Awesome AI Security Tools

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.

Type legend: 🟢 public source / open-source · 🔬 research (paper / benchmark / dataset / framework) · 🟠 commercial with open components · ⚠️ restrictive, non-commercial, or unclear/no license — check before use.

GitHub-hosted entries show static ★ stars and last-commit snapshots; refresh them with python3 scripts/update_github_metrics.py before release. Latest snapshot: 2026-08-16. Hugging Face model entries show license, access, and artifact metadata. Ordering within a section favors flagship and actively maintained projects.

Autotriage of Security Findings
AI Agent & Coding-Agent Security
Scanners & Auditors
Frameworks, Rule Standards & Benchmarks
Runtime Protection & Enforcement
AI/ML Supply Chain & Model Security
Pentest & Red-Team Agents
AI-Powered Recon & Narrow ML Tools
Subdomain & DNS Prediction
Recon Screenshot Triage
Software / Tech Fingerprinting
AI-Assisted Fuzzing
Password / Credential ML
Phishing Detection (Visual / URL)
AI/ML-Assisted Detection Rules & Engines
Defensive Trained-Model Detectors
AI-Powered SAST & Secure Code Review
AI-Powered Threat Modeling
LLM-Driven Fuzzing
Harness / target generation
Fuzzing the LLM
Threat Intelligence
Log Analysis / SIEM / SOC Triage
Reverse Engineering
LLM Red-Teaming & Guardrails
Scanners, Evals & Guardrails
Prompt-Injection Classifier Models
Specialty Security LLMs
LLM Honeypots & Deception
CTF / Exploit / Bug-Bounty Agents & Benchmarks
Cloud / IaC / DFIR / OSINT / Phishing
Related Awesome Lists
Contributing
Contact
License

Autotriage of Security Findings

AI/LLM tools that triage, deduplicate, prioritize, or validate the output of scanners and finding sources.

nuclei-autotriage 🟢⚠️ — Two-stage LLM triage (falsifier + red-team pass) of Nuclei JSONL findings via OpenAI-compatible endpoints (vLLM/Ollama). (CyberOK) — note: restrictive personal/non-commercial EULA, not a permissive OSS license. (★ 1 · updated 2026-05-25)
Related: agent-audit · asamm
seclab-taskflow-agent 🟢 — YAML-driven taskflow agent framework for triaging CodeQL/SAST alerts and filtering false positives. (GitHub Security Lab) (★ 221 · updated 2026-08-03)
Related: SigmaOptimizer
honeyslop 🟢 — Code-canary decoys to triage AI-hallucinated ("slop") vulnerability reports flooding bug-bounty programs. (★ 97 · updated 2026-05-20)
nano-analyzer 🟢🔬 — Minimal three-stage LLM pipeline (context → scan → skeptical triage) for zero-day discovery in C/C++. (AISLE) (★ 307 · updated 2026-04-14)
SigmaOptimizer 🟢 — Generates, tests, and refines Sigma rules from real logs with false-positive checking. (★ 11 · updated 2025-08-01)
Related: soctalk · seclab-taskflow-agent
ai-soc-triage-assistant 🟢⚠️ — SOC alert triage assistant with prompt-injection guardrails, output validation, and MITRE ATT&CK mapping. (★ 0 · updated 2026-02-23)

See also: OpenAI's Aardvark research preview — public references exist, but there is no standalone installable repository to badge here.

AI Agent & Coding-Agent Security

Securing the AI agents themselves — auditing coding agents (Claude Code, Codex, OpenClaw), scanning skills / plugins / MCP manifests, and governance for agentic development. A fast-moving 2026 category, split below by role.

Scanners & Auditors

agent-audit 🟢 — Forensic auditor for local AI coding agents (Claude Code, Codex CLI, OpenClaw) and project-surface scanner for repos shipping skills, plugins, and MCP manifests; 296 bundled rules across native + imported detector families, with optional LLM cross-verification. (CyberOK / S. Gordeychik) (★ 15 · updated 2026-07-15)
Sources: asamm · ATR – Agent Threat Rules · aguara · Cisco AI Defense – skill-scanner
Related: asamm · aguara · agentguard · agentic-radar · nuclei-autotriage
AI-Infra-Guard 🟢 — Full-stack AI red-teaming platform covering OpenClaw security scan, agent scan, skills scan, MCP scan, AI-infra vulnerability scan, and LLM jailbreak evaluation. (Tencent Zhuque Lab) (★ 4,512 · updated 2026-08-12)
Related: agent-audit · aguara · Cisco AI Defense – skill-scanner · Cisco AI Defense – mcp-scanner
SkillSpector 🟢 — Security scanner for AI-agent skills used by Claude Code, Codex CLI, Gemini CLI, and similar ecosystems; combines static analysis, AST/YARA/taint checks, optional LLM semantic review, MCP least-privilege/tool-poisoning checks, risk scoring, and SARIF/JSON/Markdown output. (NVIDIA) (★ 14,673 · updated 2026-08-15)
Related: Cisco AI Defense – skill-scanner · skilltotal · Snyk Agent Scan · Cisco AI Defense – mcp-scanner
Ramparts 🟢 — Rust scanner for MCP servers and agent-skill bundles with YARA rules, optional LLM analysis, OSV/CVE lookups, OWASP MCP Top 10 mapping, and SARIF/JSON/Markdown reports. (★ 96 · updated 2026-08-07)
Related: SkillSpector · Cisco AI Defense – skill-scanner · Cisco AI Defense – mcp-scanner
mcp-armor 🟢 — Local MCP security scanner with auto-discovery for agentic IDE configs, tool/resource/prompt inventory, prompt-injection checks, rug-pull and tool-poisoning detection, baseline drift monitoring, and JSON/Markdown reports. (Aira Security) (★ 119 · updated 2026-03-27)
Related: SkillSpector · Ramparts · Cisco AI Defense – mcp-scanner
aguara 🟢 — Single-binary static scanner (Go, no LLM) for AI-agent skills and MCP servers; multi-layer engine (pattern + NLP + taint tracking + rug-pull detection). Companion aguara-mcp exposes scanning as an MCP tool. (★ 86 · updated 2026-08-12)
Related: aguara-mcp · agent-audit · Snyk Agent Scan · Cisco AI Defense – skill-scanner
agent-scan 🟢 — Security scanner for AI agents, MCP servers, and agent skills; the successor path for the original Invariant Labs mcp-scan work. (Snyk) (★ 2,912 · updated 2026-08-13)
Related: aguara · Cisco AI Defense – mcp-scanner · Cisco AI Defense – skill-scanner
inkog 🟠 — Commercial-backed static security scanner for AI agents across LangChain, LangGraph, CrewAI, AutoGen, and no-code workflows; Apache-2.0 CLI with proprietary deep-scan engine. (Inkog) (★ 28 · updated 2026-06-07)
Related: Snyk Agent Scan · agentic-radar
AgentShield 🟢 — Security scanner for AI-agent configurations, MCP servers, hooks, and tool permissions with CLI, GitHub Action, and app workflows. (★ 1,068 · updated 2026-07-22)
Related: agent-audit · Snyk Agent Scan
repo-forensics 🟢⚠️ — Offline scanner for AI-agent repos, skills, plugins, and MCP servers; license is PolyForm Noncommercial. (★ 155 · updated 2026-08-08)
Related: agent-audit · aguara
skill-scanner 🟠 — Scanner for agent skills combining YAML + YARA patterns, LLM-as-a-judge, and behavioral dataflow analysis (Codex / Cursor skill formats). (Cisco AI Defense) (★ 2,435 · updated 2026-08-04)
Related: defenseclaw · aguara · Cisco AI Defense – mcp-scanner
mcp-scanner 🟢⚠️ — Scanner for MCP servers and agentic tool surfaces, covering tools, prompts, resources, package risk, malware indicators, and deployment readiness. (Cisco AI Defense) (★ 1,033 · updated 2026-08-07)
Related: Cisco AI Defense – skill-scanner · Snyk Agent Scan · aguara
mcp-guardian 🟢 — JS/TS library and CLI for detecting prompt injection in MCP tool descriptions and pinning tool definitions. (★ 6 · updated 2026-07-29)
Related: Cisco AI Defense – mcp-scanner · Snyk Agent Scan
MCP Observatory 🟢🟠 — CI-native MCP-server testing tool for schema drift, safe attack simulation, record/replay verification, health scoring, and SARIF evidence before agents depend on a server. (KryptosAI) — note: the local evidence engine is open source; hosted telemetry intelligence, fleet workflows, and commercial ranking remain outside the package. (★ 176 · updated 2026-08-15)
Related: Cisco AI Defense – mcp-scanner · skilltotal
agentic-radar 🟠 — CLI security scanner for agentic workflows (LangGraph, CrewAI, n8n, etc.) — maps tools/data flows and flags risks. (SplxAI) (★ 1,036 · updated 2025-11-27)
skilltotal 🟢 — Offline deterministic static scanner (regex + AST, no LLM, no account) for AI components — agent skills/plugins, MCP servers, npm & PyPI packages, and git repos; flags supply-chain risk, dangerous capabilities, prompt-injection surfaces, MCP tool poisoning/shadowing, and data-exfiltration paths, maps to the OWASP Agentic Skills Top 10, and emits JSON + SARIF 2.1.0. (skilltotal.ai) (★ 1 · updated 2026-08-15)
Related: aguara · Snyk Agent Scan · Cisco AI Defense – skill-scanner · Cisco AI Defense – mcp-scanner
Sunglasses 🟢 — Local input/content scanner for AI agents that checks prompts, files, media metadata, skills, and tool descriptions against pattern and mechanism-based prompt-injection, exfiltration, command-injection, and agent-threat rules. — note: early-stage project; published precision/recall benchmark is self-reported by the project. (★ 4 · updated 2026-08-14)
Related: skilltotal · Armorer Guard
trentclaw 🟠 — Client-side security auditor for OpenClaw deployments: applies pattern-based secret redaction locally, then uploads config/skill metadata and confirm-gated skill archives to Trent AI's API, which identifies misconfigurations, risky skills (prompt injection, permission escalation, data exfiltration), and chained attack paths. (Trent AI) — note: core detection runs server-side via the Trent AI API (requires an API key); the Apache-2.0 client collects OpenClaw config/skill metadata, applies pattern-based secret redaction locally, and uploads skill archives only after an explicit in-terminal confirmation. (★ 23 · updated 2026-07-27)
A2A Security Scanner 🟢 — CLI and PyPI scanner for Agent-to-Agent (A2A) agent cards, source code, registries, and live endpoints using specification validation, YARA rules, heuristics, endpoint testing, and an optional LLM analyzer. (Cisco AI Defense) (★ 162 · updated 2026-04-16)
Related: Cisco AI Defense – mcp-scanner · Agent Threat Rules

