Fournisseur Conforme — auto-diagnostic cybersécurité pour fournisseurs et prestataires : évaluez vos pratiques face au projet de référentiel ReCyF v2.5 (version de travail ANSSI) et repartez avec des
Translation pending
Security projects
Loading…
Security projects
Public projects with traces of AI coding tools in their repositories, sorted by newest listing.
Security · 981 projectsReset filters
Framework-agnostic security middleware for Node.js and edge runtimes
DEVADARA is an offline Windows antivirus that defends your computer the way your body defends itself.
Your leases, contracts and invoices, read and checked by Yomizaka: every finding quotes its rule and the line it rests on, every PDF examined for signs of editing, every document found again in a seco
QtPass is a free, open-source GUI for pass, the Unix password manager: GnuPG-encrypted passwords synced with Git on Linux, Windows, macOS and BSD.
Optics maps every AI process and every connection it makes, flags the first time AI reaches somewhere new, and sends it to the monitoring tools your team already watches. It sees the connection, not t
VEXORA (Explainable Fund-Flow Tracing for Fraud Detection): follows funds within a bank, flags potentially suspicious transfers and builds one case for the investigator. All data synthetic.
Vettalon 用多個 AI 模型交叉覆核程式碼風險，保留候選與反證供人工判斷。掃描由本機編排；深掃會將選取的程式碼與上下文送到你設定的模型。免費核心提供供應鏈獵捕，Pro 提供企業報告與桌面 App。
Translation pending
Quantsiv finds the cryptography in your code that a future quantum computer could break, shows what to fix first based on how long your data must stay secret, and produces the Cryptographic Bill of Ma
Encrypted legacy vault. Store messages, passwords and documents, pass them to people you choose only when it's truly time.
Protect your Node.js projects from supply chain attacks. Scan npm packages for malware, crypto-drainers, and security vulnerabilities with AI-powered threat intelligence.
Self-hosted OAuth 2.1 for your apps, APIs, and AI agents. On-behalf-of delegation, MCP support, and a crypto-agile core built for post-quantum security.
One-time keys for an ordinary Safe: a seat that keeps its place among the owners while the key behind it changes after every approval. Your passkey plays the key. Base Sepolia only.
Secure DevOps workflows with Smallstep. Automate trust and integrate device identity across DevOps pipelines for enhanced security.
An open specification and tools for verifying the provenance of scientific detector data, including images, movies, and spectra, using signatures made inside the detector.
RouteGate is an open-source self-hosted platform for managed VPN nodes, accounts, devices, routing, and client access.
Encrypted in your browser, stored as an Arkiv entity, deleted by the protocol. The key never leaves the link.
ProvGuard: provenance-based tool-call guard for LLM agents, evaluated on AgentDojo.
The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towar
Class action settlements, tracking protection, automatic cookie banner handling and global VPN locations in one app.
Translation pending
Record every host an MCP server contacts, per tool, and fail CI on new ones.
AI-native cybersecurity maturity for SMEs and the consultants who serve them.
Manage ISO 27001 compliance end-to-end. Gap tracking, risk register, evidence automation, and 29 regulatory framework assessments — self-hosted, open source. Multi-jurisdiction policy rendering for 8
Surf the internet from home, anywhere in the world! Fully managed, Zero trust VPN for your home or small office network.
Let Claude Code use your passwords and API keys without ever being handed them. Free, open source, Windows.
Live CVE tracking across leading cybersecurity vendors — Fortinet, Palo Alto Networks, Cisco, Check Point and more — broken down by firewall, endpoint, SASE and identity products.
Translation pending
Run Claude Code, Codex or pi in a secure Linux VM on your Mac. Your API keys never enter the sandbox, every connection follows your policy, and it pauses in 1 ms and wakes in 0.3 s.
AEGIS Defense: sistema autónomo de ciberdefensa post-cuántica desplegado en producción. No es una librería. No es un concepto. Es defensa activa 24/7.
Translation pending
See what your Microsoft 365 tenants over-share, how their posture scores and who can spoof their domains, for one environment or a whole client book.
