scadastrangelove/awesome-ai-security-tools
Public
Star 历史趋势
数据来源: GitHub API · 生成自 Stargazers.cn
README.md

Awesome AI Security Tools Awesome

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.

License: CC0-1.0 PRs Welcome

Type legend: 🟢 public source / open-source · 🔬 research (paper / benchmark / dataset / framework) · 🟠 commercial with open components · ⚠️ restrictive, non-commercial, or unclear/no license — check before use.

GitHub-hosted entries show static ★ stars and last-commit snapshots; refresh them with python3 scripts/update_github_metrics.py before release. Latest snapshot: 2026-07-26. Hugging Face model entries show license, access, and artifact metadata. Ordering within a section favors flagship and actively maintained projects.

Contents

Autotriage of Security Findings

AI/LLM tools that triage, deduplicate, prioritize, or validate the output of scanners and finding sources.

  • nuclei-autotriage 🟢⚠️ — Two-stage LLM triage (falsifier + red-team pass) of Nuclei JSONL findings via OpenAI-compatible endpoints (vLLM/Ollama). (CyberOK) — note: restrictive personal/non-commercial EULA, not a permissive OSS license. (★ 1 · updated 2026-05-25)
  • seclab-taskflow-agent 🟢 — YAML-driven taskflow agent framework for triaging CodeQL/SAST alerts and filtering false positives. (GitHub Security Lab) (★ 219 · updated 2026-07-20)
  • honeyslop 🟢 — Code-canary decoys to triage AI-hallucinated ("slop") vulnerability reports flooding bug-bounty programs. (★ 95 · updated 2026-05-20)
  • nano-analyzer 🟢🔬 — Minimal three-stage LLM pipeline (context → scan → skeptical triage) for zero-day discovery in C/C++. (AISLE) (★ 301 · updated 2026-04-14)
  • SigmaOptimizer 🟢 — Generates, tests, and refines Sigma rules from real logs with false-positive checking. (★ 11 · updated 2025-08-01)
  • ai-soc-triage-assistant 🟢⚠️ — SOC alert triage assistant with prompt-injection guardrails, output validation, and MITRE ATT&CK mapping. (★ 0 · updated 2026-02-23)

See also: OpenAI's Aardvark / Codex Security research previews — public references exist, but there is no standalone installable repo to badge here.

AI Agent & Coding-Agent Security

Securing the AI agents themselves — auditing coding agents (Claude Code, Codex, OpenClaw), scanning skills / plugins / MCP manifests, and governance for agentic development. A fast-moving 2026 category, split below by role.

Scanners & Auditors

  • agent-audit 🟢 — Forensic auditor for local AI coding agents (Claude Code, Codex CLI, OpenClaw) and project-surface scanner for repos shipping skills, plugins, and MCP manifests; 296 bundled rules across native + imported detector families, with optional LLM cross-verification. (CyberOK / S. Gordeychik) (★ 15 · updated 2026-07-15)
  • AI-Infra-Guard 🟢 — Full-stack AI red-teaming platform covering OpenClaw security scan, agent scan, skills scan, MCP scan, AI-infra vulnerability scan, and LLM jailbreak evaluation. (Tencent Zhuque Lab) (★ 4,278 · updated 2026-07-24)
  • SkillSpector 🟢 — Security scanner for AI-agent skills used by Claude Code, Codex CLI, Gemini CLI, and similar ecosystems; combines static analysis, AST/YARA/taint checks, optional LLM semantic review, MCP least-privilege/tool-poisoning checks, risk scoring, and SARIF/JSON/Markdown output. (NVIDIA) (★ 13,788 · updated 2026-07-24)
  • Ramparts 🟢 — Rust scanner for MCP servers and agent-skill bundles with YARA rules, optional LLM analysis, OSV/CVE lookups, OWASP MCP Top 10 mapping, and SARIF/JSON/Markdown reports. (★ 96 · updated 2026-06-23)
  • mcp-armor 🟢 — Local MCP security scanner with auto-discovery for agentic IDE configs, tool/resource/prompt inventory, prompt-injection checks, rug-pull and tool-poisoning detection, baseline drift monitoring, and JSON/Markdown reports. (Aira Security) (★ 116 · updated 2026-03-27)
  • aguara 🟢 — Single-binary static scanner (Go, no LLM) for AI-agent skills and MCP servers; multi-layer engine (pattern + NLP + taint tracking + rug-pull detection). Companion aguara-mcp exposes scanning as an MCP tool. (★ 85 · updated 2026-07-24)
  • agent-scan 🟢 — Security scanner for AI agents, MCP servers, and agent skills; the successor path for the original Invariant Labs mcp-scan work. (Snyk) (★ 2,818 · updated 2026-07-22)
  • inkog 🟠 — Commercial-backed static security scanner for AI agents across LangChain, LangGraph, CrewAI, AutoGen, and no-code workflows; Apache-2.0 CLI with proprietary deep-scan engine. (Inkog) (★ 29 · updated 2026-06-07)
  • AgentShield 🟢 — Security scanner for AI-agent configurations, MCP servers, hooks, and tool permissions with CLI, GitHub Action, and app workflows. (★ 1,020 · updated 2026-07-22)
  • repo-forensics 🟢⚠️ — Offline scanner for AI-agent repos, skills, plugins, and MCP servers; license is PolyForm Noncommercial. (★ 144 · updated 2026-07-25)
  • skill-scanner 🟠 — Scanner for agent skills combining YAML + YARA patterns, LLM-as-a-judge, and behavioral dataflow analysis (Codex / Cursor skill formats). (Cisco AI Defense) (★ 2,381 · updated 2026-06-29)
  • mcp-scanner 🟢⚠️ — Scanner for MCP servers and agentic tool surfaces, covering tools, prompts, resources, package risk, malware indicators, and deployment readiness. (Cisco AI Defense) (★ 990 · updated 2026-07-21)
  • mcp-guardian 🟢 — JS/TS library and CLI for detecting prompt injection in MCP tool descriptions and pinning tool definitions. (★ 5 · updated 2026-02-17)
  • agentic-radar 🟠 — CLI security scanner for agentic workflows (LangGraph, CrewAI, n8n, etc.) — maps tools/data flows and flags risks. (SplxAI) (★ 1,017 · updated 2025-11-27)
  • skilltotal 🟢 — Offline deterministic static scanner (regex + AST, no LLM, no account) for AI components — agent skills/plugins, MCP servers, npm & PyPI packages, and git repos; flags supply-chain risk, dangerous capabilities, prompt-injection surfaces, MCP tool poisoning/shadowing, and data-exfiltration paths, maps to the OWASP Agentic Skills Top 10, and emits JSON + SARIF 2.1.0. (skilltotal.ai) (★ 1 · updated 2026-07-09)
  • Sunglasses 🟢 — Local input/content scanner for AI agents that checks prompts, files, media metadata, skills, and tool descriptions against pattern and mechanism-based prompt-injection, exfiltration, command-injection, and agent-threat rules. — note: early-stage project; published precision/recall benchmark is self-reported by the project. (★ 5 · updated 2026-07-23)
  • trentclaw 🟠 — Client-side security auditor for OpenClaw deployments: applies pattern-based secret redaction locally, then uploads config/skill metadata and confirm-gated skill archives to Trent AI's API, which identifies misconfigurations, risky skills (prompt injection, permission escalation, data exfiltration), and chained attack paths. (Trent AI) — note: core detection runs server-side via the Trent AI API (requires an API key); the Apache-2.0 client collects OpenClaw config/skill metadata, applies pattern-based secret redaction locally, and uploads skill archives only after an explicit in-terminal confirmation. (★ 23 · updated 2026-07-23)