Frameworks, Rule Standards & Benchmarks

asamm 🔬 — Agentic SAMM — an OWASP SAMM extension for AI-driven development: an entry-point-based threat taxonomy plus 17 controls across 5 SAMM functions (Governance, Design, Implementation, Verification, Operations) with L1/L2/L3 maturity. License: CC BY-SA 4.0. (CyberOK / S. Gordeychik) (★ 17 · updated 2026-07-26)
Sources: OWASP SAMM · NIST AI RMF · NCSC Secure AI Guidelines · MCP Security Best Practices
Related: agent-audit
agent-threat-rules (ATR) 🟢 — Open, versioned, machine-readable detection rules for AI-agent threats (prompt injection, tool poisoning, MCP attacks, and skill compromise) — "Sigma for agents"; 768 rules across 10 categories with integrations for Microsoft AGT, Cisco AI Defense, MISP, OWASP, FINOS, and SigmaHQ. (★ 371 · updated 2026-08-16)
Related: agent-audit · aguara
Agent Governance Toolkit 🟢 — Multi-language toolkit for policy-enforced agent tool calls and audit records, with optional identity, MCP-gateway, sandboxing, reliability, and compliance components. (Microsoft) — note: official public preview; APIs and deployment patterns may change before general availability. (★ 5,953 · updated 2026-08-12)
Related: ATR – Agent Threat Rules · ToolHive
MCP-Security-Checklist 🟢 — Security checklist for MCP clients, servers, multi-MCP deployments, lifecycle controls, authz/authn, isolation, and crypto-specific MCP integrations. (SlowMist) (★ 835 · updated 2025-04-28)
Related: Cisco AI Defense – mcp-scanner · ATR – Agent Threat Rules
Anthropic-Cybersecurity-Skills 🟢 — Large community cybersecurity skill library for AI agents, mapped to MITRE ATT&CK, NIST CSF, MITRE ATLAS, D3FEND, and NIST AI RMF. — note: independent community project, not affiliated with Anthropic. (★ 27,919 · updated 2026-08-08)
Related: sast-skills · Cisco AI Defense – skill-scanner
Claude-BugHunter 🟢 — Claude Code / agent-skill bundle for authorized bug hunting and external red-team workflows across web, API, identity, cloud, recon, reporting, Burp MCP, slash commands, and the cbh CLI. — note: skill bundle and workflow knowledge base, not a standalone scanner. (★ 3,616 · updated 2026-08-16)
Related: sast-skills · Anthropic-Cybersecurity-Skills
AgentDojo 🟢🔬 — Benchmark environment for prompt-injection attacks and defenses in tool-using LLM agents. (★ 749 · updated 2026-06-02)
Related: agent-audit · ATR – Agent Threat Rules
Agent3Sigma-Canary 🟢🔬 — Sandboxed research framework for evaluating AI-agent security over complete execution trajectories, covering direct/indirect injection, skill and memory poisoning, and practical risk outcomes. (Ant Group) — note: research framework that requires Docker plus target and auxiliary LLM configuration; use only in controlled environments. (★ 35 · updated 2026-08-09)
Related: AgentDojo · HarmBench
Agent Security Bench (ASB) 🟢🔬 — Official ICLR 2025 benchmark for evaluating attacks and defenses in LLM-based agents across ten scenarios, including direct and indirect prompt injection, memory poisoning, and defensive strategies. — note: research benchmark rather than a production control; reproducing evaluations requires configured target and evaluator models. (★ 284 · updated 2026-04-16)
Related: AgentDojo · Agent3Sigma-Canary
Skill-Inject 🟢🔬 — Benchmark for measuring prompt-injection vulnerabilities carried by agent skill files across Claude Code, Codex CLI, and Gemini CLI under multiple safety-policy conditions. — note: benchmark artifact that executes controlled malicious skill scenarios; run only in an isolated test environment with synthetic data and accounts. (★ 91 · updated 2026-07-01)
Related: SkillSpector · AgentDojo
AI Security Verification Standard (AISVS) 🔬⚠️ — Stable verification standard defining testable security requirements for AI applications across model lifecycle, supply chain, data handling, agentic systems, and MCP integrations. (OWASP) — note: security standard and checklist, not an executable scanner; share-alike terms apply to adapted material. (★ 428 · updated 2026-07-30)
Related: asamm · Agent Threat Rules

Runtime Protection & Enforcement

nono 🟢 — Least-privilege sandbox for AI coding agents that isolates the agent and delegated tools with composable filesystem, network, credential-proxy, and command policies. (NoLabs) — note: APIs are still stabilizing ahead of the 1.0 release; review every pulled profile before use. (★ 3,672 · updated 2026-08-13)
Related: microsandbox · ToolHive
Arcjet Guard 🟢🟠 — JavaScript runtime guard for AI-agent tool calls and MCP handlers, with prompt-injection detection, sensitive-data detection/redaction, and custom local policy rules. (Arcjet) — note: open SDK packages integrate with Arcjet's hosted platform; assess the service, account, and data-processing requirements for the protections you enable. (★ 680 · updated 2026-08-15)
Related: LLM Guard · AgentLock
ToolHive 🟢 — Platform for running MCP servers in isolated containers with per-request identity/access policy, registry and gateway workflows, audit logs, Kubernetes operator support, and observability hooks. (Stacklok) (★ 2,016 · updated 2026-08-14)
Related: microsandbox · defenseclaw
Pipelock 🟢 — AI-agent firewall and verifiable egress-control layer mediating HTTP, WebSocket, CONNECT, MCP, and A2A traffic to detect prompt injection, secret exfiltration, SSRF, and suspicious outbound actions. — note: open-source core is Apache-2.0; commercial reporting/features are also advertised. (★ 796 · updated 2026-08-16)
Related: ToolHive · mcp-context-protector
SourceryKit 🟠⚠️ — Python SDK for agent guardrails that intercepts outbound HTTP calls, enforces trusted-endpoint policies, logs requests, and checks agent handoff claims against a Provably backend before propagation. (ProvablyAI) — note: BSL-1.1 licensed; requires Provably backend/API credentials and database setup. (★ 18 · updated 2026-08-12)
Related: Pipelock · mcp-context-protector
emisar 🟠⚠️ — Agent-infrastructure control plane that exposes declared, typed actions through MCP, applies policy and approval gates before dispatch, revalidates calls on an outbound-only host runner, and records separate control-plane and host audit trails. — note: runner, MCP bridge, and packs are Apache-2.0; the hosted portal/control plane is BSL-1.1 and converts to Apache-2.0 on 2029-07-26. Connecting a runner requires an emisar account and outbound HTTPS to the control plane. (★ 416 · updated 2026-08-15)
mcp-context-protector 🟢 — MCP security wrapper that sits in front of downstream MCP servers, scans tool responses with guardrail providers, and supports quarantine/review workflows for desktop and coding-agent MCP configs. (Trail of Bits) (★ 222 · updated 2026-02-13)
Related: Cisco AI Defense – mcp-scanner · ToolHive · Pipelock
MCP Defender 🟢⚠️ — Desktop app that proxies MCP tool-call requests and responses for Cursor, Claude, VS Code, and Windsurf, checks intercepted traffic against signatures, and prompts users to allow or block suspicious calls. — note: AGPL-3.0 licensed; project has been acquired by Docker. (★ 255 · updated 2026-06-05)
Related: ToolHive · mcp-context-protector
MCP Gateway 🟢 — Plugin-based MCP gateway that proxies configured MCP servers, sanitizes sensitive request/response data, supports guardrail plugins such as basic masking and Presidio, and runs a server reputation/risk check before loading MCP servers. (Lasso Security) (★ 385 · updated 2026-01-22)
Related: ToolHive · Pipelock · mcp-context-protector
Parallax 🟢 — Rust runtime policy engine for AI agents: evaluates lifecycle events with regex, keyword, Sigma, CEL, and SQL rules to block or redact prompt injection, data exfiltration, dangerous tool calls, and secret leakage. — note: early-stage project with limited adoption signal. (★ 35 · updated 2026-06-05)
Related: Pipelock · Armorer Guard
Armorer Guard 🟢 — Local Rust scanner and MCP proxy for AI-agent prompt injection, credential leakage, exfiltration, and risky tool-call arguments, with structured reasons and no scanner network calls. — note: young project with limited independent adoption signal. (★ 42 · updated 2026-08-09)
Related: agentguard · ATR – Agent Threat Rules
onecli 🟢 — Credential gateway and encrypted vault for AI agents; injects real API credentials at the gateway so agents only see placeholder keys. (★ 3,095 · updated 2026-07-31)
Related: agentguard · defenseclaw
microsandbox 🟢 — Local-first, microVM-backed programmable sandboxes for AI agents with SDKs, CLI, MCP support, and rootless hardware isolation. (★ 7,548 · updated 2026-08-16)
Related: agentguard · defenseclaw
agentguard 🟢 — Real-time security layer for coding agents: hooks scan every new skill, block dangerous actions before execution, run daily posture patrols, and track which skill triggered each action (incl. Web3-specific checks). (★ 456 · updated 2026-06-25)
Related: agent-audit · defenseclaw
defenseclaw 🟠 — Enforcement and evidence layer for agentic deployments: static CodeGuard checks, sandboxing, registry ingestion with SSRF guards, and audit/observability. (Cisco AI Defense) (★ 819 · updated 2026-08-14)
Related: Cisco AI Defense – skill-scanner · agentguard
clawsec 🟢⚠️ — Security skill suite for OpenClaw-family agents; AGPL-3.0 licensed. (Prompt Security) (★ 1,083 · updated 2026-08-05)
Related: agentguard · Cisco AI Defense – skill-scanner
AgentLock 🟢🔬⚠️ — Pre-action authorization gate for LLM agent tool calls that decides from session provenance rather than content, with deny-by-default tool permissions, parameter lineage, Ed25519 signed receipts, and a hash-chained audit log; AGPL-3.0 licensed with commercial options. — note: evaluated on AgentDojo with predictions pre-registered before the runs; the published results include a suite where the defense costs more utility than the attack it prevents. (★ 19 · updated 2026-08-12)
h5i 🟢 — Local Rust CLI for auditable coding-agent workspaces: per-agent worktrees with sandbox policies, provenance capture, peer review, neutral verification, secret/prompt-injection audit signals, and refs/h5i/ run metadata. — note: security-adjacent agent-workspace governance tool, not a vulnerability scanner or VM-equivalent sandbox. (★ 531 · updated 2026-08-16)*
Related: microsandbox · defenseclaw
DvalinCode 🟢 — Local-first AI coding agent with runtime governance controls: org/repo policy gates for tools, models, MCP servers, paths, and commands, plus provider/shell/MCP egress controls and hash-chained audit logs. — note: young project with limited independent adoption signal. (★ 112 · updated 2026-08-11)
Related: h5i · Pipelock · Armorer Guard
TAP 🟢🟠 — Credential-isolation proxy and MCP server for AI agents: agents send placeholder credentials, TAP injects real secrets server-side after per-action policy checks, with optional human approval on sensitive calls. (human.tech) — note: Apache-2.0 runtime is self-hostable, but the hosted dashboard and managed-service deployment glue are proprietary; self-hosting puts credential/key isolation and policy-engine hardening on the operator. (★ 12 · updated 2026-07-23)
Agent Memory Guard 🟢 — Runtime middleware for AI-agent memory reads and writes, screening prompt injection, memory poisoning, secret/PII leakage, protected-key tampering, and size anomalies before persisted memory is reused. (OWASP) — note: OWASP Incubator project; published benchmark numbers are project-reported and should be independently reproduced before production enforcement. (★ 125 · updated 2026-08-16)
AIO Sandbox 🟢⚠️ — All-in-one Docker workspace for AI agents with browser, shell, file, code-execution, MCP, and VSCode interfaces, plus API-key/JWT controls and private-deployment guidance. — note: the public repository ships SDKs, integrations, and docs rather than the core runtime service; official Chromium-enabled deployments use seccomp=unconfined. Treat it as a trusted execution environment, not a hardened isolation boundary; use separate VMs or a hardened runtime plus network policy for hostile workloads. (★ 5,719 · updated 2026-07-02)
Related: Kubernetes Agent Sandbox · microsandbox
Agentgateway 🟢 — Agent-native proxy and gateway for MCP and A2A traffic with OAuth/JWT/API-key authentication, CEL-based RBAC policies, TLS, rate limiting, and OpenTelemetry observability. (★ 4,373 · updated 2026-08-14)
Related: MCP Gateway · Pipelock
Kubernetes Agent Sandbox 🟢 — Kubernetes CRDs and controllers for isolated, stateful singleton agent workloads, delegating low-level isolation to configured runtimes such as gVisor or Kata Containers. (Kubernetes SIG Apps) — note: sandbox orchestrator, not an isolation runtime itself; security depends on the selected RuntimeClass, network policy, and workload configuration. (★ 3,532 · updated 2026-08-16)
Sources: Kubernetes announcement
Related: AIO Sandbox
Prismor 🟢 — Self-hosted runtime control plane for coding agents with pre-tool-call hooks, policy-driven observe/approve/block decisions, an MCP gateway, secret and egress controls, and tamper-evident audit evidence. (★ 290 · updated 2026-08-16)
Related: Armorer Guard · AgentLock
tirith 🟢⚠️ — Terminal guard for developers and AI coding agents that intercepts homograph and terminal-injection tricks, obfuscated execution chains, pipe-to-shell patterns, credential exfiltration, and malicious skill/config files. — note: AGPL-3.0 with a separate commercial license; shell interception is a host-side guard, not a substitute for sandboxing or least-privilege tool access. (★ 2,663 · updated 2026-08-13)
Related: nono · gate.cat
ADR 🟢🔬 — Agentic AI Detection and Response system combining cross-client agent telemetry, ADR-Bench security scenarios, and a dual-agent detector for suspicious intent, tool use, and execution traces. (Uber) — note: deployed at Uber and published with an MLSys 2026 paper; the open release includes the Sensor, benchmark, and Detector, but not ADR Prevention or the offline ADR Explorer. Default detector configurations require model-provider credentials. (★ 1,435 · updated 2026-08-10)
Related: Pipelock · AgentLock

