Enforce spending limits, block destructive commands, and control what AI agents can do. 25ms hook eval. No LLM in the authorization path. Self-protecting locked rules.
Security projects
Loading…
Security projects
Public projects with traces of AI coding tools in their repositories, sorted by newest listing.
Security · 1,033 projectsReset filters
Custom Flipper Zero firmware: Flipper-ARF protocols + custom UI. (The web flasher is not working and it has many bugs, will try to fix it in future but for now main focus is firmware itself.)
AI-assisted control mapping prototype for a fictional organization. AI suggests, code calculates, the analyst decides.
YouTube, Discord с голосом, Telegram, игры. Сама подбирает стратегию zapret и держит её.
Translation pending
WonderID is identity governance and administration (IGA) for human and non-human identities: employees, contractors, partners, service accounts, workloads, API keys and AI agents. One control plane fo
Lets you connect your accounts once and give each AI agent limited, logged access to them
AI summary · revised during review
Scan links, files, emails, texts and phone numbers against real threat intelligence.
Translation pending
Browse 601+ production-ready Open Policy Agent (OPA) Rego policies by standard: CIS Benchmarks, DISA STIGs, NIST, NERC-CIP, IEC 62443, ISO 27001, SOC 2, PCI-DSS, EU AI Act and 55+ frameworks. Apache 2
Frosts the screen when you stop using the Mac, and clears it the moment a hand comes back.
Solana forensic scanner. Token X-Ray traces the deployer, the launch block and every authority; Wallet Shield revokes drainer approvals in one click. Powered by Predator AI.
Persistent, signed, on-chain-anchored memory your AI agents can carry across providers, sessions, and tools — and any third party can verify.
Auditable AI patch triage: deterministic exploitation signals (EPSS/KEV/SSVC) in, machine-verified LLM decisions out
Translation pending
Passive detection of AI agent activity in public records: the method walked through a synthetic incident, notices, and browser tools.
TraceRook stops risky Claude Code actions before they run. Local rules on your Mac, contextual analysis with Anthropic Claude, and a native review for every high-risk call.
self-hosted anti-bot solvers that keep working after the vendor's next update.
Backups for your Mac that keep every version, encrypted, to a drive, a NAS, a cloud folder or S3. Free and open source.
Self-hosted threat-intel dashboard on a Raspberry Pi: security news with CVE lookups, CISA exploitation flags, and colour-coded severity.
📱 Android private messenger, crypto wallet and light node to Mixin Network
Translation pending
Android navigation that avoids the fields of view of mapped ALPR cameras — the 139,391 of the 142,257 in the 50 states and DC whose facing is recorded — routed offline, so your start and destination s
Android app that flags AirTags, Tile, SmartTags & Find My trackers travelling WITH you over time, plus an experimental detector for key-rotating clones. Fully offline, no internet permission.
Self-hosted auth for the open web, with a signing key for every tenant.
Self-hosted access to SSH, Kubernetes, databases, web apps and RDP/VNC with SSO, RBAC and session recording—without proprietary client software.
Recon and hunting for authorized security testing, with hash-chained evidence and human-signed receipts for every lane.
A simple, self-hosted, web-based IP Address Lookup Tool written using Flask (Python), packaged using Docker Compose for a quick and easy deployment
Highflame is the AI agent security platform: a verifiable identity for every agent and an authorization decision for every action, enforced inline across LLM and MCP traffic.
Pre-execution verification for AI agents. SATISFIED, UNSATISFIED, or UNKNOWN. Current release: v1.23.1.
Translation pending
Signed identity, a Mandate, a bond and a tamper-evident log for AI agents on any runtime. Open protocol, public beta.
A simple, self-hosted, web-based Bulk Password Generator written using Flask (Python), packaged using Docker Compose for a quick and easy deployment
Free password generator. Make strong passwords, PINs and passphrases with custom length and symbols. Everything happens in your browser, nothing is sent or stored.
Map what your infrastructure agent can change in production, whether each change can be undone, and when a person must approve. Storage first.