One package, one sentence to your AI agent, about 20 minutes. Compass runs entirely in your AWS account.
Translation pending
Slopscale is a fork of headscale, the self-hosted Tailscale control server, that runs one tailnet with an admin console, roles, approval and auditing.
Keeps the Internet open and your data secure. Top-notch VPN from the creators of the famous ad blocker.
Get SOC 2, GDPR, HIPAA, and ISO certified with expert guidance and the job done for you. Open-source compliance platform with no vendor lock-in.
Hybrid Rust/Python security scanners for prompt injection, DLP, PII, and agentic tool risks — a layered, on-device AI firewall library.
API tokens for Blablador, issued after Helmholtz/JSC sign-in
Translation pending
One static agent for Windows, macOS and Linux. Inventory, posture, compliance, policies, deployment and remote actions, with a public roadmap to native MDM.
An open-source, large-scale, full packet capturing, indexing, and database system. Stop using slow tools to dissect and search your packets, let Arkime do the grunt work for you!
From shadow AI to signed evidence. Discover, sign, and hand the auditor a bundle they can verify themselves.
A person signs the permission with a passkey. The agent signs a receipt for each action. A free checker says whether the agent stayed within the permission, and where it did not.
Your AI agent says it did the right thing. Deedglass checks if it really did, and stops it if it didn't. Free to run on your own servers.
Checks AI-generated code before it merges: security rules, SARIF output for GitHub code scanning, and a CI gate that exits 1 on HIGH findings. Open-source core (MIT).
Discover your AI agent's attack surface — capabilities, tool permissions, MCP integrations, and prompt risks — with clear, actionable findings before deployment. Free, offline, open-source.
Corgea finds, triages, and fixes vulnerabilities across code, packages, infrastructure, and containers.
Translation pending
Trust that travels with your data. Every signature, AI action, and file carries its own proof — so anyone who asks can verify what happened, anywhere.
A modern GUI client based on Tauri, designed to run in Windows, macOS and Linux for tailored proxy experience
Protect your SIP Servers from bad actors at https://sentrypeer.org
Secrets Bridge adds access requests, approvals, audit and agent execution around the secrets you keep in AWS Secrets Manager and HashiCorp Vault. Values stay in your provider.
A self-hosted gateway that checks, limits, masks and audits every statement before it reaches your production database.
One goal becomes a governed, audited plan. Your deployment's rules can veto it; the record survives root access. Apache 2.0.
Remove common tracking parameters from URLs locally in your browser.
A free, native Mac app for API keys, .env variables and recovery codes. Encrypted on your Mac and opened with Touch ID.
One audited Postgres base mapped to SOC 2, HIPAA, ISO 27001, and NIST 800-53: fail-closed RLS, S3 Object-Lock WORM, and an append-only audit chain, in five composable module families you compose, neve
Privacy-first apps for Mac and iPhone. A Faraday cage for your data.
A live-fire range where anyone can try to rob an AI agent's wallet. Breach it and the contract pays you; fail and the agent's on-chain score — and spending limit — goes up. Settled in USDC on Arc.
Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure
Claude Code, Codex and Cursor ask Paveo before they run a shell command or write a file. The dangerous ones are refused, with a record your security team can verify.
Screen names against signed sanctions data in your browser. No account or backend required.
Prompt injection detection for autonomous agents. Seven technique classes. Sub-10ms response. Open source.
Не работает Telegram, WhatsApp, YouTube? Бесплатный прокси за 10 секунд и VPN для обхода глушилок и белых списков. МТС, МегаФон, Tele2, Билайн, Yota.
Translation pending
Three open-source layers: fence the OS with NockLock, firewall the tools with NockGuard, view configured audit records on the Wall.
Turn sensitive report snips into client-safe replicas. Sensitive text is masked on your device. Nothing is stored.
Turn online abuse into a case you can file. Check images for manipulation, keep tamper-evident evidence, draft your NCCIA complaint and find the right helpline — in English and Roman Urdu. Your data s
Your AI writes the code. Kompile makes sure it does not leak. Check your app for exposed keys and open doors, fix them with your own AI, and stay protected every week.
