Single-file browser client for the Have I Been Pwned API. No API key, no backend. Passwords are hashed locally and only a 5-character SHA-1 prefix is ever sent.
Security projects
Loading…
Security projects
Public projects with traces of AI coding tools in their repositories, sorted by newest listing.
Security · 1,369 projectsReset filters
Vero is a verifiable credibility layer for people and organisations publishing online, built on Midnight. Prove a relevant credential or accountability claim — and choose what you reveal.
Online signature verification from stroke dynamics, benchmarked on SVC2004.
Translation pending
Recover ZecWallet Lite seeds, zcashd wallet.dat files, and standalone Sapling or Sprout keys with a local-first desktop flow.
Free sanctions screening, PEP checks, and adverse media search tool. Plus a comprehensive AML Knowledge Hub covering MLR 2017, POCA 2002, and FCA compliance. Built for compliance professionals.
Scan any Base coin for rugs before you buy: a 0–100 safety score in the feed.
Something feels off? Check the vibe. A second opinion for messages, profiles, invitations and offers: warning signs of scams, grooming, coercion and exploitation, and where to get help.
Live in-browser multi-person pose tracking and zone-based behavior detection. It runs entirely client-side with no backend and no uploads required.
AI translation
106 curated security scans of open-source AI agents, MCP servers and LLM apps - 24 confirmed fixes, run local-first with Semgrep, Gitleaks, Trivy and pip-audit.
Plataforma SaaS completa para adequação à Lei Geral de Proteção de Dados
Translation pending
The Kubernetes-native policy enforcement plane for MCP. Deterministic admission and egress policy, attributable audit, and SIEM export — MIT, self-hosted, no SaaS.
Sandboxes isolados e descartáveis para agentes de IA: MCP, CLI, dashboard web e app nativo de macOS. Rede desligada por padrão, allowlist de domínios e trilha de auditoria. Go + SwiftUI.
Translation pending
Detect and anonymize sensitive entities in text using LLM-powered workflows
Replays sandbox test results comparing how different Git workflow setups resist attacks
Translation pending
AI summary · revised during review
Face ID-style unlock for Omarchy: the infrared camera recognises you at the lock screen, at sudo and in polkit, while your password stays the real key.
Open-source Aadhaar, PAN, GSTIN & UPI detection and reversible masking for AI prompts. Runs on your infrastructure. MIT.
Not everyone is a developer. Not everyone has to be.
Translation pending
The primary threat is accidental destruction — an agent that misreads a path and deletes the wrong folder — not a determined attacker. Network isolation is secondary and off by default; an AI CLI that
Agentic AI Platform for Enterprises. Securely connect all your data and systems. Operate trusted AI with built-in security and governance.
CI/lock collects trusted telemetry across every checkpoint between commit and production — CI/CD builds, security scans (SAST/DAST/SBOM), runtime + cluster integrity (Falco, Linkerd mTLS, kube-bench),
Translation pending
The local-first credential vault your AI agents can use — but never see. 66 testable security constraints. Rust.
AI Agent City is the operations layer for the agent economy: spending limits, monitoring, security, trust, and discovery for AI agents. Human-readable and machine-readable.
Custos demo wallet — mô phỏng và giải thích giao dịch Solana Devnet trước khi ký.
Translation pending
GDPR Chapter V Transfer Impact Assessment skill for Claude — EDPB six-step methodology, CNIL three-way Step 3, four essential guarantees, 12 country profiles, balanced Art. 49 analysis, RoPA interchan
Translation pending
GDPR Breach Response Sentinel Agent Skill (open standard) — ENISA severity assessment, EDPB case matching, Art. 33/34 notification support, audit-ready .docx generation
Translation pending
Read-only macOS notch + menu bar monitor for Claude Code and Codex. Open source, free, local-only. Risk-scores every tool call and tracks the footholds agents leave behind.
A policy-enforcing filesystem for AI agents. Point it at a real project directory and it serves a filtered mirror — same paths, same sizes — deciding per read which face of each file to show.
