first credential vault your AI agents can use — but never see. 66 testable security constraints. Rust.
AI Agent City is the operations layer for the agent economy: spending limits, monitoring, security, trust, and discovery for AI agents. Human-readable and machine-readable.
Custos demo wallet — mô phỏng và giải thích giao dịch Solana Devnet trước khi ký.
Translation pending
GDPR Chapter V Transfer Impact Assessment skill for Claude — EDPB six-step methodology, CNIL three-way Step 3, four essential guarantees, 12 country profiles, balanced Art. 49 analysis, RoPA interchan
Translation pending
GDPR Breach Response Sentinel Agent Skill (open standard) — ENISA severity assessment, EDPB case matching, Art. 33/34 notification support, audit-ready .docx generation
Translation pending
Read-only macOS notch + menu bar monitor for Claude Code and Codex. Open source, free, local-only. Risk-scores every tool call and tracks the footholds agents leave behind.
A policy-enforcing filesystem for AI agents. Point it at a real project directory and it serves a filtered mirror — same paths, same sizes — deciding per read which face of each file to show.
Low-latency bot detection for Apache 2.4 with proof-of-work challenges, shared-memory reputation, crawler policy, and built-in observability.
Technology consulting rooted in Albion, Michigan. Built on trust, crafted with care.
Short-lived SSH certificates from your identity provider, for ssh, sudo, and the console.
mcp-skills-vault installs MCP servers safely. mcp-trace shows what they're actually doing. Offline-first. No telemetry.
Translation pending
Trust intelligence scoring for OSINT sources — behavioural reliability analysis, GDPR & EU AI Act compliant.
Translation pending
Browser-based web exploitation challenge platform powered by WASM
Translation pending
The deterministic structural architecture of massive software repositories.
Translation pending
Hardened Podman container runner with gate server and shield integration
Just-in-time access. A little less clicking around. For macOS, Windows and your terminal.
Self-hosted MCP gateway: AI agents get audited, SSO-gated, read-only database access without ever holding a DB credential.
Translation pending
SWARM: open-source multi-agent AI safety framework. Measure toxicity, governance gaps, and emergent risks with soft probabilistic labels.
Sandbox your LLM coding agents on macOS. Kernel-level enforcement via sandbox-exec — deny-first, composable, zero dependencies.
Belay is a local-first security layer at the tool-call boundary of AI coding agents. Deterministic, sub-100ms, fail-closed. Detect, block, and get notified — no LLM in the decision path.
Hub + agent + device integrations: live packet measurement, process-based L7/DNS visibility, TimescaleDB + NATS scaling infrastructure, RBAC/SSO, and 5651-compliant signed logs. Open source, MIT, self-hosted.
AI translation
Production-ready security scanning platform with 28 scanners, OPA Policy-as-Code, historical storage, trend analysis, and compliance automation across 6 asset types
eCapture is for capturing SSL/TLS text content without a CA certificate using eBPF.
AI translation
Open-source SCA platform — CVEs, licenses, and SBOMs in one place
All things related to automation and development with Cortex XSOAR (formerly Demisto)
A deny-by-default contract layer for AI agent tool calls - strict argument validation, ghost-argument stripping and self-healing retries, in-process and Pydantic-only
Discover, remediate, verify, and gate human- or agent-written code with a local, policy-bound, audit-ready security runtime.
ORES: Open Risk Evaluation & Scoring - A universal, open-source engine to standardize cybersecurity risk scoring
Translation pending
Scope-locked security review for teams that own or are authorized to test their assets.
Seal is a local approval gate for selected Claude Code MCP tool calls.
Govern connected AI clients, models, and tools on your infrastructure. Centralize access policies and audit, then build custom capabilities on the SystemPrompt runtime.
Free, open-source CLI and MCP server that keeps API keys in your OS keychain and serves them to Cursor, Claude Code, and Kiro. No cloud, no account, no .env file.
AI security from risk map to reference architecture: the full CoSAI taxonomy, the MITRE mitigations that support its controls, and target-state architectures for every class of AI application.
177 scenarios across 16 Cortex detection planes. Controlled signal generation for XSIAM/XDR detection validation.
Translation pending
A rubber band around Claude's claws. Blocks rm -rf and other destructive commands before they run, so bypassPermissions mode is actually safe.
Collective discovery for open cryptographic challenges. Contribute GPU time to a public elliptic-curve search, earn credit for verified work, share the prize when the answer is found.
Choose the assets. Run applicable upstream security checks. Read one report organized by asset and priority.
Test your vibe-coded apps, hunt down hallucinated packages, logic bugs, and secret leaks, and fix them in seconds. Works inside Cursor, Claude Code, GitHub Copilot, and Windsurf.