Decode a SAML response or OIDC token, run the hard checks, and get the fix plus two ready replies.
Third-party risk review in minutes: tier the vendor, check its SOC 2 evidence, and get a decision and memo.
A spend firewall for AI agents: every payment is checked against the job before money moves. Right payee, right amount, in scope, plus a verified-payee credential read — one call returns GO or STOP wi
Detect attackers while they're still mapping your APIs. trappsec embeds decoy routes and honey fields directly in your application code — catching adversaries before a single perimeter is crossed.
Receive your SMS online with a virtual number: create a WhatsApp, TikTok or Telegram account without a SIM. Instant SMS validation, Mobile Money payment in FCFA.
AI translation
Policy-gated before it runs, cryptographically provable afterwards. Check a real log in your browser.
Translation pending
Privacy-preserving, client-side AWS IAM policy analyzer. See a single policy's potential blast radius - privilege-escalation paths, role-assumption reach, sensitive-data access, and broad-resource gra
Translation pending
Turn every AI agent action — model calls, tool calls, approvals, redactions — into a chronological, hash-anchored evidence packet. Provable to an auditor, with no raw sensitive data stored.
Mount a capability. Bind it to identity, policy, budget, and time. Execute through a governed boundary. Preserve evidence after the machine disappears.
Make faces in photos unrecognizable with a logo, pixels, blur, or a black rectangle. Everything happens in your own browser.
AI translation
Stars is an AGPL-3.0 Windows permission analysis tool for Active Directory, NTFS and SMB effective permissions with explainable permission paths. Read-only, open source, free.
RustyMap is a port of nmap written in Rust: TCP/UDP scanning, firewall evasion, OS fingerprinting, idle scan and much more.
AI translation
Per-run budgets, loop detection, burn forecast and a breaker that answers 402 in seconds. One gateway by default, a raft cluster build when you need several; validated with real Claude traffic on Hetz
Digital key management for the University of Lagos Senate Building.
Open-source agent that detects attacks in your server logs and inbound connections, bans attackers at the firewall, checks hardening, scans code and spot-checks your URLs — with alerts and a cloud das
Policy is a document. Runtime is a hook. One identity, one policy, one hash-chained audit trail across every AI agent and every tool call.
Ambit is a self-hosted gateway that decides who may use which AI models and work apps, sets spending limits, keeps an audit record, and removes access when someone leaves.
TrustLight: a light you can trust. Free scam checker for links, messages, QR codes, numbers and files, in English, Hindi, Kannada and Tulu.
An expiring issuing CA takes down everything it ever signed. CertPilot watches authorities first.
Translation pending
SyncPass is a password manager that keeps your passwords, cards, and 2FA codes encrypted on your device. You don’t need to create an account; you never share your master password with us.
AI translation
MCP gateway between AI agents and their tools, the web and Matrix: three-layer prompt-injection defense, smaller tool lists and responses, gateway-enforced parameter and response guards, OAuth/DCR, an
mdoc is a free, open-source desktop app for Mac and Windows. Open PDFs, scans and Word files, check them against the original, replace client names, and copy clean text into ChatGPT or Claude.
Deep is a system that builds trust for online buying and selling by verifying identity with a Trust Score and Badge to reduce fraud.
AI translation
3 days free on VLESS Reality. Test speed and stability — if it works, subscribe via the Telegram bot.
AI translation
Network toolkit with 17+ engines, MCP server for AI integration, smart config rotation, data-phase drop detection, and country-aware routing. Terminal-first. Windows + Linux
Watch your cameras from anywhere while recordings stay on your own hardware. Open source, encrypted at rest, AI only if you turn it on.
A directory of direct links to get your personal data from web services.
Stop AI agents losing money on Solana: pre-sign checks, intent matching, token verdicts. MCP and HTTP, x402 USDC.
Translation pending
Get the IAM policy a CloudFormation or SAM stack needs from its template, before you deploy it.
What clearcutt-verify found and proved about the northcutted-images image estate.
Enforce spending limits, block destructive commands, and control what AI agents can do. 25ms hook eval. No LLM in the authorization path. Self-protecting locked rules.