Frameworks, Rule Standards & Benchmarks

  • asamm 🔬 — Agentic SAMM — an OWASP SAMM extension for AI-driven development: an entry-point-based threat taxonomy plus 17 controls across 5 SAMM functions (Governance, Design, Implementation, Verification, Operations) with L1/L2/L3 maturity. License: CC BY-SA 4.0. (CyberOK / S. Gordeychik) (★ 14 · updated 2026-06-28)
  • agent-threat-rules (ATR) 🟢 — Open, versioned, machine-readable detection-rule format for AI-agent threats (prompt injection, tool poisoning, MCP attacks, skill compromise) — "Sigma for agents" (MIT). Engine-agnostic; converts to Splunk/Elastic/SARIF. (★ 0 · updated 2026-03-10)
  • MCP-Security-Checklist 🟢 — Security checklist for MCP clients, servers, multi-MCP deployments, lifecycle controls, authz/authn, isolation, and crypto-specific MCP integrations. (SlowMist) (★ 834 · updated 2025-04-28)
  • Anthropic-Cybersecurity-Skills 🟢 — Large community cybersecurity skill library for AI agents, mapped to MITRE ATT&CK, NIST CSF, MITRE ATLAS, D3FEND, and NIST AI RMF. — note: independent community project, not affiliated with Anthropic. (★ 26,601 · updated 2026-06-26)
  • Claude-BugHunter 🟢 — Claude Code / agent-skill bundle for authorized bug hunting and external red-team workflows across web, API, identity, cloud, recon, reporting, Burp MCP, slash commands, and the cbh CLI. — note: skill bundle and workflow knowledge base, not a standalone scanner. (★ 3,049 · updated 2026-07-22)
  • AgentDojo 🟢🔬 — Benchmark environment for prompt-injection attacks and defenses in tool-using LLM agents. (★ 684 · updated 2026-06-02)