Low-latency bot detection for Apache 2.4 with proof-of-work challenges, shared-memory reputation, crawler policy, and built-in observability.
Technology consulting rooted in Albion, Michigan. Built on trust, crafted with care.
Short-lived SSH certificates from your identity provider, for ssh, sudo, and the console.
mcp-skills-vault installs MCP servers safely. mcp-trace shows what they're actually doing. Offline-first. No telemetry.
Translation pending
Trust intelligence scoring for OSINT sources — behavioural reliability analysis, GDPR & EU AI Act compliant.
Translation pending
Browser-based web exploitation challenge platform powered by WASM
Translation pending
The deterministic structural architecture of massive software repositories.
Translation pending
Hardened Podman container runner with gate server and shield integration
Just-in-time access. A little less clicking around. For macOS, Windows and your terminal.
Self-hosted MCP gateway: AI agents get audited, SSO-gated, read-only database access without ever holding a DB credential.
Translation pending
SWARM: open-source multi-agent AI safety framework. Measure toxicity, governance gaps, and emergent risks with soft probabilistic labels.
Sandbox your LLM coding agents on macOS. Kernel-level enforcement via sandbox-exec — deny-first, composable, zero dependencies.
Belay is a local-first security layer at the tool-call boundary of AI coding agents. Deterministic, sub-100ms, fail-closed. Detect, block, and get notified — no LLM in the decision path.
Hub + agent + device integrations: live packet measurement, process-based L7/DNS visibility, TimescaleDB + NATS scaling infrastructure, RBAC/SSO, and 5651-compliant signed logs. Open source, MIT, self-hosted.
AI translation
Production-ready security scanning platform with 28 scanners, OPA Policy-as-Code, historical storage, trend analysis, and compliance automation across 6 asset types
eCapture is for capturing SSL/TLS text content without a CA certificate using eBPF.
AI translation
Open-source SCA platform — CVEs, licenses, and SBOMs in one place
All things related to automation and development with Cortex XSOAR (formerly Demisto)
A deny-by-default contract layer for AI agent tool calls - strict argument validation, ghost-argument stripping and self-healing retries, in-process and Pydantic-only
Discover, remediate, verify, and gate human- or agent-written code with a local, policy-bound, audit-ready security runtime.
ORES: Open Risk Evaluation & Scoring - A universal, open-source engine to standardize cybersecurity risk scoring
Translation pending
Scope-locked security review for teams that own or are authorized to test their assets.
Seal is a local approval gate for selected Claude Code MCP tool calls.
Govern connected AI clients, models, and tools on your infrastructure. Centralize access policies and audit, then build custom capabilities on the SystemPrompt runtime.
Free, open-source CLI and MCP server that keeps API keys in your OS keychain and serves them to Cursor, Claude Code, and Kiro. No cloud, no account, no .env file.
AI security from risk map to reference architecture: the full CoSAI taxonomy, the MITRE mitigations that support its controls, and target-state architectures for every class of AI application.
177 scenarios across 16 Cortex detection planes. Controlled signal generation for XSIAM/XDR detection validation.
Translation pending
A rubber band around Claude's claws. Blocks rm -rf and other destructive commands before they run, so bypassPermissions mode is actually safe.
Collective discovery for open cryptographic challenges. Contribute GPU time to a public elliptic-curve search, earn credit for verified work, share the prize when the answer is found.
Choose the assets. Run applicable upstream security checks. Read one report organized by asset and priority.
Test your vibe-coded apps, hunt down hallucinated packages, logic bugs, and secret leaks, and fix them in seconds. Works inside Cursor, Claude Code, GitHub Copilot, and Windsurf.
Small Print is a nightly record of the tool descriptions, schemas and instructions that MCP servers, agent skills and plugins give your agent: every version hashed, every change diffed and graded by a
Sane WordPress defaults with actionable Site Health reporting for security, privacy, performance, and core updates — including same-line security patches.
The archive feature Graylog Open is missing — self-hosted, streaming, with independent compliance audit.