Custom Flipper Zero firmware: Flipper-ARF protocols + custom UI. (The web flasher is not working and it has many bugs, will try to fix it in future but for now main focus is firmware itself.)
AI-assisted control mapping prototype for a fictional organization. AI suggests, code calculates, the analyst decides.
YouTube, Discord с голосом, Telegram, игры. Сама подбирает стратегию zapret и держит её.
Translation pending
WonderID is identity governance and administration (IGA) for human and non-human identities: employees, contractors, partners, service accounts, workloads, API keys and AI agents. One control plane fo
Lets you connect your accounts once and give each AI agent limited, logged access to them
AI summary · revised during review
Scan links, files, emails, texts and phone numbers against real threat intelligence.
Translation pending
Browse 601+ production-ready Open Policy Agent (OPA) Rego policies by standard: CIS Benchmarks, DISA STIGs, NIST, NERC-CIP, IEC 62443, ISO 27001, SOC 2, PCI-DSS, EU AI Act and 55+ frameworks. Apache 2
Frosts the screen when you stop using the Mac, and clears it the moment a hand comes back.
Solana forensic scanner. Token X-Ray traces the deployer, the launch block and every authority; Wallet Shield revokes drainer approvals in one click. Powered by Predator AI.
Persistent, signed, on-chain-anchored memory your AI agents can carry across providers, sessions, and tools — and any third party can verify.
Welcome to the WSO2 Identity Server source code! For info on working with the WSO2 Identity Server repository and contributing code, click the link below.
Auditable AI patch triage: deterministic exploitation signals (EPSS/KEV/SSVC) in, machine-verified LLM decisions out
Translation pending
Passive detection of AI agent activity in public records: the method walked through a synthetic incident, notices, and browser tools.
Deploy the latest version of Wazuh Server as a Kubernetes Operator on any cloud. A charm deploying the Wazuh Server.
Translation pending
TraceRook stops risky Claude Code actions before they run. Local rules on your Mac, contextual analysis with Anthropic Claude, and a native review for every high-risk call.
Open source secret scanner with 450+ rules. Detect and validate credentials via CLI, Go library, Burp Suite extension, or Chrome. Built by Praetorian.
self-hosted anti-bot solvers that keep working after the vendor's next update.
Backups for your Mac that keep every version, encrypted, to a drive, a NAS, a cloud folder or S3. Free and open source.
Self-hosted threat-intel dashboard on a Raspberry Pi: security news with CVE lookups, CISA exploitation flags, and colour-coded severity.
📱 Android private messenger, crypto wallet and light node to Mixin Network
Translation pending
Android navigation that avoids the fields of view of mapped ALPR cameras — the 139,391 of the 142,257 in the 50 states and DC whose facing is recorded — routed offline, so your start and destination s
Android app that flags AirTags, Tile, SmartTags & Find My trackers travelling WITH you over time, plus an experimental detector for key-rotating clones. Fully offline, no internet permission.
Self-hosted auth for the open web, with a signing key for every tenant.
Self-hosted access to SSH, Kubernetes, databases, web apps and RDP/VNC with SSO, RBAC and session recording—without proprietary client software.
Recon and hunting for authorized security testing, with hash-chained evidence and human-signed receipts for every lane.
A simple, self-hosted, web-based IP Address Lookup Tool written using Flask (Python), packaged using Docker Compose for a quick and easy deployment
Highflame is the AI agent security platform: a verifiable identity for every agent and an authorization decision for every action, enforced inline across LLM and MCP traffic.
Pre-execution verification for AI agents. SATISFIED, UNSATISFIED, or UNKNOWN. Current release: v1.23.1.
Translation pending
Signed identity, a Mandate, a bond and a tamper-evident log for AI agents on any runtime. Open protocol, public beta.
A simple, self-hosted, web-based Bulk Password Generator written using Flask (Python), packaged using Docker Compose for a quick and easy deployment
Free password generator. Make strong passwords, PINs and passphrases with custom length and symbols. Everything happens in your browser, nothing is sent or stored.