ランサムウェアのふるまい検知＆エアギャップ隔離、公衆Wi-Fiでの盗聴対策、不正USB/BadUSB物理ポートガードを1つのメニューバーアプリに。自宅でも外出先でも、複雑な設定なしで自律防御。
Translation pending
Generate threat models from system descriptions using LLMs with iterative review
AI summary · README
Run schema-validated bundled Network replays in an ephemeral workbench. No decisions are recorded, and ChangeSafe never executes infrastructure changes.
Translation pending
Open-source team mesh control. Self-host a console on Headscale — no per-seat lock-in. Workspaces, tags, keys, and Network Apps. Official Tailscale clients only.
Signed receipts for AI responses, anchored on Monad. It proves who served which bytes and what they claimed, not which weights ran.
Alias sostituisce nomi, codici fiscali e IBAN prima che la richiesta arrivi al modello di AI, e rimette i dati veri nella risposta. Per studi professionali e PMI.
Translation pending
One command to install. Gives people one link to all your servers, serves a cover site on every server and watches their health. Open source.
AeroPad is a local-first 2FA & security workbench with an encrypted-at-rest TOTP vault, QR import/generation, secure notes, encrypted .aeropad backups, strict WebCrypto validation, self-hosted/offline
Verify what is exposed, what changed, what acted, and what the evidence actually supports.
Bounded unauthenticated external exposure scan. Check public files, security headers, certificate evidence, CORS, and optional takeover risk.
Translation pending
See if your unshield amount links your withdrawal to the deposit address. Free and open source. The check runs in your browser.
EDEP ist ein offener, prüfbarer Sicherheitsstandard für Windows: ausgehender Verkehr nur für zugelassene Programme, Telemetrie auf das Minimum, jede Blockade protokolliert. Mit kostenlosem Audit-Tool.
Translation pending
Apna Business Cloud, India me safe. Team backup and vault for Indian companies — Bharat Tijori.
Agent Sentinel is a local flight recorder and execution boundary for AI coding agents. It blocks dangerous commands, asks you before risky ones, and records everything. One binary, no cloud, no accoun
Dormathon 2026, Track 1 (Predictive Model): Scam Guardian, a wallet demo that pauses risky transfers when someone may be coached by a scammer. Expo, Android and Web.
241 domain tools across 35 vendor integrations and CMVP, KEV, EPSS, FedRAMP, SCF, and OSCAL, with Pi, Cursor Agent SDK, and Flue runtime paths.
Android app that flags nearby Flock ALPRs, Axon body cams, and police by fusing BLE/WiFi + the DeFlock map + Waze police reports. It never connects to, pairs with, or jams anything it detects.
An independently-enforced Go trust-kernel, egress lockdown, and CI that runs against live infrastructure — the same NanoClaw experience, secured underneath.
Assess the risk to your organisation's crown jewels in Microsoft 365, Google Workspace or AWS and download a branded PDF report. Runs entirely in your browser.
Kwetsbaarheden Analyse Tool, openkat.nl.
Translation pending
Runtime leak detector for modern web apps — finds exposed API keys, validates BaaS misconfigurations (Supabase/Firebase RLS), and catches secrets in JS bundles. Chrome extension + CLI.
Open-source MFA for developers — self-hosted, pragmatic, in active development.
Explore remote monitoring and management tools, forensic artifacts, and detections. Open source intelligence for threat hunters and defenders.
Independent, compliance-grade audits of AI in emotionally sensitive conversations.
Translation pending
Evidence Chain: cadena de custodia verificable para evidencia digital.
Translation pending
Tracecat is the open source security automation platform for teams and AI agents. Build workflows, manage cases, and automate cyber defense.
Generate least-privilege Claude Code permission rules for MCP tools from their live annotations: readOnlyHint tools go to allow, everything else to ask, one mcp__server__tool rule each, never a glob.
CI gate for Claude Code skills and plugins: scans a skills or plugin repository for instruction-override text, exfiltration patterns, dangerous hook commands, unpinned MCP servers and secret-shaped st
Pensar is a continuous adversarial testing platform: offensive AI agents attack your live systems, prove real exploits, and re-attack every fix until it holds.