AI/ML Supply Chain & Model Security

Tools for securing model artifacts, serialized ML files, AI/ML supply-chain surfaces, and malicious-package detection datasets/benchmarks.

Fraim 🟢 — Framework for AI-powered security workflows including LLM SAST and IaC analysis with SARIF/HTML output. (★ 160 · updated 2025-12-01)
Related: sast-skills
Adversarial Robustness Toolbox (ART) 🟢 — Flagship machine-learning security library for evaluating and defending models against evasion, poisoning, extraction, and inference attacks across major ML frameworks. (LF AI & Data / IBM) (★ 6,178 · updated 2025-11-13)
Related: Foolbox · PrivacyRaven
Foolbox 🟢 — Classic Python toolbox for generating adversarial examples and benchmarking robustness of PyTorch, TensorFlow, and JAX models. (★ 2,972 · updated 2024-03-04)
Related: Adversarial Robustness Toolbox
modelscan 🟢 — Scans ML model files for unsafe serialization patterns and embedded code, with a focus on model serialization attacks. (Protect AI) (★ 762 · updated 2026-02-18)
Related: Fickling · picklescan · ai-exploits
Fickling 🟢 — Python pickle decompiler, rewriter, and static analyzer for inspecting and detecting malicious pickle/PyTorch payloads. (Trail of Bits) (★ 662 · updated 2026-08-13)
Related: modelscan · picklescan
picklescan 🟢 — Lightweight CLI/library for detecting suspicious Python pickle operations in ML and model artifacts. (★ 418 · updated 2026-07-01)
Related: modelscan · Fickling
AIsbom 🟢 — AI software bill of materials tooling for AI/ML supply-chain inventory and provenance metadata. (★ 76 · updated 2026-08-16)
Related: modelscan · model-provenance-kit
model-provenance-kit 🟢 — Toolkit for model-family provenance and fingerprinting across model weights, tokenizers, and architecture signals. (Cisco AI Defense) (★ 101 · updated 2026-08-12)
Related: AIsbom
pickle-fuzzer 🟢 — Structure-aware fuzzer for pickle scanners, useful for hardening tools such as modelscan, Fickling, and picklescan. (Cisco AI Defense) (★ 17 · updated 2026-08-03)
Related: modelscan · Fickling · picklescan
Medusa 🟢⚠️ — AI-first security scanner for AI/ML repos, agents, and MCP surfaces; AGPL-3.0 licensed. (Pantheon Security) (★ 964 · updated 2026-06-24)
Related: agent-audit · modelscan
PrivacyRaven 🟢🔬 — Privacy-testing library for deep-learning systems, covering model extraction and membership-inference style attacks. (Trail of Bits) — note: archived/hiatus project, but still a useful reference implementation. (★ 214 · updated 2025-09-05)
Related: Adversarial Robustness Toolbox
gym-malware 🟢🔬 — OpenAI Gym environment for reinforcement-learning agents that mutate PE malware to evade static ML malware detectors. (★ 636 · updated 2018-06-15)
deep-pwning 🟢🔬 — Historical "Metasploit for machine learning" framework for experimenting with adversarial robustness of ML models. (★ 571 · updated 2022-05-17)
open-malicious-code-benchmark 🟢🔬 — OMCBench benchmark suite for malicious-code/package detection: labeled Python and JavaScript package archives, common runners, and published precision/recall/F1 metrics. (False Positive Community) — note: evaluates an unreleased commercial ML detector (MOLOT / PT Application Inspector) alongside open-source baselines. (★ 17 · updated 2026-06-09)
Related: GuardDog · OSSGadget · malicious-code-ruleset · bandit4mal
malicious-software-packages-dataset 🟢🔬 — Human-vetted dataset of malicious software packages across npm, PyPI, IDE extensions, and AI Skills, useful for detector training and evaluation. (Datadog Security Labs) — note: contains real malware samples; Datadog notes selection bias because many samples were identified by GuardDog. (★ 371 · updated 2026-08-14)
Related: GuardDog · pypi_malregistry
GuardDog 🟢 — CLI for detecting malicious PyPI, npm, Go, RubyGems, GitHub Actions, and VSCode extension packages using Semgrep rules and package-metadata heuristics. (Datadog) (★ 1,184 · updated 2026-08-14)
Related: malicious-software-packages-dataset · Packj
package-analysis 🟢🔬 — Sandboxed static/dynamic analysis pipeline for open-source packages, capturing filesystem, process, and network behavior and publishing data for malicious-package research. (OpenSSF) (★ 903 · updated 2026-07-21)
Related: malicious-packages · package-feeds
malicious-code-ruleset 🟢 — Focused Semgrep ruleset for malicious-code patterns such as dynamic execution and obfuscation, used as an OMCBench baseline. (Apiiro) (★ 149 · updated 2025-02-24)
Related: open-malicious-code-benchmark
pypi_malregistry 🔬⚠️ — ASE'23 / USENIX Security'26 malicious-PyPI dataset with more than 10k malicious package versions. — note: no LICENSE file found and the repository contains malware samples; handle in an isolated environment. (★ 129 · updated 2026-07-21)
Related: malicious-software-packages-dataset

Pentest & Red-Team Agents

Autonomous and semi-autonomous AI agents for penetration testing, exploitation, and attack simulation.