Map what your infrastructure agent can change in production, whether each change can be undone, and when a person must approve. Storage first.
ランサムウェアのふるまい検知＆エアギャップ隔離、公衆Wi-Fiでの盗聴対策、不正USB/BadUSB物理ポートガードを1つのメニューバーアプリに。自宅でも外出先でも、複雑な設定なしで自律防御。
Translation pending
Generate threat models from system descriptions using LLMs with iterative review
AI summary · README
Run schema-validated bundled Network replays in an ephemeral workbench. No decisions are recorded, and ChangeSafe never executes infrastructure changes.
Translation pending
Open-source team mesh control. Self-host a console on Headscale — no per-seat lock-in. Workspaces, tags, keys, and Network Apps. Official Tailscale clients only.
Signed receipts for AI responses, anchored on Monad. It proves who served which bytes and what they claimed, not which weights ran.
Alias sostituisce nomi, codici fiscali e IBAN prima che la richiesta arrivi al modello di AI, e rimette i dati veri nella risposta. Per studi professionali e PMI.
Translation pending
One command to install. Gives people one link to all your servers, serves a cover site on every server and watches their health. Open source.
AeroPad is a local-first 2FA & security workbench with an encrypted-at-rest TOTP vault, QR import/generation, secure notes, encrypted .aeropad backups, strict WebCrypto validation, self-hosted/offline
Verify what is exposed, what changed, what acted, and what the evidence actually supports.
Bounded unauthenticated external exposure scan. Check public files, security headers, certificate evidence, CORS, and optional takeover risk.
Translation pending
See if your unshield amount links your withdrawal to the deposit address. Free and open source. The check runs in your browser.
EDEP ist ein offener, prüfbarer Sicherheitsstandard für Windows: ausgehender Verkehr nur für zugelassene Programme, Telemetrie auf das Minimum, jede Blockade protokolliert. Mit kostenlosem Audit-Tool.
Translation pending
Apna Business Cloud, India me safe. Team backup and vault for Indian companies — Bharat Tijori.
Agent Sentinel is a local flight recorder and execution boundary for AI coding agents. It blocks dangerous commands, asks you before risky ones, and records everything. One binary, no cloud, no accoun
Dormathon 2026, Track 1 (Predictive Model): Scam Guardian, a wallet demo that pauses risky transfers when someone may be coached by a scammer. Expo, Android and Web.
241 domain tools across 35 vendor integrations and CMVP, KEV, EPSS, FedRAMP, SCF, and OSCAL, with Pi, Cursor Agent SDK, and Flue runtime paths.
Android app that flags nearby Flock ALPRs, Axon body cams, and police by fusing BLE/WiFi + the DeFlock map + Waze police reports. It never connects to, pairs with, or jams anything it detects.
An independently-enforced Go trust-kernel, egress lockdown, and CI that runs against live infrastructure — the same NanoClaw experience, secured underneath.
Assess the risk to your organisation's crown jewels in Microsoft 365, Google Workspace or AWS and download a branded PDF report. Runs entirely in your browser.
Kwetsbaarheden Analyse Tool, openkat.nl.
Translation pending
Runtime leak detector for modern web apps — finds exposed API keys, validates BaaS misconfigurations (Supabase/Firebase RLS), and catches secrets in JS bundles. Chrome extension + CLI.
Open-source MFA for developers — self-hosted, pragmatic, in active development.
Explore remote monitoring and management tools, forensic artifacts, and detections. Open source intelligence for threat hunters and defenders.
Independent, compliance-grade audits of AI in emotionally sensitive conversations.
Translation pending
Evidence Chain: cadena de custodia verificable para evidencia digital.
Translation pending
Tracecat is the open source security automation platform for teams and AI agents. Build workflows, manage cases, and automate cyber defense.
Generate least-privilege Claude Code permission rules for MCP tools from their live annotations: readOnlyHint tools go to allow, everything else to ask, one mcp__server__tool rule each, never a glob.
CI gate for Claude Code skills and plugins: scans a skills or plugin repository for instruction-override text, exfiltration patterns, dangerous hook commands, unpinned MCP servers and secret-shaped st
Pensar is a continuous adversarial testing platform: offensive AI agents attack your live systems, prove real exploits, and re-attack every fix until it holds.