Runtime Protection & Enforcement

  • ToolHive 🟢 — Platform for running MCP servers in isolated containers with per-request identity/access policy, registry and gateway workflows, audit logs, Kubernetes operator support, and observability hooks. (Stacklok) (★ 1,975 · updated 2026-07-26)
  • Pipelock 🟢 — AI-agent firewall and verifiable egress-control layer mediating HTTP, WebSocket, CONNECT, MCP, and A2A traffic to detect prompt injection, secret exfiltration, SSRF, and suspicious outbound actions. — note: open-source core is Apache-2.0; commercial reporting/features are also advertised. (★ 784 · updated 2026-07-26)
  • SourceryKit 🟠⚠️ — Python SDK for agent guardrails that intercepts outbound HTTP calls, enforces trusted-endpoint policies, logs requests, and checks agent handoff claims against a Provably backend before propagation. (ProvablyAI) — note: BSL-1.1 licensed; requires Provably backend/API credentials and database setup. (★ 15 · updated 2026-07-20)
  • mcp-context-protector 🟢 — MCP security wrapper that sits in front of downstream MCP servers, scans tool responses with guardrail providers, and supports quarantine/review workflows for desktop and coding-agent MCP configs. (Trail of Bits) (★ 222 · updated 2026-02-13)
  • MCP Defender 🟢⚠️ — Desktop app that proxies MCP tool-call requests and responses for Cursor, Claude, VS Code, and Windsurf, checks intercepted traffic against signatures, and prompts users to allow or block suspicious calls. — note: AGPL-3.0 licensed; project has been acquired by Docker. (★ 255 · updated 2026-06-05)
  • MCP Gateway 🟢 — Plugin-based MCP gateway that proxies configured MCP servers, sanitizes sensitive request/response data, supports guardrail plugins such as basic masking and Presidio, and runs a server reputation/risk check before loading MCP servers. (Lasso Security) (★ 381 · updated 2026-01-22)
  • Parallax 🟢 — Rust runtime policy engine for AI agents: evaluates lifecycle events with regex, keyword, Sigma, CEL, and SQL rules to block or redact prompt injection, data exfiltration, dangerous tool calls, and secret leakage. — note: early-stage project with limited adoption signal. (★ 31 · updated 2026-06-05)
  • Armorer Guard 🟢 — Local Rust scanner and MCP proxy for AI-agent prompt injection, credential leakage, exfiltration, and risky tool-call arguments, with structured reasons and no scanner network calls. — note: young project with limited independent adoption signal. (★ 41 · updated 2026-06-22)
  • onecli 🟢 — Credential gateway and encrypted vault for AI agents; injects real API credentials at the gateway so agents only see placeholder keys. (★ 2,847 · updated 2026-07-26)
  • microsandbox 🟢 — Local-first, microVM-backed programmable sandboxes for AI agents with SDKs, CLI, MCP support, and rootless hardware isolation. (★ 7,024 · updated 2026-07-25)
  • agentguard 🟢 — Real-time security layer for coding agents: hooks scan every new skill, block dangerous actions before execution, run daily posture patrols, and track which skill triggered each action (incl. Web3-specific checks). (★ 446 · updated 2026-06-25)
  • defenseclaw 🟠 — Enforcement and evidence layer for agentic deployments: static CodeGuard checks, sandboxing, registry ingestion with SSRF guards, and audit/observability. (Cisco AI Defense) (★ 783 · updated 2026-07-24)
  • AgentFence 🟢 — Runtime-oriented test harness for deployed agents, probing prompt injection, secret leakage, and system-instruction exposure. Early-stage project. (★ 59 · updated 2025-03-06)
  • clawsec 🟢⚠️ — Security skill suite for OpenClaw-family agents; AGPL-3.0 licensed. (Prompt Security) (★ 1,070 · updated 2026-07-22)
  • AgentLock 🟢🔬⚠️ — Pre-action authorization gate for LLM agent tool calls that decides from session provenance rather than content, with deny-by-default tool permissions, parameter lineage, Ed25519 signed receipts, and a hash-chained audit log; AGPL-3.0 licensed with commercial options. — note: evaluated on AgentDojo with predictions pre-registered before the runs; the published results include a suite where the defense costs more utility than the attack it prevents. (★ 18 · updated 2026-07-16)
  • h5i 🟢 — Local Rust CLI for auditable coding-agent workspaces: per-agent worktrees with sandbox policies, provenance capture, peer review, neutral verification, secret/prompt-injection audit signals, and refs/h5i/* run metadata. — note: security-adjacent agent-workspace governance tool, not a vulnerability scanner or VM-equivalent sandbox. (★ 486 · updated 2026-07-26)
  • DvalinCode 🟢 — Local-first AI coding agent with runtime governance controls: org/repo policy gates for tools, models, MCP servers, paths, and commands, plus provider/shell/MCP egress controls and hash-chained audit logs. — note: young project with limited independent adoption signal. (★ 96 · updated 2026-07-22)
  • TAP 🟢🟠 — Credential-isolation proxy and MCP server for AI agents: agents send placeholder credentials, TAP injects real secrets server-side after per-action policy checks, with optional human approval on sensitive calls. (human.tech) — note: Apache-2.0 runtime is self-hostable, but the hosted dashboard and managed-service deployment glue are proprietary; self-hosting puts credential/key isolation and policy-engine hardening on the operator. (★ 11 · updated 2026-07-23)
  • Agent Memory Guard 🟢 — Runtime middleware for AI-agent memory reads and writes, screening prompt injection, memory poisoning, secret/PII leakage, protected-key tampering, and size anomalies before persisted memory is reused. (OWASP) — note: OWASP Incubator project; published benchmark numbers are project-reported and should be independently reproduced before production enforcement. (★ 102 · updated 2026-07-26)

AI/ML Supply Chain & Model Security

Tools for securing model artifacts, serialized ML files, AI/ML supply-chain surfaces, and malicious-package detection datasets/benchmarks.