PentestGPT 🟢🔬 — The original USENIX'24 LLM pentest agent; re-released as an autonomous pipeline with strong benchmark results. (★ 14,886 · updated 2026-07-14)
PentAGI 🟢 — Fully autonomous multi-agent pentest framework with Docker sandboxing. (VXControl) (★ 21,845 · updated 2026-08-06)
CAI – Cybersecurity AI 🟢🟠 — Modular, bug-bounty-ready agent framework supporting 300+ LLM models. MIT for research; separate commercial license for production/on-prem. (Alias Robotics) (★ 9,735 · updated 2026-07-14)
Strix 🟢 — Autonomous "AI hackers" that dynamically run code and validate vulnerabilities with PoCs (Apache-2.0). (★ 53,078 · updated 2026-08-14)
hackingBuddyGPT 🟢🔬 — Minimal (~50 LOC) research framework for LLM-driven Linux priv-esc and web pentesting (FSE'23). (★ 1,209 · updated 2026-08-10)
Nebula 🟢🟠 — AI pentesting CLI assistant with local-LLM support (Llama-3.1, Mistral, DeepSeek). (★ 1,087 · updated 2026-07-26)
HexStrike-AI 🟢 — MCP server exposing 150+ security tools (nmap, gobuster, nuclei, …) to AI agents (MIT). (★ 11,066 · updated 2026-08-03)
Deep Eye 🟢 — AI-assisted penetration-testing scanner that orchestrates multiple LLM providers for payload generation, 45+ vulnerability checks, CVE/RAG-assisted testing, AI triage, scan diffing, browser automation, proxying, and multi-format reports. — note: MIT-licensed; authorized use only. Heavy runtime surface: optional browser automation/proxying, plaintext API-key config, plugins with full OS access, and pickle model files called out in SECURITY.md. (★ 1,968 · updated 2026-08-14)
Related: HexStrike-AI · pentest-ai
Burp Suite MCP Server 🟢⚠️ — Official Burp Suite extension exposing Burp to AI clients through MCP. (PortSwigger) — note: GPL-3.0 licensed. (★ 1,070 · updated 2026-08-12)
Related: HexStrike-AI
pentest-ai 🟢 — Offensive-security MCP server with 200+ wrapped tools, specialist agents, and OWASP-oriented probes for authorized testing. (★ 1,594 · updated 2026-08-08)
Related: pentest-ai-agents
pentest-ai-agents 🟢 — Collection of Claude Code offensive-security subagents for authorized penetration-testing research. (★ 2,130 · updated 2026-08-08)
Related: pentest-ai
DarkMoon 🟢⚠️ — Autonomous AI penetration-testing platform that orchestrates specialized web, AD, Kubernetes, CMS, and framework agents through an MCP-controlled Docker toolbox with local privacy-tokenization for sensitive target data. — note: GPL-3.0 licensed; heavy Docker/LLM stack, use only for authorized testing. (★ 841 · updated 2026-08-06)
Related: PentAGI · HexStrike-AI · pentest-ai
T3MP3ST 🟢⚠️ — Autonomous offensive-security meta-harness that wraps local or API-backed coding agents into a multi-agent recon-to-exploit workflow with MCP/API, War Room UI, tool arsenal, and committed benchmark artifacts. — note: very new AGPL-3.0 project with bold benchmark claims; use only for authorized testing and verify independently before operational use. (★ 5,587 · updated 2026-08-12)
Related: PentAGI · HexStrike-AI · pentest-ai
Shannon 🟢🟠⚠️ — White-box autonomous AI pentester with strong XBOW-benchmark results. Shannon Lite is AGPL-3.0; Shannon Pro is commercial. (★ 46,855 · updated 2026-08-12)
AIDA 🟢⚠️ — Model-agnostic autonomous pentest agent running inside an isolated Docker environment; AGPL-3.0 licensed. (★ 472 · updated 2026-07-19)
HackSynth 🟢🔬⚠️ — Planner/summarizer LLM-agent framework for autonomous penetration testing and benchmark evaluation; AGPL-3.0 licensed. (★ 313 · updated 2025-06-24)
VulnBot 🟢🔬 — Multi-agent collaborative penetration-testing framework with RAG support. (★ 185 · updated 2025-04-07)
PentestAgent 🟢 — Black-box AI pentest framework with MCP, multi-agent spawning, and persistent sessions. (★ 2,950 · updated 2026-08-04)
cyber-security-llm-agents 🟢⚠️ — AutoGen-based agents for cybersecurity tasks (shown at RSAC 2024). (NVISO) (★ 388 · updated 2024-05-07)
Pentest-Swarm-AI 🟢 — Swarm-intelligence multi-agent pentest with stigmergic blackboard coordination (Go). (★ 2,204 · updated 2026-08-04)
hackGPT 🟢⚠️ — LLM offensive-security toolkit. (★ 1,199 · updated 2026-08-12)
ShiftGrid 🟢 — Prompt engine that turns Claude Code into a transparent, human-in-the-loop pentester, structuring engagements through checklists, observations, and notes exposed via an agent-facing API. — note: early-stage local Docker application with no built-in authentication; keep its API and UI ports bound to localhost. (★ 38 · updated 2026-08-02)
BugTraceAI 🟢⚠️ — Self-hosted autonomous web-application security scanner that combines reconnaissance, specialist exploit agents, Go fuzzers, and Playwright validation to produce evidence-backed findings. (BugTraceAI) — note: AGPL-3.0 licensed and beta; use only for authorized testing. Requires an LLM provider or local Ollama endpoint and a substantial Docker/Playwright/Go runtime. (★ 174 · updated 2026-07-30)
Related: Project overview · Web dashboard · Docker launcher
HunterX 🟢 — AI-assisted offensive security engine that orchestrates reconnaissance, security-tool coordination, vulnerability detection and validation, evidence collection, and report-ready findings in one workflow. (NullC0d3) — note: early-stage and tool-orchestration-heavy; run only in an isolated, authorized assessment environment. (★ 11 · updated 2026-08-16)
MCP Security Hub 🟢 — Collection of Dockerized MCP servers that expose offensive-security tools such as Nmap, Nuclei, SQLMap, Ghidra, Hashcat, and related assessment utilities to MCP-capable assistants. (FuzzingLabs) — note: orchestration and wrapper collection rather than a security boundary; its containers invoke offensive tools and must be used only in isolated, explicitly authorized environments. (★ 760 · updated 2026-04-08)
Related: pentest-ai · Burp Suite MCP Server

AI-Powered Recon & Narrow ML Tools

Hyper-specific AI/ML tools for a single offensive-security, recon, or detection step — the subwiz/eyeballer pattern rather than broad autonomous agents. 🅐 = self-contained trained model or learned model/pattern engine; 🅑 = LLM wrapper that calls an external API.

Subdomain & DNS Prediction

subwiz 🟢 — 🅐 Lightweight nanoGPT model that predicts resolvable subdomains via beam search; model weights are published on Hugging Face. (Hadrian Security) (★ 388 · updated 2025-12-18)
Related: HadrianSecurity/subwiz model
regulator 🟢⚠️ — 🅐 Learns and ranks regex-like naming patterns from known subdomains to generate likely new candidates. — note: no LICENSE file found; treat as source-available until clarified. (★ 392 · updated 2023-02-18)
Related: subwiz

Recon Screenshot Triage

eyeballer 🟢⚠️ — 🅐 Convolutional neural network that classifies pentest/recon screenshots (login pages, webapps, old-looking sites, parked domains, and custom 404s) for attack-surface triage. (Bishop Fox) — note: GPL-3.0 licensed. (★ 1,290 · updated 2024-02-19)

Software / Tech Fingerprinting

GyoiThon 🟢🔬 — 🅐 Machine-learning-assisted web intelligence tool that fingerprints products, versions, CVEs, login pages, debug messages, and related web-server signals from HTTP responses. — note: historical research reference; Apache-2.0 licensed, but maintenance is low. (★ 826 · updated 2021-06-29)

AI-Assisted Fuzzing

ffufai 🟢⚠️ — 🅑 AI wrapper around the ffuf web fuzzer that suggests file extensions and paths from the target URL and headers using OpenAI or Anthropic models. (Joseph Thacker) — note: requires an LLM API key; README states MIT but no LICENSE file was found. (★ 801 · updated 2025-12-04)

Password / Credential ML

PassGPT 🔬⚠️ — 🅐 GPT-style password model trained on leaked passwords for research on password generation and strength estimation. (Rando et al.) license: CC BY-NC-4.0 · access: open 10-char model; 16-char variant gated · artifacts: PyTorch/Safetensors. Research-only / non-commercial use; related code: javirandor/passgpt.
PassGAN 🔬 — 🅐 WGAN that learns password distributions from leaks to generate guesses; historical reference implementation of the PassGAN paper (MIT). — note: historical research reference; not an actively maintained password-auditing product. (★ 2,009 · updated 2018-09-30)
neural_network_cracking 🔬 — 🅐 RNN password-guessing model from Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks (USENIX Security 2016); Apache-2.0 licensed. (CMU CUPS Lab) — note: historical USENIX research implementation, not a maintained password-auditing product. (★ 243 · updated 2018-11-30)
Related: PassGPT · PassGAN

Phishing Detection (Visual / URL)

phishing-url-detection 🟢 — 🅐 Packaged URL phishing classifier with ONNX and pickle artifacts. license: MIT · access: open · artifacts: ONNX, pickle. Model card recommends ONNX over pickle for safer inference.
Phishing Email Detection DistilBERT v2.4.1 🟢 — DistilBERT text-classification model for email and URL phishing detection, trained on a public Hugging Face phishing-email dataset. license: Apache-2.0 · access: open · artifacts: Safetensors. — note: strong download signal, but independently verify the very high published metrics before production use.
PhishIntention 🔬 — 🅐 Deep-vision phishing detector that infers both brand intention and credential-taking intention from webpage appearance and dynamics (USENIX Security 2022). — note: CC0-1.0 licensed. (★ 263 · updated 2026-06-04)
VisualPhishNet 🔬⚠️ — 🅐 Triplet CNN for zero-day phishing detection by visual similarity to trusted websites (ACM CCS 2020). (CISPA) — note: no LICENSE file found; dataset access is research-request based. (★ 30 · updated 2022-02-09)

AI/ML-Assisted Detection Rules & Engines

SYARA 🟢🔬 — 🅐 Semantic YARA-like rule engine for text and multimodal signals, adding embedding similarity, classifier-backed rules, LLM evaluators, and pHash matching to familiar YARA-style syntax. — note: early-stage engine; useful for LLM-era intent signals such as phishing, prompt injection, jailbreaks, hallucination, and disinformation rather than classic binary-only YARA matching. (★ 18 · updated 2026-03-05)
AutoYara 🟢🔬 — 🅐 Research implementation of automatic YARA rule generation via biclustering over byte n-grams for malware-family samples. — note: Apache-2.0 research code from the ACM AISec 2020 paper; README explicitly says it comes with no warranty or support. (★ 79 · updated 2025-10-08)
Related: Automatic Yara Rule Generation Using Biclustering
yaraml_rules 🟢🔬 — Research code that trains scikit-learn classifiers on malware and benign corpora, then compiles the learned model into deployable YARA rules. (Sophos) — note: historical research reference; the maintained value is the ML-to-YARA technique, not a current detection product. (★ 215 · updated 2020-12-18)
RuleLLM 🟢🔬 — 🅑 LLM-assisted malware-rule generator that clusters malicious code samples and produces/refines/validates YARA and Semgrep rules. — note: MIT-licensed research prototype; requires OpenAI-compatible API access plus YARA/Semgrep validators. (★ 12 · updated 2025-04-25)

Defensive Trained-Model Detectors

DeepSQLi 🟢⚠️ — 🅐 Deep-learning SQL-injection detector with dataset, trained models, and a Flask Prediction API for GatewayD IDS/IPS integration. (GatewayD) — note: AGPL-3.0 licensed; defensive detector rather than offensive generator. (★ 7 · updated 2026-02-21)
deepsecrets 🟢 — Semantic secrets scanner using lexing/parsing, entropy checks, and hashed-known-secret matching across 500+ languages. — note: useful narrow detector, but not a trained ML model. (★ 171 · updated 2026-06-04)
VLAI Vulnerability Severity Classifier 🟢🔬 — RoBERTa-based vulnerability-severity classifier trained on CIRCL vulnerability scores to assist triage before manual CVSS scoring. (CIRCL) license: CC-BY-4.0 · access: open · artifacts: Safetensors.

AI-Powered SAST & Secure Code Review

Static analysis and secure code review enhanced with LLMs.