Small Print is a nightly record of the tool descriptions, schemas and instructions that MCP servers, agent skills and plugins give your agent: every version hashed, every change diffed and graded by a
Sane WordPress defaults with actionable Site Health reporting for security, privacy, performance, and core updates — including same-line security patches.
The archive feature Graylog Open is missing — self-hosted, streaming, with independent compliance audit.
Blocks credential exfiltration, config harvesting, and secret leakage before the network call fires. Behavioral sequence detection at the runtime level — not prompts.
AI Ops for Bring Your Own Agent (BYOA) teams. Audit coworker harnesses with doorman dashboard, mine prompt history for capability needs, and block rogue tools at the gate.
The Zanii transparency log, live: verifiable AI-agent actions streaming in real time.
Translation pending
Install Know Your Agent with npx in minutes. Offline demo, MCP gate, local free console, or enterprise hosted. No private protocol.
Daily Internet.nl standards measurements of a real fleet, made by the unmodified internetnl CLI against a self-hosted netnl facade.
Translation pending
Your agent knows a lot about you. Sanctuary keeps that information private. A firewall for your AI agent that runs on your own Mac, enforcing what it can reach at the operating-system level with keys
Self-hosted, metadata-only visibility and guardrails for the AI coding tools your engineers use. Never prompt text, never source code.
Verify once, access everywhere. KYC, KYB, and KYA compliance credentials via encrypted tokens and Interchain Messaging (ICM) on the Avalanche® blockchain. Non-custodial, software-only, no PII stored.
Fast, private, free. Strip EXIF metadata from photos, videos, and PDFs.
Local-first pentest agent: Go daemon + React dashboard + Codex/Claude Code/Pi runtimes, scoped projects, Blackboard, sandbox runners
Translation pending
Orca Security provides agentless, workload-deep, context-aware cloud infrastructure security and compliance through our comprehensive cloud security solution all in a single platform.
Translation pending
Verify Pakistani online stores and sellers before you pay, and file structured fraud disputes when something goes wrong. A free public database of reported scams, blacklisted brands, and dispute outco
Walletbeat is an Ethereum wallet rating site. It aims to provide a trustworthy, up-to-date source of information about the state of the Ethereum wallet ecosystem
An open-source OAuth2 and OpenID Connect server for simple, secure authentication.
Agents generate actions. rv authorizes them before they run. Hook-grade allow/deny for Grok, Pi, OpenCode, Claude, OpenClaw, Hermes, Codex, and Cursor.
Fine Grain Access Control proxy for AI Agents using Google APIs.
Open-source security audit for your AI agents: the skills they run, exposed secrets, risky MCP config, and unsafe updates. Runs on your machine.
BitGraph allocates an unused position before it receives a file's SHA-256 fingerprint, then binds the fingerprint to that position and consumes it. The proof is a file you keep. It verifies offline.
Open-source cryptographic receipts, identity, and audit trails for AI agent sessions. Like TLS certificates, but for agents.
File transfer, datarooms and deposit boxes. End-to-end encrypted. Hosted in Europe.
Translation pending
Open-source AI API audit proxy with tamper-proof evidence chain
ASCII-only by default, no escape parser, a paste warning and reveal modes, memory-safe. An opt-in TUI mode runs ssh, vim and htop, still filtering every character. Copy commands in and text out withou
Translation pending
Master prompts that turn any AI coding agent into a swarm of specialist auditors — evidence-bound, adversarially verified, filed as GitHub issues in German or English.
The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.
Find the plaintext secrets on your Mac and move them into an encrypted vault. Your files keep working, and only the command you run gets the real value. macOS, no account, no telemetry.
One compiled binary puts guardrails under the agent you already run: a destructive tool call is denied before it executes, every milestone needs a contract a human approved, and every execution leaves
Free, open-source CLI for scanning, SBOM generation, vulnerability auditing, and AI-agent-driven dependency analysis.
Verified agent actions: authorization policy, signed receipts, and audit evidence for AI agent tool calls. One command to protect any MCP server.
Local-first session transfer on macOS: Chromium browsers, ChatGPT Codex, experimental Cursor import, encrypted Grok Bot export, and optional Browserless Cloud.
Translation pending
Glaurung is a pre-1.0, AI-native reverse-engineering toolkit with a fast Rust core, a Python API, optional agent workflows, and provenance-aware SQLite project files.
Turn code-review findings into targeted security tests, then generate vulnerability reports for the risks that are proven to matter.
Turn an AI eval result into one portable, offline-verifiable receipt and chain it: eval receipt, decision receipt, outcome receipt. Ed25519 + RFC 6962 Merkle, no server, no network.
Harness, manifest, backend. Manager token stays out of the child environment. Bitwarden SM, 1Password, pass, sops. macOS and Linux.