Blocks credential exfiltration, config harvesting, and secret leakage before the network call fires. Behavioral sequence detection at the runtime level — not prompts.
AI Ops for Bring Your Own Agent (BYOA) teams. Audit coworker harnesses with doorman dashboard, mine prompt history for capability needs, and block rogue tools at the gate.
The Zanii transparency log, live: verifiable AI-agent actions streaming in real time.
Translation pending
Install Know Your Agent with npx in minutes. Offline demo, MCP gate, local free console, or enterprise hosted. No private protocol.
Daily Internet.nl standards measurements of a real fleet, made by the unmodified internetnl CLI against a self-hosted netnl facade.
Translation pending
Your agent knows a lot about you. Sanctuary keeps that information private. A firewall for your AI agent that runs on your own Mac, enforcing what it can reach at the operating-system level with keys
Self-hosted, metadata-only visibility and guardrails for the AI coding tools your engineers use. Never prompt text, never source code.
Verify once, access everywhere. KYC, KYB, and KYA compliance credentials via encrypted tokens and Interchain Messaging (ICM) on the Avalanche® blockchain. Non-custodial, software-only, no PII stored.
Fast, private, free. Strip EXIF metadata from photos, videos, and PDFs.
Local-first pentest agent: Go daemon + React dashboard + Codex/Claude Code/Pi runtimes, scoped projects, Blackboard, sandbox runners
Translation pending
Orca Security provides agentless, workload-deep, context-aware cloud infrastructure security and compliance through our comprehensive cloud security solution all in a single platform.
Translation pending
Verify Pakistani online stores and sellers before you pay, and file structured fraud disputes when something goes wrong. A free public database of reported scams, blacklisted brands, and dispute outco
Walletbeat is an Ethereum wallet rating site. It aims to provide a trustworthy, up-to-date source of information about the state of the Ethereum wallet ecosystem
An open-source OAuth2 and OpenID Connect server for simple, secure authentication.
Agents generate actions. rv authorizes them before they run. Hook-grade allow/deny for Grok, Pi, OpenCode, Claude, OpenClaw, Hermes, Codex, and Cursor.
Fine Grain Access Control proxy for AI Agents using Google APIs.
Open-source security audit for your AI agents: the skills they run, exposed secrets, risky MCP config, and unsafe updates. Runs on your machine.
BitGraph allocates an unused position before it receives a file's SHA-256 fingerprint, then binds the fingerprint to that position and consumes it. The proof is a file you keep. It verifies offline.
Open-source cryptographic receipts, identity, and audit trails for AI agent sessions. Like TLS certificates, but for agents.
File transfer, datarooms and deposit boxes. End-to-end encrypted. Hosted in Europe.
Translation pending
Open-source AI API audit proxy with tamper-proof evidence chain
ASCII-only by default, no escape parser, a paste warning and reveal modes, memory-safe. An opt-in TUI mode runs ssh, vim and htop, still filtering every character. Copy commands in and text out withou
Translation pending
Master prompts that turn any AI coding agent into a swarm of specialist auditors — evidence-bound, adversarially verified, filed as GitHub issues in German or English.
The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.
Find the plaintext secrets on your Mac and move them into an encrypted vault. Your files keep working, and only the command you run gets the real value. macOS, no account, no telemetry.
One compiled binary puts guardrails under the agent you already run: a destructive tool call is denied before it executes, every milestone needs a contract a human approved, and every execution leaves
Free, open-source CLI for scanning, SBOM generation, vulnerability auditing, and AI-agent-driven dependency analysis.
Verified agent actions: authorization policy, signed receipts, and audit evidence for AI agent tool calls. One command to protect any MCP server.
Local-first session transfer on macOS: Chromium browsers, ChatGPT Codex, experimental Cursor import, encrypted Grok Bot export, and optional Browserless Cloud.
Translation pending
Glaurung is a pre-1.0, AI-native reverse-engineering toolkit with a fast Rust core, a Python API, optional agent workflows, and provenance-aware SQLite project files.