Claude Code permission rule simulator: load the merged allow, ask and deny settings, show which rule decides any tool call, and find the bypasses: commands that slip past a Bash pattern, paths that es
Run Claude Code, Codex or pi in a secure Linux VM on your Mac. Your API keys never enter the sandbox, every connection follows your policy, and it pauses in 1 ms and wakes in 0.3 s.
AgentGuard is an open-source runtime firewall for AI agents. Wire-level enforcement at the protocol boundary — an MCP gateway and an LLM API proxy — with policy-as-code in YAML, human-in-the-loop appr
Proxed.AI is the simplest way to protect AI API keys in iOS apps. Lock down your API credentials, verify device authenticity with Apple's DeviceCheck, and structure AI outputs—all without a backend. O
CaMeL-style control/data-flow separation that reduces injection-to-effect risk under stated assumptions. Topology, not a safety certificate.
Translation pending
Independent gateway on customer-owned endpoints. Route one agent, press the kill switch, keep the Azure or OpenAI bill you already pay.
A security incident-response console: detections become diagnoses, diagnoses are challenged by evidence, and every response is scored and tiered before anyone acts.
Every AI employee. One workplace. Connect the bots you already run, set what they may do, and approve anything risky.
Cartographier les liens entre sociétés, dirigeants, adresses, événements juridiques et sanctions — avec niveau de preuve (confirmé, déclaré, inféré, simulé).
Translation pending
Instrument the macOS Seatbelt sandbox at runtime without hand-waving
Translation pending
Open-source security tooling built by VardrSec: API authorization testing, attack surface mapping, and local scan automation.
Explore an extensive range of use cases supported by Fingerprint, and learn how to successfully implement it for your business with practical guidance and a comprehensive demo.
Every LLM interaction. Logged. Immutable. Attributed. Human-directed AI assistance with deterministic governance for chat and MCP tool calls. What Is LLM Provost? LLM Provost is a complete enterprise
Authentication, validation, fraud detection, payments intelligence, and global data, delivered through one unified API.
Translation pending
Pocket ID is an easy-to-use, self-hosted OpenID Connect Certified™ and OAuth 2.0 provider. Users sign in to your apps with passkeys instead of passwords.
A web frontend for the motion daemon.
JumpServer 是广受欢迎的开源堡垒机与运维安全审计平台，支持主机、数据库、Kubernetes、RemoteApp 等资产统一纳管，覆盖 4A、PAM、数据库审计与合规场景。
Translation pending
Free, open-source, local-first scanner and integrity monitor for OpenClaw skills. npx ironheights scan ./skill
Blur unregistered faces in your live stream with InnoLive's real-time AI de-identification. Keep registered participants visible and try face privacy protection in your browser.
Disposable email that actually disappears. Spam-proof, encrypted, real-time. Like a burner phone, but for your inbox.
Open-source, privacy-first, AI-native browser on Ungoogled Chromium. No telemetry, no ads, no sponsored tabs. Bring your own AI keys.
Free PDF redaction that really deletes text. Remove names, numbers and hidden metadata from PDFs without uploading them. No account, no watermark.
Native iOS proxy client (meow-rs) for iOS 18+. Clash-style YAML subscriptions, rule-based routing, DNS over HTTPS, QR-code profile sharing, and a SwiftUI material design in light and dark. Available o
Open source, privacy-first, and built to scale. Hanko is the fastest way you integrate passkeys, 2FA, SSO, and more, with full control over your data. Move between self-hosted and Hanko Cloud anytime.
Five AI agent tool calls, each followed through a real OPA policy compiled to WebAssembly and running in your browser: allowed, held for approval, or blocked.
Kubernetes operator for Keycloak. Manage realms, clients, users, roles, and identity providers as code. Features GitOps support, automatic secret sync, drift detection, and works with Keycloak 20-26+.
Open-source Rust kernel for AI agents: kernel-enforced permissions, hybrid post-quantum capability tokens, provable actions.