Vulnhuntr 🟢 — Zero-shot vulnerability discovery in Python repos via LLM call-chain analysis; credited with a 0-day RCE in Ragflow. (Protect AI) (★ 2,738 · updated 2025-02-06)
Related: IRIS
deepsec 🟢 — Agent-powered security harness for scanning large codebases with coding agents, resumable parallel runs, custom matchers, and optional revalidation. (Vercel Labs) (★ 7,670 · updated 2026-08-13)
Related: claude-code-security-review · sast-skills
Codex Security 🟠 — CLI and TypeScript SDK that use Codex Security to find, validate, and help fix vulnerabilities in a codebase, with scan comparison and containerized bulk-scan support. (OpenAI) — note: the CLI/SDK are open source, but scans require Codex Security access and, for best results, OpenAI Trusted Access. (★ 9,873 · updated 2026-08-16)
Related: deepsec · defending-code-reference-harness
open·kritt 🟢⚠️ — Self-hosted platform that orchestrates Codex or Claude Code across focused vulnerability-research workflows, then validates, de-duplicates, ranks, and reports resulting findings. (Kritt AI) — note: jobs run as root in disposable Docker containers with writable target copies and direct internet access; the stack has no application auth by default and sends scanned code to the configured model provider. Deploy only on a dedicated, access-controlled host and scan authorized targets. (★ 1,723 · updated 2026-08-12)
Related: deepsec · Visa Vulnerability Agentic Harness
Visa Vulnerability Agentic Harness 🟢 — Agentic SAST pipeline for autonomous vulnerability discovery, exploitability verification, SARIF/Markdown reporting, remediation, and validation using frontier AI models. (Visa) — note: Apache-2.0; authorized use only. The default scan profile can continue into remediation and edit target source files; use --stop-after s9 for detection-only runs. (★ 2,553 · updated 2026-08-04)
Related: deepsec · defending-code-reference-harness
defending-code-reference-harness 🟢 — Reference Claude Code skills and autonomous vulnerability-discovery pipeline for threat modeling, static scanning, triage, execution-verified C/C++ memory-bug discovery, reporting, and patch generation. (Anthropic) — note: official reference implementation, not maintained as a product; the autonomous pipeline executes target code and should be run only inside the documented gVisor sandbox. (★ 7,131 · updated 2026-08-06)
Related: deepsec · claude-code-security-review
rust-in-peace 🟢 — Rust-security fork of Anthropic's defending-code reference harness, adding a Rust profile for agentic review of unsafe/FFI memory bugs, panic-DoS, deserialization-trust issues, and Miri/ASan/panic/hang-verified findings. (Sergey Gordeychik) — note: very new Apache-2.0 fork; autonomous runs execute target code and should use the documented sandbox. (★ 14 · updated 2026-08-11)
Related: defending-code-reference-harness · deepsec
claude-code-security-review 🟠 — Official Claude-based semantic SAST GitHub Action that reviews PR diffs. (Anthropic) (★ 5,863 · updated 2026-02-11)
IRIS 🟢🔬 — Neurosymbolic SAST combining LLMs with CodeQL for Java vulnerability detection (MIT). (★ 413 · updated 2026-07-02)
sast-skills 🟢 — Agent skills that turn AI coding assistants into a multi-agent SAST scanner. (★ 1,276 · updated 2026-04-08)
Related: Fraim · llm-sast-scanner
llm-sast-scanner 🟢 — SAST skill for AI coding agents with structured source-to-sink analysis across 34 vulnerability classes. License: MIT stated in README. (★ 274 · updated 2026-04-07)
Related: sast-skills
sast-ai-workflow 🟢 — LangGraph workflow for reviewing static-analysis findings, reducing false positives, and producing vulnerability review output. (Red Hat Ecosystem AppEng) (★ 20 · updated 2026-06-29)
Related: seclab-taskflow-agent · Fraim
llm-security-scanner 🟢⚠️ — LLM-powered code scanner that opens GitHub issues for findings. (★ 22 · updated 2025-04-02)
Trail of Bits Skills 🟢⚠️ — Claude Code- and Codex-compatible security workflow skills for code review, differential review, false-positive analysis, supply-chain checks, GitHub Actions auditing, Semgrep rule generation, and vulnerability research. (Trail of Bits) — note: reusable agent workflow instructions rather than a standalone deterministic scanner; share-alike terms apply to adapted material. (★ 6,612 · updated 2026-08-14)
Related: sast-skills · Claude-BugHunter
OpenHack 🟢 — File-based source-guided white-box security-review workspace that orchestrates agents through reconnaissance, vulnerability hunting, validation, evidence capture, and reporting. (Hadrian Security) — note: requires an external coding harness/model and can consume substantial model tokens; OpenHack provides workflow state and review artifacts, not sandboxing or an execution-security boundary. Use only on authorized targets. (★ 730 · updated 2026-06-01)
Related: deepsec · rust-in-peace
Buttercup 🟢🔬⚠️ — Multi-component cyber reasoning system for finding, validating, and patching software vulnerabilities with coordinated agent workflows. (Trail of Bits) — note: AGPL-3.0 research/competition system rather than a lightweight scanner; deployment uses multiple services, Docker, and configured model providers. (★ 1,676 · updated 2026-08-10)
Related: OpenHack · Visa Vulnerability Agentic Harness

AI-Powered Threat Modeling

Architecture-level threat model generation and design-phase risk analysis driven by LLM reasoning.

tachi 🟢 — Threat modeling and AI-reasoning vulnerability detection harness for Claude Code that dispatches 14 specialized threat agents (6 STRIDE, 5 LLM, 3 agentic) against an architecture description in Mermaid, C4, PlantUML, ASCII, or free text, producing SARIF 2.1.0 for code scanning, MAESTRO seven-layer classification, attack trees, CVSS-aligned composite risk scores, compensating-controls analysis of the target codebase, and a PDF report. (David Matousek) — note: runs inside Claude Code; architecture descriptions are processed by the configured Claude model. (★ 89 · updated 2026-08-13)
Related: STRIDE GPT · defending-code-reference-harness
STRIDE GPT 🟢 — LLM-powered threat modeling tool that generates STRIDE threat models, attack trees, data flow diagrams, DREAD risk scores, mitigations, and Gherkin test cases from application descriptions, architecture diagrams, or codebases (agentic analysis mode), with OWASP LLM Top 10 and Agentic (ASI) coverage, MITRE ATT&CK/ATLAS mapping, Markdown/JSON/SARIF/HTML output, and broad LLM provider support via LiteLLM including local hosting. (Matthew Adams) (★ 1,100 · updated 2026-08-12)
Related: tachi

LLM-Driven Fuzzing

Two families: (a) LLMs generating harnesses/targets for traditional fuzzing, and (b) fuzzing the LLM itself.

Harness / target generation

oss-fuzz-gen 🟢 — LLM-driven fuzz-harness generation for OSS-Fuzz; reported 26 real vulnerabilities (incl. CVE-2024-9143 in OpenSSL). (Google) (★ 1,430 · updated 2026-03-02)
PromptFuzz 🟢🔬⚠️ — LLM-mutated prompts to generate fuzz drivers for C/C++ libraries (Rust). (★ 342 · updated 2026-05-15)
Fuzz4All 🟢🔬 — "Universal" LLM-based fuzzer across compilers/languages (ICSE 2024). (★ 336 · updated 2025-08-11)
ChatAFL 🟢🔬 — LLM-guided protocol fuzzing extending AFLNet (NDSS'24). (★ 392 · updated 2025-06-20)
TitanFuzz 🟢🔬⚠️ — First LLM-based fuzzer for PyTorch/TensorFlow (ISSTA'23). (★ 94 · updated 2023-09-10)

Fuzzing the LLM

LLMFuzzer 🟢🔬 — First open-source fuzzing framework for LLM API integrations. — note: historical research reference; maintenance appears low compared with current LLM security scanners. (★ 377 · updated 2024-02-12)
ps-fuzz 🟠 — System-prompt hardening fuzzer; 16 attacks × 16 providers. (Prompt Security) (★ 703 · updated 2026-02-16)
FuzzyAI 🟠 — Automated LLM fuzzer for jailbreaks/prompt injection. (CyberArk) (★ 1,561 · updated 2026-02-06)
spikee 🟢 — Prompt-injection evaluation and exploitation kit with dataset generation, Burp integration, and pluggable judges. (ReversecLabs / WithSecure) (★ 231 · updated 2026-07-13)
Related: promptmap
promptmap 🟢⚠️ — Prompt-injection scanner for custom LLM applications in white-box and black-box modes; GPL-3.0 licensed. (★ 1,250 · updated 2025-12-01)
Related: spikee
ai-prompt-fuzzer 🟢 — Burp Suite extension fuzzing GenAI/LLM prompts. (PortSwigger) (★ 36 · updated 2025-09-04)

Threat Intelligence

AI/LLM tooling for CTI gathering, IOC/TTP extraction, and analysis.

trs 🟢 — LLM + ChromaDB tool to summarize threat reports and extract MITRE TTPs and IOCs. (★ 10 · updated 2023-11-15)
TI-Mindmap-GPT 🟢 — Streamlit app: AI summaries, mindmaps, IOC/TTP extraction, and ATT&CK Navigator layers. (★ 111 · updated 2026-02-16)
aiocrioc 🟢 — LLM + OCR IOC extraction (pulls IOCs from images/PDFs). (★ 38 · updated 2024-12-04)
ThreatIngestor 🟢 — Extracts/aggregates IOCs from feeds; integrates with MISP/ThreatKB (pairs well with LLM post-processing). (★ 922 · updated 2026-05-26)
IATelligence 🟢 — Explains imported Windows APIs in PE files via GPT and maps to MITRE ATT&CK. (★ 384 · updated 2022-12-09)
Related: MCP_Security
MCP_Security 🟢⚠️ — MCP server (ORKL) for querying the ORKL threat-intel API. (★ 51 · updated 2025-01-22)
Related: IATelligence
threat-intelligence-cti-analysis 🟢 — NLP/LLM pipeline for IOC extraction, MITRE ATT&CK mapping, and knowledge-graph generation from unstructured CTI. (★ 4 · updated 2025-11-03)
Related: soctalk
CTINexus 🟢🔬 — LLM-assisted framework for data-efficient extraction of cyber-threat intelligence and construction of structured cybersecurity knowledge graphs from unstructured reports. — note: ships tests, releases, Docker configuration, and a Python package; extraction workflows require a configured supported LLM provider. (★ 85 · updated 2026-02-25)
Related: threat-intelligence-cti-analysis · CTIBench
CTIBench 🔬⚠️ — NeurIPS 2024 Spotlight benchmark with 4,610 examples across CTI knowledge, CWE root-cause mapping, CVSS prediction, ATT&CK technique extraction, and threat-actor attribution. — note: non-commercial research benchmark; the repository publishes data, evaluation notebooks, model outputs, and raw logs rather than a production CTI service. (★ 92 · updated 2026-05-07)
Related: CTINexus · CTI-BERT
CTI-BERT 🟢🔬 — BERT model pretrained from scratch on a large cybersecurity text corpus for downstream CTI extraction, classification, and question-answering tasks. (IBM Research) license: Apache-2.0 · access: open · artifacts: PyTorch.

Log Analysis / SIEM / SOC Triage

AI agents for SOC alert triage, investigation, and incident response.