  • Fraim 🟢 — Framework for AI-powered security workflows including LLM SAST and IaC analysis with SARIF/HTML output. (★ 159 · updated 2025-12-01)
  • Adversarial Robustness Toolbox (ART) 🟢 — Flagship machine-learning security library for evaluating and defending models against evasion, poisoning, extraction, and inference attacks across major ML frameworks. (LF AI & Data / IBM) (★ 6,141 · updated 2025-11-13)
  • Foolbox 🟢 — Classic Python toolbox for generating adversarial examples and benchmarking robustness of PyTorch, TensorFlow, and JAX models. (★ 2,972 · updated 2024-03-04)
  • modelscan 🟢 — Scans ML model files for unsafe serialization patterns and embedded code, with a focus on model serialization attacks. (Protect AI) (★ 748 · updated 2026-02-18)
  • Fickling 🟢 — Python pickle decompiler, rewriter, and static analyzer for inspecting and detecting malicious pickle/PyTorch payloads. (Trail of Bits) (★ 652 · updated 2026-07-21)
  • picklescan 🟢 — Lightweight CLI/library for detecting suspicious Python pickle operations in ML and model artifacts. (★ 420 · updated 2026-07-01)
  • AIsbom 🟢 — AI software bill of materials tooling for AI/ML supply-chain inventory and provenance metadata. (★ 75 · updated 2026-07-26)
  • model-provenance-kit 🟢 — Toolkit for model-family provenance and fingerprinting across model weights, tokenizers, and architecture signals. (Cisco AI Defense) (★ 99 · updated 2026-07-22)
  • pickle-fuzzer 🟢 — Structure-aware fuzzer for pickle scanners, useful for hardening tools such as modelscan, Fickling, and picklescan. (Cisco AI Defense) (★ 17 · updated 2026-06-23)
  • Medusa 🟢⚠️ — AI-first security scanner for AI/ML repos, agents, and MCP surfaces; AGPL-3.0 licensed. (Pantheon Security) (★ 949 · updated 2026-06-24)
  • PrivacyRaven 🟢🔬 — Privacy-testing library for deep-learning systems, covering model extraction and membership-inference style attacks. (Trail of Bits) — note: archived/hiatus project, but still a useful reference implementation. (★ 214 · updated 2025-09-05)
  • gym-malware 🟢🔬 — OpenAI Gym environment for reinforcement-learning agents that mutate PE malware to evade static ML malware detectors. (★ 637 · updated 2018-06-15)
  • deep-pwning 🟢🔬 — Historical "Metasploit for machine learning" framework for experimenting with adversarial robustness of ML models. (★ 570 · updated 2022-05-17)
  • open-malicious-code-benchmark 🟢🔬 — OMCBench benchmark suite for malicious-code/package detection: labeled Python and JavaScript package archives, common runners, and published precision/recall/F1 metrics. (False Positive Community) — note: evaluates an unreleased commercial ML detector (MOLOT / PT Application Inspector) alongside open-source baselines. (★ 17 · updated 2026-06-09)
  • malicious-software-packages-dataset 🟢🔬 — Human-vetted dataset of malicious software packages across npm, PyPI, IDE extensions, and AI Skills, useful for detector training and evaluation. (Datadog Security Labs) — note: contains real malware samples; Datadog notes selection bias because many samples were identified by GuardDog. (★ 368 · updated 2026-07-24)
  • GuardDog 🟢 — CLI for detecting malicious PyPI, npm, Go, RubyGems, GitHub Actions, and VSCode extension packages using Semgrep rules and package-metadata heuristics. (Datadog) (★ 1,166 · updated 2026-07-24)
  • package-analysis 🟢🔬 — Sandboxed static/dynamic analysis pipeline for open-source packages, capturing filesystem, process, and network behavior and publishing data for malicious-package research. (OpenSSF) (★ 903 · updated 2026-07-21)
  • malicious-code-ruleset 🟢 — Focused Semgrep ruleset for malicious-code patterns such as dynamic execution and obfuscation, used as an OMCBench baseline. (Apiiro) (★ 149 · updated 2025-02-24)
  • pypi_malregistry 🔬⚠️ — ASE'23 / USENIX Security'26 malicious-PyPI dataset with more than 10k malicious package versions. — note: no LICENSE file found and the repository contains malware samples; handle in an isolated environment. (★ 127 · updated 2026-07-21)

Pentest & Red-Team Agents

Autonomous and semi-autonomous AI agents for penetration testing, exploitation, and attack simulation.

  • PentestGPT 🟢🔬 — The original USENIX'24 LLM pentest agent; re-released as an autonomous pipeline with strong benchmark results. (★ 14,513 · updated 2026-07-14)
  • PentAGI 🟢 — Fully autonomous multi-agent pentest framework with Docker sandboxing. (VXControl) (★ 21,248 · updated 2026-05-31)
  • CAI – Cybersecurity AI 🟢🟠 — Modular, bug-bounty-ready agent framework supporting 300+ LLM models. MIT for research; separate commercial license for production/on-prem. (Alias Robotics) (★ 9,542 · updated 2026-07-14)
  • Strix 🟢 — Autonomous "AI hackers" that dynamically run code and validate vulnerabilities with PoCs (Apache-2.0). (★ 44,309 · updated 2026-07-25)
  • hackingBuddyGPT 🟢🔬 — Minimal (~50 LOC) research framework for LLM-driven Linux priv-esc and web pentesting (FSE'23). (★ 1,187 · updated 2025-08-27)
  • Nebula 🟢🟠 — AI pentesting CLI assistant with local-LLM support (Llama-3.1, Mistral, DeepSeek). (★ 1,074 · updated 2026-07-25)
  • HexStrike-AI 🟢 — MCP server exposing 150+ security tools (nmap, gobuster, nuclei, …) to AI agents (MIT). (★ 10,491 · updated 2026-04-27)
  • Burp Suite MCP Server 🟢⚠️ — Official Burp Suite extension exposing Burp to AI clients through MCP. (PortSwigger) — note: GPL-3.0 licensed. (★ 1,012 · updated 2026-05-26)
  • pentest-ai 🟢 — Offensive-security MCP server with 200+ wrapped tools, specialist agents, and OWASP-oriented probes for authorized testing. (★ 1,430 · updated 2026-06-30)
  • pentest-ai-agents 🟢 — Collection of Claude Code offensive-security subagents for authorized penetration-testing research. (★ 2,038 · updated 2026-06-19)
  • DarkMoon 🟢⚠️ — Autonomous AI penetration-testing platform that orchestrates specialized web, AD, Kubernetes, CMS, and framework agents through an MCP-controlled Docker toolbox with local privacy-tokenization for sensitive target data. — note: GPL-3.0 licensed; heavy Docker/LLM stack, use only for authorized testing. (★ 780 · updated 2026-07-26)
  • T3MP3ST 🟢⚠️ — Autonomous offensive-security meta-harness that wraps local or API-backed coding agents into a multi-agent recon-to-exploit workflow with MCP/API, War Room UI, tool arsenal, and committed benchmark artifacts. — note: very new AGPL-3.0 project with bold benchmark claims; use only for authorized testing and verify independently before operational use. (★ 5,203 · updated 2026-07-24)
  • Shannon 🟢🟠⚠️ — White-box autonomous AI pentester with strong XBOW-benchmark results. Shannon Lite is AGPL-3.0; Shannon Pro is commercial. (★ 46,170 · updated 2026-07-24)
  • AIDA 🟢⚠️ — Model-agnostic autonomous pentest agent running inside an isolated Docker environment; AGPL-3.0 licensed. (★ 454 · updated 2026-07-19)
  • HackSynth 🟢🔬⚠️ — Planner/summarizer LLM-agent framework for autonomous penetration testing and benchmark evaluation; AGPL-3.0 licensed. (★ 309 · updated 2025-06-24)
  • VulnBot 🟢🔬 — Multi-agent collaborative penetration-testing framework with RAG support. (★ 181 · updated 2025-04-07)
  • PentestAgent 🟢 — Black-box AI pentest framework with MCP, multi-agent spawning, and persistent sessions. (★ 2,837 · updated 2026-07-07)
  • cyber-security-llm-agents 🟢⚠️ — AutoGen-based agents for cybersecurity tasks (shown at RSAC 2024). (NVISO) (★ 381 · updated 2024-05-07)
  • Pentest-Swarm-AI 🟢 — Swarm-intelligence multi-agent pentest with stigmergic blackboard coordination (Go). (★ 2,110 · updated 2026-06-20)
  • hackGPT 🟢⚠️ — LLM offensive-security toolkit. (★ 1,195 · updated 2025-07-21)