Turn code-review findings into targeted security tests, then generate vulnerability reports for the risks that are proven to matter.
Turn an AI eval result into one portable, offline-verifiable receipt and chain it: eval receipt, decision receipt, outcome receipt. Ed25519 + RFC 6962 Merkle, no server, no network.
Harness, manifest, backend. Manager token stays out of the child environment. Bitwarden SM, 1Password, pass, sops. macOS and Linux.
Audit the Agent Skills installed on this machine for security, trustworthiness, spec conformance, context cost, and trigger quality, then produce a graded…
An agent escape can be built from actions your guard already approved. plumbline scores the sequence, not the step.
Comprehensive ESLint plugins for security vulnerabilities, code quality, and architecture governance in JavaScript and TypeScript projects.
Find out what an attacker can make your chatbot do. Open source, Apache 2.0, runs on your machine or in your CI against your own deployment.
Enforce what an agent can do, prove what it did, and watch for what slipped through. Open, composable, verifiable.
Block prompt injection before your AI agent reads it. Open source, local first, MIT licensed.
Durable, per-user memory for AI agents that resists injection and confabulation. Structural quarantine of third-party claims, grounded-or-silent abstention, supersession without erasure. One SQLite fi
Semantic SBOM & CBOM diff in Rust. Compare CycloneDX/SPDX, score compliance, and enrich with OSV/KEV data. Fast, CI-ready.
The security agent for vibe-coded apps. Kelp probes your backend the way an attacker would and hands you the fix — ready to paste back into your AI tool.
Aegis ShellGuard is a Rust shell guardrail for AI coding agents. rm -rf, git reset --hard and DROP TABLE wait for your approval; safe commands pass through in under 2 ms.
Security coaching and compliance training in Slack and Microsoft Teams, plus open-source skills for AI coding agents.
Give AI agents page automation and direct HTTP control for authorized web red teaming. Configure sandbox and network limits, then review the session. Pure Rust, no Chromium or V8.
Autonomous bug bounty platform with AI agents that hunt like predators. Isolated sandboxes. HackerOne-ready reports. Try free.
Intutic is the open-core Policy as Code layer for Continuous Compliance and Continuous Enforcement for AI agents — the circuit breaker that sits between your agents and production, evaluating every to
Self-contained, air-gapped Bitcoin key and wallet calculator. Turn dice rolls, seed phrases, and private keys into wallet recovery information — entirely offline.
AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platform
Translation pending
Prove you're a real, unique person once — then reuse it everywhere. No name, no face, nothing stored.
Translation pending
See every device on your home network - including the Zigbee, Z-Wave, Matter and Bluetooth LE ones an IP scan cannot find. Self-hosted, MIT, with two-way Home Assistant integration.
Alpacon is the AI-native privileged access management (PAM) platform. Zero-trust tunnels, command-level permissions, and full session audit trails.
An Arch-based Linux distribution that runs a local LLM as a system service: AI-native shell, wlroots Wayland desktop, security monitor, kernel module. No cloud, no API keys.
Translation pending
Free and open source. An AI reads the security alerts your tools raise, tells you which ones matter, and asks before it does anything. Runs on your own computer.
DefectDojo unifies and automates vulnerability management, enabling security teams to focus on prioritizing and remediating the most critical vulnerabilities. We help teams reduce time spent on manual
ProofLedger anchors SHA-256 hashes of your files to Polygon and Bitcoin, by API or the free web tool, establishing a neutral record of what existed and when. The file never leaves your machine and any
Don't trust one AI. Verify with five. Multi-model research, claim verification, video authenticity, and governance — with audit trails.
Open-source based behavioral validation for agentic AI. Close the Behavior Gap before your AI agents reach production.
ENS subnames are revocable powers of attorney for AI agents. Arc is where they spend.
Search usernames across a wide range of platforms, check emails and passwords against breach data, and investigate domains, DNS, and IP addresses — accurate, fast, and private.
A B2B anti-fraud platform that evaluates digital payment risk in a deterministic and explainable manner, makes real-time decisions, and processes effects asynchronously, idempotently, and auditably.