Claude Code permission rule simulator: load the merged allow, ask and deny settings, show which rule decides any tool call, and find the bypasses: commands that slip past a Bash pattern, paths that es
Run Claude Code, Codex or pi in a secure Linux VM on your Mac. Your API keys never enter the sandbox, every connection follows your policy, and it pauses in 1 ms and wakes in 0.3 s.
AgentGuard is an open-source runtime firewall for AI agents. Wire-level enforcement at the protocol boundary — an MCP gateway and an LLM API proxy — with policy-as-code in YAML, human-in-the-loop appr
Proxed.AI is the simplest way to protect AI API keys in iOS apps. Lock down your API credentials, verify device authenticity with Apple's DeviceCheck, and structure AI outputs—all without a backend. O
CaMeL-style control/data-flow separation that reduces injection-to-effect risk under stated assumptions. Topology, not a safety certificate.
Translation pending
Independent gateway on customer-owned endpoints. Route one agent, press the kill switch, keep the Azure or OpenAI bill you already pay.
A security incident-response console: detections become diagnoses, diagnoses are challenged by evidence, and every response is scored and tiered before anyone acts.
Every AI employee. One workplace. Connect the bots you already run, set what they may do, and approve anything risky.
Cartographier les liens entre sociétés, dirigeants, adresses, événements juridiques et sanctions — avec niveau de preuve (confirmé, déclaré, inféré, simulé).
Translation pending
Instrument the macOS Seatbelt sandbox at runtime without hand-waving
Translation pending
Open-source security tooling built by VardrSec: API authorization testing, attack surface mapping, and local scan automation.
Explore an extensive range of use cases supported by Fingerprint, and learn how to successfully implement it for your business with practical guidance and a comprehensive demo.
Every LLM interaction. Logged. Immutable. Attributed. Human-directed AI assistance with deterministic governance for chat and MCP tool calls. What Is LLM Provost? LLM Provost is a complete enterprise
Authentication, validation, fraud detection, payments intelligence, and global data, delivered through one unified API.
Translation pending
Pocket ID is an easy-to-use, self-hosted OpenID Connect Certified™ and OAuth 2.0 provider. Users sign in to your apps with passkeys instead of passwords.
A web frontend for the motion daemon.
JumpServer 是广受欢迎的开源堡垒机与运维安全审计平台，支持主机、数据库、Kubernetes、RemoteApp 等资产统一纳管，覆盖 4A、PAM、数据库审计与合规场景。
Translation pending
Free, open-source, local-first scanner and integrity monitor for OpenClaw skills. npx ironheights scan ./skill
Blur unregistered faces in your live stream with InnoLive's real-time AI de-identification. Keep registered participants visible and try face privacy protection in your browser.
Disposable email that actually disappears. Spam-proof, encrypted, real-time. Like a burner phone, but for your inbox.
Open-source, privacy-first, AI-native browser on Ungoogled Chromium. No telemetry, no ads, no sponsored tabs. Bring your own AI keys.
Free PDF redaction that really deletes text. Remove names, numbers and hidden metadata from PDFs without uploading them. No account, no watermark.
Native iOS proxy client (meow-rs) for iOS 18+. Clash-style YAML subscriptions, rule-based routing, DNS over HTTPS, QR-code profile sharing, and a SwiftUI material design in light and dark. Available o
Open source, privacy-first, and built to scale. Hanko is the fastest way you integrate passkeys, 2FA, SSO, and more, with full control over your data. Move between self-hosted and Hanko Cloud anytime.
Five AI agent tool calls, each followed through a real OPA policy compiled to WebAssembly and running in your browser: allowed, held for approval, or blocked.
Kubernetes operator for Keycloak. Manage realms, clients, users, roles, and identity providers as code. Features GitOps support, automatic secret sync, drift detection, and works with Keycloak 20-26+.
Built it? Time to show it.
One command in your project folder. Built with AI is enough; AI features are optional.
/nomorevibeSee how to list