AI-Powered Recon & Narrow ML Tools

Hyper-specific AI/ML tools for a single offensive-security, recon, or detection step — the subwiz/eyeballer pattern rather than broad autonomous agents. 🅐 = self-contained trained model or learned model/pattern engine; 🅑 = LLM wrapper that calls an external API.

Subdomain & DNS Prediction

  • subwiz 🟢 — 🅐 Lightweight nanoGPT model that predicts resolvable subdomains via beam search; model weights are published on Hugging Face. (Hadrian Security) (★ 383 · updated 2025-12-18)
  • regulator 🟢⚠️ — 🅐 Learns and ranks regex-like naming patterns from known subdomains to generate likely new candidates. — note: no LICENSE file found; treat as source-available until clarified. (★ 393 · updated 2023-02-18)

Recon Screenshot Triage

  • eyeballer 🟢⚠️ — 🅐 Convolutional neural network that classifies pentest/recon screenshots (login pages, webapps, old-looking sites, parked domains, and custom 404s) for attack-surface triage. (Bishop Fox) — note: GPL-3.0 licensed. (★ 1,288 · updated 2024-02-19)

Software / Tech Fingerprinting

  • GyoiThon 🟢🔬 — 🅐 Machine-learning-assisted web intelligence tool that fingerprints products, versions, CVEs, login pages, debug messages, and related web-server signals from HTTP responses. — note: older project; Apache-2.0 licensed, but maintenance appears low. (★ 826 · updated 2021-06-29)
  • http-fingerprint-transformer 🔬⚠️ — 🅐 Transformer-encoded HTTP-header fingerprinting experiment for classifying web-server software and versions. — note: thesis artifact; code is GPL-3.0 and data is CC BY-SA 4.0. (★ 3 · updated 2024-04-05)

AI-Assisted Fuzzing

  • ffufai 🟢⚠️ — 🅑 AI wrapper around the ffuf web fuzzer that suggests file extensions and paths from the target URL and headers using OpenAI or Anthropic models. (Joseph Thacker) — note: requires an LLM API key; README states MIT but no LICENSE file was found. (★ 797 · updated 2025-12-04)

Password / Credential ML

  • PassGPT 🔬⚠️ — 🅐 GPT-style password model trained on leaked passwords for research on password generation and strength estimation. (Rando et al.) license: CC BY-NC-4.0 · access: open 10-char model; 16-char variant gated · artifacts: PyTorch/Safetensors. Research-only / non-commercial use; related code: javirandor/passgpt.
  • PassGAN 🔬 — 🅐 WGAN that learns password distributions from leaks to generate guesses; historical reference implementation of the PassGAN paper (MIT). (★ 2,005 · updated 2018-09-30)
  • neural_network_cracking 🔬 — 🅐 RNN password-guessing model from Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks (USENIX Security 2016); Apache-2.0 licensed. (CMU CUPS Lab) (★ 243 · updated 2018-11-30)

Phishing Detection (Visual / URL)