AI-SOC-Agent 🟢 — Black Hat 2025 MCP server exposing security-investigation tools (ELK, IRIS). (★ 47 · updated 2025-12-28)
soctalk 🟢 — LangGraph SOC automation agent with MCP integrations for Wazuh, Cortex, TheHive, and MISP plus mock-agent test lab. (★ 78 · updated 2026-08-12)
Related: SigmaOptimizer
Vigil SOC 🟢 — Open-source AI SOC with readable Python agents, Markdown playbooks, and MCP integrations for triage, investigation, hunting, response, reporting, and forensics. (Vigil SOC) (★ 246 · updated 2026-08-15)
Related: soctalk
agentic-soc-platform 🟢 — Agentic SOC platform (LangGraph/Dify) with local-LLM support. (★ 1,144 · updated 2026-08-05)
SigmAIQ 🟢⚠️ — pySigma wrapper and LangChain toolkit for automatic Sigma rule creation and translation; LGPL-2.1 licensed. (AttackIQ) (★ 97 · updated 2025-11-03)
Related: SigmaOptimizer
RulePilot 🟢🔬 — LLM-powered security-rule generation agent for Splunk, Microsoft Sentinel, and Elastic, with field detection from log samples, multi-stage refinement, and cross-platform rule conversion. — note: MIT-licensed ICSE 2026 research prototype; requires an OpenAI API key. (★ 15 · updated 2025-10-20)
Related: SigmAIQ · SigmaOptimizer
SOCGPT 🟢 — LLM log summarization, severity triage, MITRE mapping, and Q&A. (★ 7 · updated 2025-06-11)
AttackGen 🟢 — LLM-driven incident-response scenario generator using MITRE ATT&CK + ATLAS. (★ 1,234 · updated 2026-08-13)
Google Security Operations and Threat Intelligence MCP Server 🟢 — MCP servers and packages that let MCP clients access Google Security Operations, SOAR, Google Threat Intelligence, and Security Command Center for investigation, hunting, and security automation workflows. (Google Cloud) — note: integration layer rather than an MCP-defense tool; requires Google credentials and access to the connected security products/services. (★ 517 · updated 2026-04-29)
Related: MCP_Security · Vigil SOC
ExCyTIn-Bench (SecRL) 🟢🔬 — ICML 2026 benchmark for evaluating LLM agents on cyber-threat investigation and threat hunting through security question-answering over eight anonymized incident databases. (Microsoft) — note: evaluation requires model-provider credentials, Dockerized MySQL incident databases, and roughly 10 GB for the standard eight-container setup (up to 33 GB for the combined database). (★ 142 · updated 2026-08-03)
Related: CTIBench · Google Security Operations MCP

Reverse Engineering

LLM-assisted binary analysis and traffic inspection.

Gepetto 🟢 — IDA Pro plugin: GPT adds comments and meaningful variable names. (★ 3,457 · updated 2026-08-15)
ida-pro-mcp 🟢 — MCP bridge for IDA Pro exposing decompile, disassemble, xref, rename, and debugging workflows to LLM clients. (★ 11,375 · updated 2026-08-09)
GhidraMCP 🟢 — MCP server exposing Ghidra reverse-engineering ops to any MCP-capable LLM. (★ 9,800 · updated 2025-06-23)
Related: GhidrOllama · OGhidra
ReVa 🟢 — Ghidra-focused reverse-engineering assistant with MCP support, Claude Skills integration, and long-form analysis workflows. (★ 803 · updated 2026-07-28)
Related: GhidraMCP · GhidrAssistMCP
GhidrAssistMCP 🟢 — Native Ghidra MCP extension with broad tool coverage, headless support, and security-sensitive tool gating. (★ 719 · updated 2026-08-02)
Related: ReVa · ghidra-mcp
ghidra-mcp 🟢 — Ghidra MCP server with large tool coverage, GUI plugin, headless server, and lazy tool loading. (★ 3,322 · updated 2026-08-12)
Related: GhidrAssistMCP
GhidrOllama 🟢⚠️ — Ghidra script using the Ollama API for function analysis/renaming. (★ 154 · updated 2024-11-29)
Related: OGhidra · GhidraMCP
GhidraGPT 🟢 — Ghidra plugin that integrates LLMs for automated code refactoring and analysis. (★ 656 · updated 2026-07-22)
Related: GhidraMCP · ReVa
LLM4Decompile 🟢🔬⚠️ — Research project for binary-to-C decompilation with LLMs; code is MIT, but model weights use a more restrictive license. (★ 6,963 · updated 2026-02-12)
x64dbg_mcp 🟢 — MCP server exposing x64dbg debugging and reverse-engineering operations to AI clients. (★ 104 · updated 2026-06-08)
binaryninja-mcp 🟢 — MCP server for Binary Ninja-assisted reverse engineering. (★ 47 · updated 2025-05-13)
OGhidra 🟢 — Natural-language Ghidra analysis via Ollama. (Lawrence Livermore National Lab) (★ 409 · updated 2026-08-14)
Related: GhidrOllama · GhidraMCP
ghidra_tools (G-3PO) 🟢 — Ghidra plugin for AI-assisted decompiled-code analysis. (Tenable) (★ 312 · updated 2023-05-10)
gpt-wpre 🔬 — Whole-program reverse engineering with GPT-3. (★ 406 · updated 2022-12-31)
burpgpt 🟢 — Burp Suite extension integrating GPT for passive scanning. (★ 2,347 · updated 2024-06-09)
Related: Burp-extension-for-GPT
Burp-extension-for-GPT 🟢 — Burp extension to analyze HTTP traffic with GPT. (Tenable) (★ 116 · updated 2023-05-01)
Related: burpgpt
REA 🟢 — Local CLI and MCP toolkit for agent-assisted reverse engineering of native binaries, managed PE/CLI files, JavaScript/Electron apps, and browser runtimes, using Hopper or an operator-provided Ghidra installation. — note: deep native analysis uses separately licensed Hopper or operator-installed Ghidra. Setup can modify agent MCP registrations after interactive approval, and dynamic providers run with the current user's permissions; analyze only authorized artifacts. (★ 332 · updated 2026-08-14)
Related: GhidraMCP · ReVa

LLM Red-Teaming & Guardrails

Tools for attacking and defending LLM applications themselves.

Scanners, Evals & Guardrails

NuGuard 🟢 — Generates an AI-SBOM, statically analyzes agentic applications, red-teams live targets for prompt injection/tool misuse/data exfiltration, and validates behavioral policy compliance with SARIF, JSON, and Markdown reports. (NuGuard AI) — note: beta project; live red-team scans actively probe the target and require authorization. LLM-assisted features need provider credentials, and the optional NuGuard.ai hosted offering adds commercial features. (★ 23 · updated 2026-08-14)
Related: garak · Medusa
garak 🟢 — The LLM vulnerability scanner — probes for prompt injection, jailbreaks, data leakage, and more. (NVIDIA) (★ 8,824 · updated 2026-08-14)
Related: PyRIT · promptfoo
PyRIT 🟢 — Python Risk Identification Tool; battle-tested across 100+ GenAI red-team operations. (Microsoft) (★ 4,310 · updated 2026-08-14)
promptfoo 🟢 — LLM eval + red-teaming/pentesting CLI with 50+ attack plugins (MIT). Note: OpenAI announced an acquisition agreement in March 2026; remains MIT-licensed — track governance. (★ 24,270 · updated 2026-08-15)
Augustus 🟢 — Single-binary LLM security testing framework for prompt injection, jailbreaks, and adversarial attacks across many providers. (Praetorian) (★ 278 · updated 2026-08-13)
Related: garak · PyRIT
agentic_security 🟢 — Agentic LLM vulnerability scanner and AI red-team kit for jailbreaks, prompt injection, fuzzing, and API stress testing. (★ 1,966 · updated 2026-07-31)
Related: garak · spikee
HackAgent 🟢 — Python SDK and CLI for red-teaming AI agents with research-backed attacks such as AdvPrefix, AutoDAN-Turbo, PAIR, TAP, FlipAttack, BoN, and static templates across agent frameworks. — note: works locally without an API key; optional cloud reporting is available. (★ 358 · updated 2026-08-15)
Related: PyRIT · garak · agentic_security
wallbreaker 🟢🔬⚠️ — Claude-Code-style terminal and red-team harness for authorized LLM safety testing, with HarmBench, PAIR/TAP, Crescendo, GCG-style workflows, Parseltongue transforms, MCP tooling, LLM judges, and reproducible run artifacts. — note: offensive jailbreak toolkit for authorized testing only; AGPL-3.0 licensed and NOTICE flags external jailbreak corpora with their own or missing upstream licenses. (★ 1,173 · updated 2026-08-11)
Related: HarmBench · PyRIT · garak
HiveTrace Red 🟢 — Early-stage LLM red-teaming framework with 80+ attack templates, async evaluation pipelines, WildGuard evaluators, multi-provider support, and HTML reporting. — note: young project with limited independent adoption signal. (★ 29 · updated 2026-08-13)
Related: garak · PyRIT · promptfoo
DeepTeam 🟢 — Open-source framework for red-teaming LLMs and LLM systems across jailbreaks, prompt injection, data leakage, and safety risks. (★ 2,452 · updated 2026-08-12)
Moonshot 🟢 — Modular tool for benchmarking, red-teaming, and evaluating LLM applications with custom connectors and recipes. (AI Verify Foundation) (★ 347 · updated 2026-02-05)
Guardrails AI 🟢 — Python framework for adding input/output guards, validators, structured-output controls, and Guardrails Hub checks to LLM applications. (Guardrails AI) (★ 7,289 · updated 2026-08-14)
Related: NeMo Guardrails · LLM Guard
Giskard 🟢 — Open-source evaluation, testing, and red-teaming framework for LLM agents, including agent vulnerability scanning and RAG evaluation workflows. (Giskard AI) (★ 5,753 · updated 2026-08-14)
Related: Moonshot · promptfoo
LangKit 🟢 — LLM monitoring toolkit extracting safety/security signals such as jailbreak similarity, prompt-injection similarity, hallucination checks, PII patterns, toxicity, and refusal metrics. (WhyLabs) (★ 994 · updated 2024-11-22)
LLM Guard 🟢 — Suite of input/output scanners (PII, prompt injection, etc.). (Protect AI) — note: archived by the maintainer; retained as a historical reference for local input/output guardrails. (★ 3,201 · updated 2026-07-08)
Related: Rebuff
Rebuff 🟢 — Archived prompt-injection detector (heuristics + LLM + vector DB + canary tokens). (Protect AI) — note: archived by the maintainer; retained as a historical prompt-injection defense reference. (★ 1,520 · updated 2024-01-25)
Related: LLM Guard
NeMo Guardrails 🟢 — Programmable guardrails (input/output/dialog/retrieval rails) for LLM apps. (NVIDIA) (★ 6,959 · updated 2026-08-13)
PurpleLlama 🟢 — Llama Guard classifiers, CodeShield, and CyberSecEval. (Meta) (★ 4,352 · updated 2026-08-14)
LLAMATOR 🟢⚠️ — Red-teaming framework for chatbots and GenAI systems; CC BY-NC-SA 4.0 licensed. (★ 215 · updated 2026-01-15)
Vigil 🟢🔬 — Library/REST API to scan prompts and responses for prompt injection. (★ 495 · updated 2024-01-31)
Counterfit 🟢 — ML/AI penetration-testing automation tool. (Microsoft) (★ 934 · updated 2025-07-18)
AI-Red-Teaming-Playground-Labs 🟢 — CTFd-based AI red-team training challenges. (Microsoft) (★ 2,045 · updated 2025-10-07)
EasyJailbreak 🟢🔬 — Framework for building and testing adversarial jailbreak prompts. (★ 886 · updated 2026-03-30)
TextAttack 🟢🔬 — Python framework for adversarial attacks, data augmentation, and training for NLP models; useful for robustness testing beyond chat-only LLM scanners. (★ 3,467 · updated 2026-08-15)
GPTFuzz 🟢🔬 — Research framework for red-teaming LLMs with auto-generated jailbreak prompts. (★ 604 · updated 2026-02-27)
HarmBench 🟢🔬 — ICML 2024 standardized evaluation framework for automated red-teaming and robust-refusal benchmarking. (Center for AI Safety) (★ 1,029 · updated 2024-08-05)
Related: JailbreakBench
llm-attacks (GCG) 🟢🔬 — Canonical Greedy Coordinate Gradient adversarial-suffix attack implementation for transferable attacks on aligned language models. (★ 4,761 · updated 2024-08-02)
Related: nanoGCG
nanoGCG 🟢 — Fast, lightweight PyTorch implementation of the GCG adversarial-suffix algorithm. (★ 346 · updated 2025-05-13)
Related: llm-attacks (GCG)
JailbreakBench 🟢🔬 — NeurIPS 2024 open robustness benchmark and leaderboard for generating and defending against LLM jailbreaks. (★ 654 · updated 2025-03-31)
Open-Prompt-Injection 🟢🔬 — Open-source toolkit and benchmark for implementing and evaluating prompt-injection attacks, defenses, and LLM-integrated applications. (★ 478 · updated 2025-10-29)
PINT Benchmark 🟢🔬 — Prompt-injection test benchmark for evaluating detectors and guardrails across multilingual prompt injection, jailbreak, benign, and hard-negative inputs. (Lakera) — note: archived benchmark retained as a historical research reference; use newer maintained corpora for current detector comparisons. (★ 198 · updated 2026-04-02)
Related: Open-Prompt-Injection · Prompt Guard 86M
PIArena 🟢🔬 — ACL 2026 toolbox and benchmark for prompt-injection attacks and defenses, with ready-to-use attacks/defenses, evaluation pipelines, agent benchmarks, a Hugging Face dataset, and leaderboard. (★ 46 · updated 2026-04-20)
Related: PINT Benchmark · Open-Prompt-Injection
Whistleblower 🟢⚠️ — Offensive testing tool for inferring system prompts and discovering capabilities of LLM applications exposed through APIs. (Repello AI) — note: no LICENSE file found. (★ 177 · updated 2025-10-27)
LLMmap 🟢🔬 — Minimal-query fingerprinting tool for identifying LLMs from behavioral traces, with a pretrained open-set inference model. (★ 423 · updated 2025-07-24)
llm-security 🔬 — Original PoC for indirect prompt-injection attacks. (★ 2,127 · updated 2025-07-17)
JailbreakLLMs 🔬⚠️ — Research dataset of 6,387 ChatGPT prompts, including in-the-wild jailbreak prompts from Reddit, Discord, websites, and open datasets. (★ 23 · updated 2024-02-21)
Do-Not-Answer 🟢🔬 — Dataset for evaluating LLM safeguards on unsafe or policy-sensitive prompts. (★ 341 · updated 2024-06-07)
prompt-injection-defenses 🟢⚠️ — Curated catalog of practical defenses against prompt injection. (★ 724 · updated 2025-02-22)
little-canary 🟢🔬 — Prompt-injection preflight risk sensor that routes untrusted input through a powerless sacrificial model, then reads response residue to return pass/flag/block before the primary agent acts. — note: experimental sensing layer, not a security guarantee or runtime containment. A failed canary can return availability-first routing with explicit degraded coverage; remote/OpenAI-compatible canary or judge endpoints receive raw input. (★ 27 · updated 2026-08-14)
Related: Rebuff · prompt-injection-defenses
Kiji Privacy Proxy 🟢 — Local privacy proxy for OpenAI-compatible AI API traffic that detects and masks 26 PII types with an ONNX model before forwarding requests, then restores mappings in responses. (Dataiku 575 Lab) — note: protects configured proxied traffic, not every path by which an application or agent can disclose data; operators retain responsibility for proxy routing and local mapping storage. (★ 421 · updated 2026-07-27)
Related: LLM Guard · Kiji PII model
Anamorpher 🟢🔬 — Research tool with a frontend and Python API for crafting and visualizing image-scaling attacks that reveal hidden prompt injections to multimodal AI systems after downscaling. (Trail of Bits) — note: active beta research tool for authorized testing; generated payloads are sensitive to the target's image-resampling implementation and preprocessing pipeline. (★ 1,076 · updated 2026-02-19)
Sources: Trail of Bits research announcement
Related: PromptFuzz · promptfoo
Prompt SIREN 🟢🔬 — Research workbench for developing and evaluating prompt-injection attacks and defenses with state-machine agent control, AgentDojo/SWE-bench integrations, configuration sweeps, and reproducible result aggregation. (Meta AI) — note: experiment harness; running target evaluations requires model-provider credentials and may need Docker or browser extras depending on the selected environment. (★ 61 · updated 2026-05-18)
Related: AgentDojo · PyRIT