Black out SSNs, account numbers and personal details in PDFs and screenshots before you send them. Runs entirely in your browser — your file is never uploaded.
Free WHOIS API, DNS lookup, SSL inspection, subdomain enumeration & email security in one call. 1,000 free requests/mo, no credit card.
Translation pending
Forward or paste a suspicious email. A team of AI agents dissects it and returns an evidence-cited verdict: SCAM, SUSPICIOUS, or LIKELY SAFE.
Translation pending
Open source desktop app and Chromium extension for capturing, organizing, and verifying web evidence in OSINT investigations. Local-first, with SHA-256 hashes, a signed manifest, and RFC 3161 timestam
Point your phone and see the Bluetooth devices around you in AR. Find unknown trackers. Scans are stored on your phone.
Free scanner for vibe-coded JS, TypeScript and Python apps: leaked keys, broken API routes, swallowed errors, vulnerable packages, PII leaks. Ranked fixes.
Generate audit-ready PDF and Word documentation for Microsoft Intune policies, settings, assignments, and security baselines with a free read-only tool.
Reads your existing coding-agent logs and turns them into clear answers about exposure, activity and cost. Local, read-only, no network.
Compliance gateway for OpenAI, Anthropic and more. Enterprise self-hosted keeps sensitive data in your network, apart from system-prompt text. Signed receipts.
Herramientas para gestionar la adecuación a la Ley 21.719 de protección de datos
Translation pending
AI summary · website and README
Queryable encryption for Postgres. Searchable field-level encryption with identity-bound keys, on the database you already use. The infrastructure for privacy-first applications.
msb-manager runs coding agents in per-project microVMs with deny-by-default egress and credentials that never enter the VM.
Security-first proxy for Large Language Models with multi-provider support, ring-based plugin pipeline, and real-time SOC dashboard.
Check a Supabase app's Row Level Security in about a minute. Real attacks on a private copy in your browser, with a fix file when one can be made. Free, no signup.
Locke is the Sonomos Early Access desktop app for x64 Windows and Linux. It screens AI websites through the Locke Extension and command-line, script and SDK traffic through a local proxy. macOS is com
A free, open-source VPN client for your subscription. Works with VLESS + Reality, VMess, Trojan, Shadowsocks, Hysteria2, TUIC and WireGuard, and with Remnawave, Marzban and 3x-ui subscriptions. For Wi
Let Claude Code, Cursor and Codex use your credentials without seeing them. Touch ID per credential, proxy calls, audit log. Open source, local, macOS.
A safety floor your AI agents can't get under: one policy for every agent, judged by what each call will run, backstopped by the kernel, with a signed record.
TRACE (Toolkit for Retrieval and Analysis of Cyber Evidence) is free, open-source digital forensics software. Open E01, AFF4 and raw disk images read-only, triage what stands out, recover deleted file
A checklist of the privacy and AI settings worth turning off, with the menu path to each and a flag when it is time to check again.
Compare data privacy, retention, and model training policies across major LLM providers, inference APIs, and AI coding tools.
Flowlight is open-source application-aware network intelligence for macOS, with deeper visibility into AI agents, tools and MCP servers.
Lets a person or organization govern their own AI agent through scoped, signed delegation
Translation pending
AI summary · revised during review
An open standard for AI agent identity — signed declarations and attestations that verify offline.
Free security intelligence API and MCP server. 55 tools: CVE, domain recon, IOC, MITRE ATLAS, D3FEND, code security. No signup required.
One folder Claude Code, Cursor and Codex all read over MCP. An agent reads only what its person can, every write is a version, and folders share outward.
Verify and issue EU Digital Identity Wallet credentials with one API call. Open source, runs on your servers, personal data stays with you.
Free scam shield for Indian elders and families. Paste a message and get a plain verdict: Safe, Be Careful, or Danger. English, Hindi, Hinglish. Runs on your device.
Pattern-matching call blocker for Android. No internet permission. No ads. No tracking.