  • phishing-url-detection 🟢 — 🅐 Packaged URL phishing classifier with ONNX and pickle artifacts. license: MIT · access: open · artifacts: ONNX, pickle. Model card recommends ONNX over pickle for safer inference.
  • Phishing Email Detection DistilBERT v2.4.1 🟢 — DistilBERT text-classification model for email and URL phishing detection, trained on a public Hugging Face phishing-email dataset. license: Apache-2.0 · access: open · artifacts: Safetensors. — note: strong download signal, but independently verify the very high published metrics before production use.
  • PhishIntention 🔬 — 🅐 Deep-vision phishing detector that infers both brand intention and credential-taking intention from webpage appearance and dynamics (USENIX Security 2022). — note: CC0-1.0 licensed. (★ 262 · updated 2026-06-04)
  • VisualPhishNet 🔬⚠️ — 🅐 Triplet CNN for zero-day phishing detection by visual similarity to trusted websites (ACM CCS 2020). (CISPA) — note: no LICENSE file found; dataset access is research-request based. (★ 30 · updated 2022-02-09)

ML-Generated Detection Rules

  • yaraml_rules 🟢 — 🅐 Trains scikit-learn classifiers on malware/benign corpora and compiles the learned model into deployable YARA rules (Apache-2.0). (Sophos) (★ 214 · updated 2020-12-18)

Defensive Trained-Model Detectors

  • DeepSQLi 🟢⚠️ — 🅐 Deep-learning SQL-injection detector with dataset, trained models, and a Flask Prediction API for GatewayD IDS/IPS integration. (GatewayD) — note: AGPL-3.0 licensed; defensive detector rather than offensive generator. (★ 7 · updated 2026-02-21)
  • deepsecrets 🟢 — Semantic secrets scanner using lexing/parsing, entropy checks, and hashed-known-secret matching across 500+ languages. — note: useful narrow detector, but not a trained ML model. (★ 170 · updated 2026-06-04)
  • VLAI Vulnerability Severity Classifier 🟢🔬 — RoBERTa-based vulnerability-severity classifier trained on CIRCL vulnerability scores to assist triage before manual CVSS scoring. (CIRCL) license: CC-BY-4.0 · access: open · artifacts: Safetensors.

AI-Powered SAST & Secure Code Review

Static analysis and secure code review enhanced with LLMs.

  • Vulnhuntr 🟢 — Zero-shot vulnerability discovery in Python repos via LLM call-chain analysis; credited with a 0-day RCE in Ragflow. (Protect AI) (★ 2,718 · updated 2025-02-06)
  • deepsec 🟢 — Agent-powered security harness for scanning large codebases with coding agents, resumable parallel runs, custom matchers, and optional revalidation. (Vercel Labs) (★ 6,373 · updated 2026-07-25)
  • defending-code-reference-harness 🟢 — Reference Claude Code skills and autonomous vulnerability-discovery pipeline for threat modeling, static scanning, triage, execution-verified C/C++ memory-bug discovery, reporting, and patch generation. (Anthropic) — note: official reference implementation, not maintained as a product; the autonomous pipeline executes target code and should be run only inside the documented gVisor sandbox. (★ 6,779 · updated 2026-07-16)
  • rust-in-peace 🟢 — Rust-security fork of Anthropic's defending-code reference harness, adding a Rust profile for agentic review of unsafe/FFI memory bugs, panic-DoS, deserialization-trust issues, and Miri/ASan/panic/hang-verified findings. (Sergey Gordeychik) — note: very new Apache-2.0 fork; autonomous runs execute target code and should use the documented sandbox. (★ 7 · updated 2026-07-26)
  • claude-code-security-review 🟠 — Official Claude-based semantic SAST GitHub Action that reviews PR diffs. (Anthropic) (★ 5,642 · updated 2026-02-11)
  • IRIS 🟢🔬 — Neurosymbolic SAST combining LLMs with CodeQL for Java vulnerability detection (MIT). (★ 408 · updated 2026-07-02)
  • sast-skills 🟢 — Agent skills that turn AI coding assistants into a multi-agent SAST scanner. (★ 1,217 · updated 2026-04-08)
  • llm-sast-scanner 🟢 — SAST skill for AI coding agents with structured source-to-sink analysis across 34 vulnerability classes. License: MIT stated in README. (★ 272 · updated 2026-04-07)
  • sast-ai-workflow 🟢 — LangGraph workflow for reviewing static-analysis findings, reducing false positives, and producing vulnerability review output. (Red Hat Ecosystem AppEng) (★ 18 · updated 2026-06-29)
  • xvulnhuntr 🟢 — Archived fork of Vulnhuntr extending support to C#, Java, and Go. (Compass Security) (★ 12 · updated 2026-02-03)
  • llm-security-scanner 🟢⚠️ — LLM-powered code scanner that opens GitHub issues for findings. (★ 22 · updated 2025-04-02)
  • vulnhuntr-mod 🟢 — Modified Vulnhuntr with Qwen/Hunyuan support and Chinese-language prompts. (★ 7 · updated 2024-12-14)

LLM-Driven Fuzzing

Two families: (a) LLMs generating harnesses/targets for traditional fuzzing, and (b) fuzzing the LLM itself.