AI translation
The Trust Harness of HyperDAG Protocol is a behavioral reputation scoring engine.
AI translation
Remote desktop in a browser tab and a private WireGuard-style mesh between your machines, with team chat and video included. Self-hostable, end-to-end encrypted.
A self-hosted PII firewall and EU data-residency gateway for the OpenAI and Anthropic APIs. Zero runtime dependencies.
Check who could be affected by your Microsoft Entra security changes. IAMAI reviews your tenant and helps you plan the work before you deploy.
Deploy HailBytes security tools on AWS or Azure in minutes. One-click deployment templates for HailBytes Security Awareness Training Platform and HailBytes Attack Surface Management Platform.
CTIPilot is a continuous cyber threat intelligence (CTI) pipeline for Swiss government entities (national, cantonal and communal administration, emergency services, police, armed forces): per-finding
Decision support for human moderators. Detects harm in the relationship between image and text, and explains why.
Prove your image is original. Embed invisible digital fingerprints.
LightNVR for one home or an entire campus: managed cloud NVR hosting, professional on-premises deployments, and MSP delivery across both. Bring your existing RTSP and ONVIF cameras.
Scan any public GitHub repo for security vulnerabilities, exposed secrets, and code quality issues.
VEYRNOX removes the #1 crypto attack surface by design. 8-digit PIN, Shamir-sharded backup on Safety Plus. iOS and Android.
Open-source software for prototyping quantum-resistant cryptography
A free, public radar for newly-issued TLS certificates on domains that impersonate Indian banks, payment apps and government portals.
Observe agent activity, catch risky actions, and stay in control of what your AI can access and execute. Local-first AI agent security: runtime monitoring, MCP config scanning, and audit-ready evidenc
Winsock Packet Editor (WPE x64) is open-source software that intercepts and edits Winsock packets, adaptively supports 32 / 64-bit target programs, and can modify and forward the network packets of any terminal program.
AI translation
SquachWatch is a firmware for the Cheap Yellow Display that gamifies detecting things like Flock Cameras, Trackers, Meta Glasses and so much more!
Infisical is the all-in-one identity security platform for developers, machines, and AI agents. Manage identities, secrets, certs, and access.
Deep launch-readiness audit that catches what AI builders ship and fake. Runs in your own agent. A watchdog re-verifies every pass.
Get verified on TETA+PI. Businesses, journalists, and artists verified via registry + C2PA + Bitcoin become discoverable by AI agents through the MCP protocol.
Account takeover detection and behavioural risk intelligence. All data is synthetic or simulated.
Create a Technocore did:key identity from your Solana wallet, publish it where anyone can verify it, and keep the receipts. Open source, no account, no server.
OpenGuardrails — next-generation AI runtime security. Secure every action your AI agent takes: the tool call, the system it reaches, the credential about to leave. From $10/month as SaaS, or privately
Pre-payment provider integrity for health plans and Medicaid programs, built on public federal data.
candor maps what every function reaches — network, filesystem, database, subprocess — in one query, and gates the edit that crosses a declared boundary.
Ledgato independently authorizes consequential agent actions at protected boundaries, then verifies and records what happened.
Translation pending
OAuth, SAML SSO, social login, and FGA in one self-hosted NuGet package. See the dashboard, run the Todo sample, and ship in minutes.
Your guided post-quantum cryptography transformation journey. Learn PQC fundamentals, assess your quantum risk, and migrate your cryptography infrastructure in full compliance with NIST, ANSSI, BSI, a
Replace your VPN with Firezone, an open-source zero trust access platform built on WireGuard®. Connect users to anything, anywhere. Try free today.
Simplify cloud-native governance with Kyverno. Automate Kubernetes security, ensure resource compliance, and empower Platform Engineers to manage infrastructure and applications using native YAML-base
Open-source SASE platform providing secure access and connectivity to apps, infrastructure, and AI workloads. Connect and protect your users.