Translation pending
开了代理分流，国内外网站分别看到哪个 IP？用国内外几十个服务同时检测出口 IP，并检查 WebRTC / DNS 泄露、AI 服务地区和 IP 风险评分。纯前端开源，无后端。
Translation pending
Baret simulates every Monad transaction before you or your AI agent signs it, checks it against your rules, and explains the verdict in plain words.
Explore SPDX 3 SBOMs as an interactive graph. Packages, source files, builds, tools, licenses... and every link between them.
Deterministic rules that enforce what your agents can do in real time, per user and per tool call, with live and after-the-fact analysis. Open source by Hexamind.
Ten open-source tools to scan, prevent, attack, investigate, gate and contain prompt-injection, MCP supply-chain and agent-to-agent attacks against AI agents.
Signed, tamper-evident records of what your AI agent decided and what it relied on. Anchored on Solana, checked by anyone in their own browser.
Secrets management for the agentic era. No more secrets in .env files. Self-hosted, no limits, free forever.
Keyorra is a free password manager for your Mac: an encrypted vault that never leaves it, and a browser extension that fills logins, cards and one-time codes.
AI SAFE²: 161 controls across 5 pillars, mapped to 32+ frameworks. The open AI governance framework for agentic AI — free on GitHub.
Vulnerability-Lookup facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streamlines the management of Coordinated Vulnerability Disclosure (CV
ScanX checks every QR code and barcode for scams before you open it, makes QR codes and gives you a Digital ID card you can share in one tap. Privacy-first: scanning works without an account.
ProofAPI seals every AI decision on Solana. Anyone can check it with a link, without trusting the operator.
Stenwatch is a free, open-source tool that narrows every public software flaw to the few that matter to your organisation, with a plain reason for each one.
Jentic is a sovereign agent operating system. Your people and your agents work side by side, and the knowledge they create compounds into something you own.
Understand what is publicly discoverable about your website.
Browse powerful, production-ready open-source libraries created to help developers build faster and integrate features with ease.
Find the round trips, quick exits and fingerprint amounts that link your shielded Zcash activity, and check a withdrawal before you make it.
A free, privacy-first relay network that helps you reach the open internet. Open source and nonprofit-run.
Free Mac app that shows what your AI coding tools installed, checks their settings for problems, and tells you what's safe to clean up. It only looks.
Code checks 500 certificates exactly, Jev reads the ticket and judges only the few that matter, and a fixed policy decides. Every input, output and cent is shown.
Mailprogramm, Mailserver, SSH-Client, Remotedesktop, Passwortmanager mit eigenem Server, Editor und Bildschirmspiegeln: Open Source, ohne Telemetrie, mit Nyu der Katze. Ein Hobbyprojekt von Streamer M
Translation pending
BlindHop mixnet privacy layer for Substrate light clients. Toggle between direct, fast, and full metadata privacy modes. No setup required — runs in your browser.
SSO, MFA, passkeys, RBAC, and session management — built for developers, trusted by enterprises.
Qeet ID identity, authentication, authorization, and security operations console.
Translation pending
Subdomain enumeration you can trust. subenum classifies every DNS lookup, grades the run complete, degraded or unreliable, and ships as a single static Go binary.
Govern what context, models, and tools AI agents may use.
Keep all your devices protected with Blokada content filtering and encryption.
One control room over open agent governance, running on your own infrastructure: per-action passkey kill switch, WireGuard remote, post-quantum signatures, and a local-first AI copilot. Apache-2.0, se
AI governance software covering 30+ frameworks: EU AI Act, ISO 42001, NIST AI RMF, GDPR. Inventory, risk, policy, evidence, LLM evaluation.
Translation pending
Find what your app accidentally exposed. Free, read-only scan of your live site. No signup.
Translation pending
Docudis finds names, emails, phone numbers, IBANs and addresses in your documents and replaces them with labels, on your phone, before you send them to an AI.
MITM proxy for reverse engineering — LLM-ready output, multi-language codegen, sign algorithm inference, request replay, plugin system, native desktop GUI (Wails + Svelte)
Translation pending
Research • Tools • OSINT • AI. Инструменты, исследования и инженерный процесс.