Harness / target generation

  • oss-fuzz-gen 🟢 — LLM-driven fuzz-harness generation for OSS-Fuzz; reported 26 real vulnerabilities (incl. CVE-2024-9143 in OpenSSL). (Google) (★ 1,423 · updated 2026-03-02)
  • PromptFuzz 🟢🔬⚠️ — LLM-mutated prompts to generate fuzz drivers for C/C++ libraries (Rust). (★ 339 · updated 2026-05-15)
  • Fuzz4All 🟢🔬 — "Universal" LLM-based fuzzer across compilers/languages (ICSE 2024). (★ 335 · updated 2025-08-11)
  • ChatAFL 🟢🔬 — LLM-guided protocol fuzzing extending AFLNet (NDSS'24). (★ 391 · updated 2025-06-20)
  • TitanFuzz 🟢🔬⚠️ — First LLM-based fuzzer for PyTorch/TensorFlow (ISSTA'23). (★ 94 · updated 2023-09-10)

Fuzzing the LLM

  • LLMFuzzer 🟢 — First open-source fuzzing framework for LLM API integrations. (★ 372 · updated 2024-02-12)
  • ps-fuzz 🟠 — System-prompt hardening fuzzer; 16 attacks × 16 providers. (Prompt Security) (★ 700 · updated 2026-02-16)
  • FuzzyAI 🟠 — Automated LLM fuzzer for jailbreaks/prompt injection. (CyberArk) (★ 1,537 · updated 2026-02-06)
  • spikee 🟢 — Prompt-injection evaluation and exploitation kit with dataset generation, Burp integration, and pluggable judges. (ReversecLabs / WithSecure) (★ 226 · updated 2026-07-13)
  • promptmap 🟢⚠️ — Prompt-injection scanner for custom LLM applications in white-box and black-box modes; GPL-3.0 licensed. (★ 1,237 · updated 2025-12-01)
  • ai-prompt-fuzzer 🟢 — Burp Suite extension fuzzing GenAI/LLM prompts. (PortSwigger) (★ 35 · updated 2025-09-04)

Threat Intelligence

AI/LLM tooling for CTI gathering, IOC/TTP extraction, and analysis.

  • trs 🟢 — LLM + ChromaDB tool to summarize threat reports and extract MITRE TTPs and IOCs. (★ 10 · updated 2023-11-15)
  • TI-Mindmap-GPT 🟢 — Streamlit app: AI summaries, mindmaps, IOC/TTP extraction, and ATT&CK Navigator layers. (★ 110 · updated 2026-02-16)
  • aiocrioc 🟢 — LLM + OCR IOC extraction (pulls IOCs from images/PDFs). (★ 38 · updated 2024-12-04)
  • ThreatIngestor 🟢 — Extracts/aggregates IOCs from feeds; integrates with MISP/ThreatKB (pairs well with LLM post-processing). (★ 923 · updated 2026-05-26)
  • IATelligence 🟢 — Explains imported Windows APIs in PE files via GPT and maps to MITRE ATT&CK. (★ 384 · updated 2022-12-09)
  • MCP_Security 🟢⚠️ — MCP server (ORKL) for querying the ORKL threat-intel API. (★ 49 · updated 2025-01-22)
  • threat-intelligence-cti-analysis 🟢 — NLP/LLM pipeline for IOC extraction, MITRE ATT&CK mapping, and knowledge-graph generation from unstructured CTI. (★ 4 · updated 2025-11-03)
  • CTI-BERT 🟢🔬 — BERT model pretrained from scratch on a large cybersecurity text corpus for downstream CTI extraction, classification, and question-answering tasks. (IBM Research) license: Apache-2.0 · access: open · artifacts: PyTorch.

Log Analysis / SIEM / SOC Triage

AI agents for SOC alert triage, investigation, and incident response.

  • AI-SOC-Agent 🟢 — Black Hat 2025 MCP server exposing security-investigation tools (ELK, IRIS). (★ 45 · updated 2025-12-28)
  • soctalk 🟢 — LangGraph SOC automation agent with MCP integrations for Wazuh, Cortex, TheHive, and MISP plus mock-agent test lab. (★ 71 · updated 2026-07-26)
  • Vigil SOC 🟢 — Open-source AI SOC with readable Python agents, Markdown playbooks, and MCP integrations for triage, investigation, hunting, response, reporting, and forensics. (Vigil SOC) (★ 219 · updated 2026-07-24)
  • agentic-soc-platform 🟢 — Agentic SOC platform (LangGraph/Dify) with local-LLM support. (★ 965 · updated 2026-07-24)
  • SigmAIQ 🟢⚠️ — pySigma wrapper and LangChain toolkit for automatic Sigma rule creation and translation; LGPL-2.1 licensed. (AttackIQ) (★ 97 · updated 2025-11-03)
  • SOCGPT 🟢 — LLM log summarization, severity triage, MITRE mapping, and Q&A. (★ 7 · updated 2025-06-11)
  • AttackGen 🟢 — LLM-driven incident-response scenario generator using MITRE ATT&CK + ATLAS. (★ 1,228 · updated 2026-07-21)

Reverse Engineering

LLM-assisted binary analysis and traffic inspection.