Prompt-Injection Classifier Models

Wolf Defender Prompt Injection 🟢 — Hugging Face text-classification model for prompt-injection detection in agents, chatbots, and CI workflows. (Patronus Studio / Casdo Labs) license: Apache-2.0 · access: open · artifacts: Safetensors, ONNX.
DeBERTa v3 Prompt Injection v2 🟢 — Apache-licensed prompt-injection classifier usable via Transformers pipelines and ONNX. (Protect AI) license: Apache-2.0 · access: open · artifacts: Safetensors, ONNX.
PromptGuard 🟢⚠️ — ModernBERT-based prompt-injection and jailbreak classifier. (CodeIntegrity AI) license: Apache-2.0 · access: gated auto · artifacts: Safetensors.
Prompt Guard 86M 🟠⚠️ — Meta prompt-injection and jailbreak classifier from the Llama Guard family. (Meta) license: Llama 3.1 · access: gated manual · artifacts: Safetensors.
prompt-injection-sentinel 🔬⚠️ — ModernBERT-large classifier for prompt-injection and jailbreak detection. (Qualifire) license: other · access: gated auto · artifacts: Safetensors.

Specialty Security LLMs

SecGPT 🟢 — Open cybersecurity-tuned LLM family for vulnerability analysis, log/traffic investigation, anomaly detection, attack/defense reasoning, command analysis, and security Q&A. (Clouditera) (★ 3,099 · updated 2025-06-25)
Related: SecGPT model
Antares-1B 🟢⚠️ — Open-weight security SLM specialized for agentic vulnerability localization: it explores repository snapshots through a terminal-style loop and ranks likely vulnerable files for analyst review. (Cisco Foundation AI) license: Apache-2.0 · access: gated manual · artifacts: Safetensors + CLI ZIP. — note: HF access is gated/manual; related smaller model: Antares-350M, benchmark: VLoc Bench.
Trendyol Cybersecurity LLM v2 70B 🟢 — Defense-focused cybersecurity LLM based on Llama-3.3-70B, trained on an alignment-safe security instruction dataset for SOC, cloud, AppSec, detection, and vulnerability-management workflows. (Trendyol Group Security Team) license: Apache-2.0 · access: open · artifacts: GGUF.
WhiteRabbitNeo 2.5 Qwen Coder 7B 🟢⚠️ — Cybersecurity-oriented Qwen2.5-Coder fine-tune positioned for offensive and defensive security assistance. (WhiteRabbitNeo) license: Apache-2.0 + WhiteRabbitNeo restrictions · access: open · artifacts: Safetensors.
Lily-Cybersecurity-7B-v0.2 🟢 — Mistral-7B-Instruct fine-tune for cybersecurity assistance, trained on hand-crafted security and hacking-related instruction pairs. (Segolily Labs) license: Apache-2.0 · access: open · artifacts: Safetensors.
RavenX CyberAgent 35B Q4_K_M 🟢⚠️ — GGUF security-specialized text-generation model positioned for pentest, bug-bounty, tool-calling, MCP, CVSS/CWE, and MITRE ATT&CK workflows. (RavenX LLC / DeadByDawn101) license: Apache-2.0 · access: open · artifacts: GGUF. — note: built from an abliterated base model and marketed for autonomous security assessment; use only in authorized, sandboxed agent harnesses with tool-call validation.

LLM Honeypots & Deception

Honeypots and deception that use LLMs to simulate convincing systems.

Beelzebub 🟢⚠️ — Low-code honeypot using LLMs to simulate SSH/HTTP/MCP services (Go). — note: GPL-3.0 licensed. (★ 2,149 · updated 2026-08-11)
DECEIVE 🟢🔬 — Proof-of-concept LLM-powered SSH honeypot that evaluates sessions as benign, suspicious, or malicious. (Splunk) (★ 288 · updated 2026-05-13)
TRAP 🟢🔬 — Research code for Targeted Random Adversarial Prompt honeypots that identify black-box LLM usage through model-specific prompt suffixes (ACL 2024 Findings). (★ 15 · updated 2024-11-20)
shelLM 🟢🔬 — LLM-powered SSH honeypot (paper "LLM in the Shell"). (★ 64 · updated 2026-06-25)
Related: VelLMes
VelLMes 🟢🔬 — Multi-protocol LLM honeypot framework (successor to shelLM). (★ 78 · updated 2025-02-18)
Related: shelLM
llm-honeypot 🔬⚠️ — Cowrie SSH honeypot extended with prompt-injection traps to detect LLM hacker agents. (Palisade Research) (★ 60 · updated 2026-01-23)

CTF / Exploit / Bug-Bounty Agents & Benchmarks

Offensive agents and the benchmarks used to evaluate them.