Audit the Agent Skills installed on this machine for security, trustworthiness, spec conformance, context cost, and trigger quality, then produce a graded…
An agent escape can be built from actions your guard already approved. plumbline scores the sequence, not the step.
Comprehensive ESLint plugins for security vulnerabilities, code quality, and architecture governance in JavaScript and TypeScript projects.
Find out what an attacker can make your chatbot do. Open source, Apache 2.0, runs on your machine or in your CI against your own deployment.
Enforce what an agent can do, prove what it did, and watch for what slipped through. Open, composable, verifiable.
Block prompt injection before your AI agent reads it. Open source, local first, MIT licensed.
Durable, per-user memory for AI agents that resists injection and confabulation. Structural quarantine of third-party claims, grounded-or-silent abstention, supersession without erasure. One SQLite fi
Semantic SBOM & CBOM diff in Rust. Compare CycloneDX/SPDX, score compliance, and enrich with OSV/KEV data. Fast, CI-ready.
The security agent for vibe-coded apps. Kelp probes your backend the way an attacker would and hands you the fix — ready to paste back into your AI tool.
Aegis ShellGuard is a Rust shell guardrail for AI coding agents. rm -rf, git reset --hard and DROP TABLE wait for your approval; safe commands pass through in under 2 ms.
Security coaching and compliance training in Slack and Microsoft Teams, plus open-source skills for AI coding agents.
Give AI agents page automation and direct HTTP control for authorized web red teaming. Configure sandbox and network limits, then review the session. Pure Rust, no Chromium or V8.
Autonomous bug bounty platform with AI agents that hunt like predators. Isolated sandboxes. HackerOne-ready reports. Try free.
Intutic is the open-core Policy as Code layer for Continuous Compliance and Continuous Enforcement for AI agents — the circuit breaker that sits between your agents and production, evaluating every to
Self-contained, air-gapped Bitcoin key and wallet calculator. Turn dice rolls, seed phrases, and private keys into wallet recovery information — entirely offline.
AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platform
Translation pending
Prove you're a real, unique person once — then reuse it everywhere. No name, no face, nothing stored.
Translation pending
See every device on your home network - including the Zigbee, Z-Wave, Matter and Bluetooth LE ones an IP scan cannot find. Self-hosted, MIT, with two-way Home Assistant integration.
Alpacon is the AI-native privileged access management (PAM) platform. Zero-trust tunnels, command-level permissions, and full session audit trails.
An Arch-based Linux distribution that runs a local LLM as a system service: AI-native shell, wlroots Wayland desktop, security monitor, kernel module. No cloud, no API keys.
Translation pending
Free and open source. An AI reads the security alerts your tools raise, tells you which ones matter, and asks before it does anything. Runs on your own computer.
DefectDojo unifies and automates vulnerability management, enabling security teams to focus on prioritizing and remediating the most critical vulnerabilities. We help teams reduce time spent on manual
ProofLedger anchors SHA-256 hashes of your files to Polygon and Bitcoin, by API or the free web tool, establishing a neutral record of what existed and when. The file never leaves your machine and any
Don't trust one AI. Verify with five. Multi-model research, claim verification, video authenticity, and governance — with audit trails.
Open-source based behavioral validation for agentic AI. Close the Behavior Gap before your AI agents reach production.
ENS subnames are revocable powers of attorney for AI agents. Arc is where they spend.
Search usernames across a wide range of platforms, check emails and passwords against breach data, and investigate domains, DNS, and IP addresses — accurate, fast, and private.
A B2B anti-fraud platform that evaluates digital payment risk in a deterministic and explainable manner, makes real-time decisions, and processes effects asynchronously, idempotently, and auditably.
AI translation
The Trust Harness of HyperDAG Protocol is a behavioral reputation scoring engine.
AI translation
Remote desktop in a browser tab and a private WireGuard-style mesh between your machines, with team chat and video included. Self-hostable, end-to-end encrypted.
A self-hosted PII firewall and EU data-residency gateway for the OpenAI and Anthropic APIs. Zero runtime dependencies.
Check who could be affected by your Microsoft Entra security changes. IAMAI reviews your tenant and helps you plan the work before you deploy.
Deploy HailBytes security tools on AWS or Azure in minutes. One-click deployment templates for HailBytes Security Awareness Training Platform and HailBytes Attack Surface Management Platform.
CTIPilot is a continuous cyber threat intelligence (CTI) pipeline for Swiss government entities (national, cantonal and communal administration, emergency services, police, armed forces): per-finding
Decision support for human moderators. Detects harm in the relationship between image and text, and explains why.
Built it? Time to show it.
One command in your project folder. Built with AI is enough; AI features are optional.
/nomorevibeSee how to list