Translation pending
Unofficial MCP server for the Sophos Fusion and Sophos Central APIs. Not a Sophos product and not supported by Sophos. 310 tools across 22 API namespaces, as a Claude Desktop extension or via npx.
Rapid7 Bulk Export MCP - AI-powered analysis for Rapid7 Command Platform data using MCP (Model Context Protocol) & AgentSkills.
Large Language Model (LLM) information redactor that prevents private information from being sent to LLMs from agentic tools by substituting placeholders for private information on outgoing requests a
Sequent is the world’s first online voting platform to ensure the highest level of confidence in elections for voters, election managers, and auditors
Vanity address mint for EVM and TRON. You make half the key on your own computer, we mint the other half on GPUs, and only you can put the full private key together.
One sealed envelope per person: a letter and the passwords they need, encrypted on your phone, opened only after months of silence. Open source, not audited.
Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.
AI Agent permission enforcement and sandbox security SDK, extracted from claw-code
Inspect SM2 signatures, ciphertext layouts, and nonce-reuse recovery in a browser.
Translation pending
AI IDE security hook: blocks directories, scans secrets, and protects AI interactions
Translation pending
Open-source crates for the Enclavia enclave runtime: in-enclave services, shared protocol types, client SDK, CLI. Dual-licensed Apache-2.0/MIT.
cMCP: Confidential MCP Gateway. Hardware-attested policy enforcement for MCP tool calls.
Translation pending
Klickbarer Prototyp: Pendelströme Konstanz–Kreuzlingen gemeinsam berechnen, ohne Rohdaten herzugeben (MPC, PSI, Differential Privacy) – mit Testdaten.
Translation pending
You can't govern what you can't see. Role mining and analytics that make sense of your authorization data — open source, self-hosted, your identity data never leaves your environment.
Verify two deployed randomness beacons from their real outputs: NIST Beacon 2.0 pulses (SHA-512 hash chain, skiplist, precommitment, RSA signature) and drand League of Entropy rounds (threshold BLS si
Check a sender address or a full email for phishing signals, with each finding explained. PhishGuard’s scores are heuristic evidence, not a guarantee of safety.
Truly redact PDFs in your own browser. Text is removed from the file, not covered with a black box, and your document is never uploaded.
Client-side visual analyzer for iptables, ip6tables, nftables and ufw rulesets — paste the output, see the structure.
Security checks agents can call: MCP manifest preflight, source-pattern scanning and injection screening, with signed redacted receipts.
Browse, search, and explore all Microsoft Intune Settings Catalog definitions — fast, and without needing Intune access.
Translation pending
Establish trust on every request. Welcome real users and AI agents, stop abusive bots — GDPR-compliant, risk-based verification that minimises friction.
13 specialized AI agents, 30+ MCP integrations, 7,200+ detection rules. Apache 2.0. Local-first.
Translation pending
Live demo of the Risk, Fraud & Regulatory Intelligence Copilot. Runs in your browser with fake sample data; no Snowflake, no AI call.
AI-control monitors for LangChain agents and Deep Agents: every step an agent proposes is judged before any of its own tools run, and a control protocol decides what runs.
Provenance-graph attack reconstruction from eBPF / Sysmon / auditd telemetry
Translation pending
Локальный AI-ассистент для аудита безопасности кода на Python, JavaScript/TypeScript и Go: находит уязвимости, классифицирует по CWE и OWASP Top 10 и предлагает проверенные исправления.
Translation pending
Sample-to-story malware analysis pipeline (lab-only, never executes samples)
Translation pending
shard-core combines ChaCha20-Poly1305 with Shamir key sharing, resilient recovery, explicit secret output, Fordefi phrase workflows, and a verified offline build path.
From generation to distribution. Generate, manage, and share SBOMs and compliance documents. Integrate with GitHub, GitLab, and more. CRA & NTIA compliant.
XTM Hub is your gateway to Filigran's cybersecurity solutions.
Built it? Time to show it.
One command in your project folder. Built with AI is enough; AI features are optional.
/nomorevibeSee how to list