SWE-agent (EnIGMA) 🟢🔬 — EnIGMA offensive-CTF mode; SOTA on NYU CTF, InterCode-CTF, and Cybench (v0.7 branch). (★ 20,063 · updated 2026-07-16)
Related: Cybench · NYU CTF Bench · InterCode
Cybench 🔬 — 40 professional CTF tasks across 4 competitions; widely used by AI safety institutes. (★ 311 · updated 2026-07-09)
NYU CTF Bench 🔬 — Dockerized CSAW CTF challenges for LLM-agent evaluation. (★ 169 · updated 2025-09-22)
CTFTiny 🔬⚠️ — Lightweight CTF benchmark from the NYU LLM CTF group; GPL-2.0 licensed. (★ 18 · updated 2026-03-10)
Related: NYU CTF Bench
InterCode 🔬 — Interactive-coding benchmark incl. InterCode-CTF. (★ 254 · updated 2024-05-05)
inspect_evals 🟢🔬 — Maintained Inspect AI evaluation suite containing multiple cyber benchmarks and tasks. (UK AI Security Institute) (★ 627 · updated 2026-08-14)
BountyBench 🔬 — 25 real systems / 40 bug bounties for Detect-Exploit-Patch evaluation. (★ 102 · updated 2025-06-22)
Cyber-Zero 🔬 — Trains cybersecurity agents without runtime; ships an EnIGMA+ scaffold. (Amazon Science) — note: archived research artifact retained as a historical reference for training cybersecurity agents without a live runtime. (★ 101 · updated 2025-09-02)
Sources: SWE-agent
Related: SWE-agent
ExploitBench 🔬 — Measures AI-agent progress on V8/Chromium exploit ladders. (★ 344 · updated 2026-07-04)
AI Goat 🟢🔬⚠️ — Vulnerable-by-design local LLM CTF for learning prompt injection, insecure output handling, data leakage, excessive agency, and related LLM app risks. — note: GPL-2.0 licensed. (★ 355 · updated 2024-08-22)
AIGoat 🟢🔬⚠️ — Local-first vulnerable LLM security playground with guided OWASP LLM Top 10 attack labs, CTF challenges, progressive defenses, and an Ollama-backed AI shopping-assistant target. — note: platform code is Apache-2.0, but training/challenge content is CC BY-NC-SA-4.0 and requires permission for commercial workshops. (★ 75 · updated 2026-04-24)
LLMVault 🟢🔬 — Intentionally vulnerable LLM security-training platform with OWASP LLM Top 10 labs, CTF-style challenges, hints, scoring, and mitigation guidance. — note: deliberately vulnerable training target; run only in an isolated, authorized environment. Live Mode optionally requires Ollama or provider credentials. (★ 295 · updated 2026-08-10)
Damn Vulnerable LLM Agent 🟢🔬 — Deliberately vulnerable LangChain ReAct agent for practicing prompt-injection and Thought/Action/Observation injection attacks. (ReversecLabs / WithSecure) (★ 504 · updated 2025-06-25)
Related: spikee
claude-bug-bounty 🟢 — Claude Code plugin orchestrating recon → vuln classes → reporting. (★ 4,227 · updated 2026-08-10)
Bug-Bounty-Agents 🟢 — 43 AI agent personas for Claude Code / Copilot / Cursor across the bug-bounty lifecycle. (★ 368 · updated 2026-04-30)
ai-exploits 🟢 — Real-world AI/ML exploits (Metasploit modules + Nuclei templates) for MLflow, Ray, H2O. (Protect AI) (★ 1,745 · updated 2024-10-23)
CyberGym 🟢🔬 — Large-scale evaluation framework for AI-agent vulnerability analysis on real-world tasks, with locally deployed challenge infrastructure, task generation, and proof-of-concept validation. (UC Berkeley / Sunblaze) — note: deploy only in an isolated local environment; the full benchmark runtime is extremely large (documentation cites up to ~10 TB) and must not be exposed to the public internet. (★ 727 · updated 2026-08-04)
Related: Cybench · CVE-Bench
CVE-Bench 🟢🔬 — ICML 2025 benchmark that evaluates AI agents against reproducible Docker environments for real critical-severity web-application CVEs and exploit objectives. — note: runs intentionally vulnerable services and should be used only in isolated environments; arm64 support is experimental. (★ 270 · updated 2026-01-14)
Related: CyberGym · BountyBench

Cloud / IaC / DFIR / OSINT / Phishing

AI tooling for cloud/IaC security, digital forensics, OSINT, and phishing detection.

EscalateGPT 🟢 — GPT-based discovery of privilege-escalation paths in AWS IAM policies. (Tenable) (★ 122 · updated 2024-01-17)
Cynative 🟢 — Local AI security research agent for cloud, code, and runtime environments across GitHub, GitLab, AWS, GCP, Azure, and Kubernetes, with read-only action gates, sandboxed code execution, evidence-backed verification, and audit logs. (★ 190 · updated 2026-08-14)
Related: Fraim · EscalateGPT
Julius 🟢 — Local Go tool that fingerprints LLM service infrastructure on authorized endpoints, identifies 60+ serving, gateway, MCP, and RAG platforms, and can enumerate exposed models. (Praetorian) — note: use only against endpoints you own or are authorized to assess. (★ 208 · updated 2026-08-06)
Related: AI-Infra-Guard · ai_osint
MemoryInvestigator 🔬 — Volatility 3 + LLM + RAG for memory-forensic triage. (★ 13 · updated 2025-09-16)
Related: Volatility-MCP-Server
Volatility-MCP-Server 🟢 — MCP exposing Volatility 3 plugins for natural-language memory forensics. (★ 39 · updated 2025-07-07)
Related: MemoryInvestigator
llm_osint 🟢🔬 — Proof-of-concept LLM OSINT framework using knowledge and web agents for internet research workflows. (★ 316 · updated 2024-11-02)
ai_osint 🟢 — Curated AI-OSINT dorks, queries, and techniques for discovering exposed LLM and AI infrastructure. (★ 154 · updated 2026-06-19)
PhishLLM 🔬⚠️ — Reference-less phishing detection via LLM brand recognition (USENIX'24). (★ 39 · updated 2026-06-04)
Related: PhishVLM
mcp-dnstwist 🟢 — MCP server for dnstwist DNS fuzzing to support typosquatting, phishing, and lookalike-domain analysis. (★ 51 · updated 2025-03-03)
osintgpt 🟢⚠️ — OpenAI embeddings + Qdrant over OSINT corpora. (★ 524 · updated 2023-12-11)

Related Awesome Lists

awesome-llm-cybersecurity-tools — Tenable's list (archived but a strong reference). (★ 488 · updated 2024-04-08)
Awesome-LLM4Cybersecurity — 600+ papers on LLMs for cybersecurity. (★ 1,746 · updated 2026-07-08)
awesome-ai-cybersecurity — Broad AI-for-security collection. (★ 151 · updated 2026-08-13)
awesome-genai-cyberhub — GenAI-driven cybersecurity resources. (★ 54 · updated 2026-08-07)
awesome-ai-security — For pentesters, bug hunters, and researchers. (★ 39 · updated 2026-08-10)
awesome-ai-security — AI security resources. (★ 1,386 · updated 2026-08-16)
Awesome-AI-Security — AI security resources. (★ 853 · updated 2026-07-18)
Awesome-AI-For-Security — AI-for-security tools, papers, and datasets. (★ 146 · updated 2026-08-13)
awesome-cybersecurity-agentic-ai — Agentic-AI cybersecurity tools and security MCP servers. (★ 536 · updated 2026-06-28)
awesome-ai-agents-security — Focused map of AI-agent security resources across runtime protection, red-teaming scanners, static analysis, sandboxing, guardrails, benchmarks, and identity. (★ 63 · updated 2026-06-12)
Awesome-Offensive-AI-Agentic-Landscape — Offensive AI-agent landscape covering open-source pentest/red-team agents, offensive/security-specialized models, papers, benchmarks, and commercial tools. (★ 211 · updated 2026-07-20)
awesome-ai-agent-attacks — Sourced timeline of real AI-agent security incidents, breaches, vulnerabilities, and attack techniques. (★ 65 · updated 2026-08-11)
AI Security Repository Radar — Daily-updated AI/LLM/MCP/RAG security repository radar with category, license, stars, and quality/relevance metadata. (★ 5 · updated 2026-08-16)
awesome-MLSecOps — Curated MLSecOps resources spanning adversarial ML, LLM security, AI red teaming, model scanning, supply-chain protection, and MLOps pipeline security. (★ 450 · updated 2026-08-15)
awesome-ai-guardrails — Catalog of AI guardrail models, tools, organizations, datasets, and papers, with useful Hugging Face model coverage. (★ 64 · updated 2026-07-30)
open-source-llm-scanners — Open-source LLM scanners and testing tools. (★ 109 · updated 2026-02-05)
awesome-mcp-security — MCP security resources, tools, writeups, and server/client risk references. (★ 728 · updated 2026-03-03)
awesome-ml-security — Trail of Bits' curated machine-learning security resources. (★ 170 · updated 2026-02-06)
awesome-ml-privacy-attacks — Machine-learning privacy-attack papers and resources. (★ 640 · updated 2024-03-18)
awesome-ml-for-cybersecurity — Large classic list of machine-learning-for-cybersecurity resources (stale-ish but still useful). (★ 9,285 · updated 2024-04-11)
Awesome-AI4DevSecOps — Taxonomy of AI-driven security solutions for DevSecOps. (★ 19 · updated 2025-07-02)
awesome-llm-security — Securing LLMs. (★ 1,683 · updated 2025-08-20)
awesome-gpt-security — GPT/LLM security tools and cases. (★ 668 · updated 2026-07-24)
awesome-threat-intelligence — Classic CTI list (pairs with the AI-CTI section). (★ 10,538 · updated 2026-05-31)
awesome-threat-modelling — General-purpose threat modeling list — methodologies and non-AI tools (Threat Dragon, pytm, Threagile); dormant since 2023 but a solid reference. (★ 1,793 · updated 2023-07-15)
Awesome-LLMs-for-Vulnerability-Detection — Focused, continuously updated index of LLM-based software-vulnerability detection research across function, repository, agentic, and smart-contract analysis, including datasets, benchmarks, and surveys. (★ 1,237 · updated 2026-08-16)

Contributing

Contributions are welcome! This README is generated from structured data.

Edit data/sections.json (validated by data/schema.json).
Use structured fields such as status, flags, and license; do not paste rendered emoji tags into the data.
Regenerate and check the README:

python3 scripts/update_github_metrics.py
python3 gen_readme.py
python3 gen_readme.py --check

Example entry:

{
  &quot;name&quot;: &quot;ExampleTool&quot;,
  &quot;repo&quot;: &quot;OWNER/REPO&quot;,
  &quot;status&quot;: [&quot;open_source&quot;],
  &quot;license&quot;: &quot;MIT&quot;,
  &quot;flags&quot;: [&quot;early_stage&quot;],
  &quot;desc&quot;: &quot;One factual sentence about what the tool does.&quot;,
  &quot;related&quot;: [
    {&quot;label&quot;: &quot;Sibling tool&quot;, &quot;url&quot;: &quot;https://github.com/OWNER/SIBLING&quot;}
  ]
}

Status values: open_source, research, commercial_open. Common flags: license_caveat, early_stage, archived, heavy_runtime, requires_api_key, authorized_testing_only, commercial_features, no_license, noncommercial, copyleft, abliterated_or_uncensored.

Guidelines: link the canonical upstream repo (not a fork); verify the URL resolves; tag the correct type and add a caveat flag/note for non-permissive, non-commercial, unclear, missing, or restrictive licenses; prefer real, installable projects over blog-only references.

For Hugging Face model entries, include the model id, license, access status (open/gated), and artifact formats (for example Safetensors or ONNX).

Contact

Maintained by Sergey Gordeychik — [email protected] · blog · @scadasl.

License

To the extent possible under law, the contributors have waived all copyright and related rights to this list (CC0-1.0). Linked projects retain their own licenses — check each before use.

awesome-ai-security-tools

项目介绍