Bitwarden is the trusted, open source password manager for individuals, teams, and enterprises. Securely store, share, and manage passwords, passkeys, and secrets. Free to start.
Free IP lookup tool. Instantly get information on any IP address: geolocation, ISP, VPN detection, and more. No account required.
Translation pending
Paste any did:key and get a shareable credential card that says what that identity has actually done on Technocore. No install, no account.
The core objective of Homebase is to revolutionize the concept of digital identity by creating a decentralized, lifelong, safe, and secure online home for every
SafeDep helps teams detect malicious packages, protect AI agents, and govern open source risk across developer machines, CI/CD pipelines, and production workflows.
Generate a random passphrase from the EFF wordlist or common English words. Self-contained, works offline, never touches the internet.
Meet ICPanda DAO, PANDA, Anda, TokenList, and dMsg: the Chrome extension for keeping secrets, sharing encrypted files, and signing across apps.
Decide what your team can share with connected AI tools. Free and open source for macOS, Windows and Linux.
Code-enforced capabilities for local agents: wallets, servers, payments — inside walls the model can't talk its way around.
Streams Salesforce Event Monitoring into Grafana Loki — Pub/Sub API, SOQL and EventLogFile ingestion, cardinality-disciplined by default.
An AI agent trading a Binance account gets no credential, only a mandate. Every executed order is reconciled against what was actually authorised.
Translation pending
Enterprise multi-agent fraud investigation platform with deterministic safety guardrails and evidence-grounded reasoning.
A cookie consent banner you can install in ten minutes. It asks your visitors before any tracker starts. 34 languages, Google Consent Mode v2, a cookie scanner and a consent log. Open source, MIT.
Your agent reads an address and buys. This is the brake. Honeypot simulation, extraction taxes, liquidity depth and impersonation checks over MCP — with a published, reproducible error rate.
A signed, tamper-evident record of what your agent actually did, written to your machine first.
Translation pending
Check your DNS security, connection speed, ad blocker effectiveness, and any site's security headers, entirely in your browser.
Sign and verify PDF documents for free, 100% in your browser: your .p12 certificate never leaves your device. No registration, open source, and LOPDP compliant.
AI translation
Policy-as-code for MCP agents: deny risky tool calls before they run, prove what ran with offline-verifiable evidence, enforce egress in the kernel (eBPF/LSM). No backend, no telemetry.
Native VPN clients for Windows, Android, and Linux with WireGuard speed, kill switch controls, and DNS leak protection.
Everyone builds the buyer side of the AI‑agent economy (identity, spend limits, payment rails). Tokenizen builds the seller side: a signed, factual proof that the delivery matches what was promised.
AI translation
Passively detect nearby drones by receiving their Remote ID broadcasts over 2.4 GHz WiFi and Bluetooth, with a live feed to your Android phone.
DFOS is an open protocol for identities, signed records, and delegated permissions that any compatible application can verify for itself.
Independent software by Alfon. Content blockers that decide on your device what reaches your screen. No accounts, no telemetry.
Identity, badges, and policy enforcement for the A2A protocol — in two lines of code. Open source.
Mint per-user, revocable Claude/agent skills from a Cloudflare Worker — the API secret bakes itself into the skill at download time. HMAC-derived keys, never stored; one-integer revocation; no app-lev
Protect native OpenAI, Anthropic, and Google Gemini traffic with PII controls, audit trails, usage metering, and budget enforcement.
Aletheore is more than a scanner. Free deterministic CLI audits (secrets, vulnerabilities, licenses, dead code, git hotspots) plus a hosted GitHub App: automated PR reviews on Aletheore Flash ($8/mo),
Phantom helps keep provider values out of the managed dotenv and MCP path for Claude Code, Cursor, Windsurf, and Codex, with exact-route HTTP credential injection.
agentdesktop is the open-source governance layer for AI agents on desktops: discover every agent harness, MCP server, and skill across your fleet, replace API keys on disk with short-lived gateway ide
Built it? Time to show it.
One command in your project folder. Built with AI is enough; AI features are optional.
/nomorevibeSee how to list