  • Gepetto 🟢 — IDA Pro plugin: GPT adds comments and meaningful variable names. (★ 3,447 · updated 2026-05-03)
  • ida-pro-mcp 🟢 — MCP bridge for IDA Pro exposing decompile, disassemble, xref, rename, and debugging workflows to LLM clients. (★ 10,776 · updated 2026-07-25)
  • GhidraMCP 🟢 — MCP server exposing Ghidra reverse-engineering ops to any MCP-capable LLM. (★ 9,583 · updated 2025-06-23)
  • ReVa 🟢 — Ghidra-focused reverse-engineering assistant with MCP support, Claude Skills integration, and long-form analysis workflows. (★ 789 · updated 2026-06-30)
  • GhidrAssistMCP 🟢 — Native Ghidra MCP extension with broad tool coverage, headless support, and security-sensitive tool gating. (★ 679 · updated 2026-07-12)
  • ghidra-mcp 🟢 — Ghidra MCP server with large tool coverage, GUI plugin, headless server, and lazy tool loading. (★ 2,960 · updated 2026-07-25)
  • GhidrOllama 🟢⚠️ — Ghidra script using the Ollama API for function analysis/renaming. (★ 153 · updated 2024-11-29)
  • GhidraGPT 🟢 — Ghidra plugin that integrates LLMs for automated code refactoring and analysis. (★ 593 · updated 2026-07-22)
  • LLM4Decompile 🟢🔬⚠️ — Research project for binary-to-C decompilation with LLMs; code is MIT, but model weights use a more restrictive license. (★ 6,783 · updated 2026-02-12)
  • x64dbg_mcp 🟢 — MCP server exposing x64dbg debugging and reverse-engineering operations to AI clients. (★ 85 · updated 2026-06-08)
  • binaryninja-mcp 🟢 — MCP server for Binary Ninja-assisted reverse engineering. (★ 47 · updated 2025-05-13)
  • OGhidra 🟢 — Natural-language Ghidra analysis via Ollama. (Lawrence Livermore National Lab) (★ 295 · updated 2026-07-24)
  • ghidra_tools (G-3PO) 🟢 — Ghidra plugin for AI-assisted decompiled-code analysis. (Tenable) (★ 312 · updated 2023-05-10)
  • gpt-wpre 🔬 — Whole-program reverse engineering with GPT-3. (★ 382 · updated 2022-12-31)
  • burpgpt 🟢 — Burp Suite extension integrating GPT for passive scanning. (★ 2,339 · updated 2024-06-09)
  • Burp-extension-for-GPT 🟢 — Burp extension to analyze HTTP traffic with GPT. (Tenable) (★ 115 · updated 2023-05-01)

LLM Red-Teaming & Guardrails

Tools for attacking and defending LLM applications themselves.

Scanners, Evals & Guardrails

  • garak 🟢 — The LLM vulnerability scanner — probes for prompt injection, jailbreaks, data leakage, and more. (NVIDIA) (★ 8,577 · updated 2026-07-24)
  • PyRIT 🟢 — Python Risk Identification Tool; battle-tested across 100+ GenAI red-team operations. (Microsoft) (★ 4,181 · updated 2026-07-26)
  • promptfoo 🟢 — LLM eval + red-teaming/pentesting CLI with 50+ attack plugins (MIT). Note: OpenAI announced an acquisition agreement in March 2026; remains MIT-licensed — track governance. (★ 23,613 · updated 2026-07-25)
  • Augustus 🟢 — Single-binary LLM security testing framework for prompt injection, jailbreaks, and adversarial attacks across many providers. (Praetorian) (★ 262 · updated 2026-07-23)
  • agentic_security 🟢 — Agentic LLM vulnerability scanner and AI red-team kit for jailbreaks, prompt injection, fuzzing, and API stress testing. (★ 1,941 · updated 2026-06-23)
  • HackAgent 🟢 — Python SDK and CLI for red-teaming AI agents with research-backed attacks such as AdvPrefix, AutoDAN-Turbo, PAIR, TAP, FlipAttack, BoN, and static templates across agent frameworks. — note: works locally without an API key; optional cloud reporting is available. (★ 336 · updated 2026-07-22)
  • HiveTrace Red 🟢 — Early-stage LLM red-teaming framework with 80+ attack templates, async evaluation pipelines, WildGuard evaluators, multi-provider support, and HTML reporting. — note: young project with limited independent adoption signal. (★ 28 · updated 2026-07-21)
  • DeepTeam 🟢 — Open-source framework for red-teaming LLMs and LLM systems across jailbreaks, prompt injection, data leakage, and safety risks. (★ 2,300 · updated 2026-07-20)
  • Moonshot 🟢 — Modular tool for benchmarking, red-teaming, and evaluating LLM applications with custom connectors and recipes. (AI Verify Foundation) (★ 338 · updated 2026-02-05)
  • Guardrails AI 🟢 — Python framework for adding input/output guards, validators, structured-output controls, and Guardrails Hub checks to LLM applications. (Guardrails AI) (★ 7,205 · updated 2026-07-23)
  • Giskard 🟢 — Open-source evaluation, testing, and red-teaming framework for LLM agents, including agent vulnerability scanning and RAG evaluation workflows. (Giskard AI) (★ 5,718 · updated 2026-07-23)
  • LangKit 🟢 — LLM monitoring toolkit extracting safety/security signals such as jailbreak similarity, prompt-injection similarity, hallucination checks, PII patterns, toxicity, and refusal metrics. (WhyLabs) (★ 994 · updated 2024-11-22)
  • LLM Guard 🟢 — Suite of input/output scanners (PII, prompt injection, etc.). (Protect AI) (★ 3,195 · updated 2026-07-08)
  • Rebuff 🟢 — Archived prompt-injection detector (heuristics + LLM + vector DB + canary tokens). (Protect AI) (★ 1,515 · updated 2024-01-25)
  • NeMo Guardrails 🟢 — Programmable guardrails (input/output/dialog/retrieval rails) for LLM apps. (NVIDIA) (★ 6,791 · updated 2026-07-23)
  • PurpleLlama 🟢 — Llama Guard classifiers, CodeShield, and CyberSecEval. (Meta) (★ 4,313 · updated 2026-07-24)
  • LLAMATOR 🟢⚠️ — Red-teaming framework for chatbots and GenAI systems; CC BY-NC-SA 4.0 licensed. (★ 216 · updated 2026-01-15)
  • Vigil 🟢🔬 — Library/REST API to scan prompts and responses for prompt injection. (★ 492 · updated 2024-01-31)
  • Counterfit 🟢 — ML/AI penetration-testing automation tool. (Microsoft) (★ 926 · updated 2025-07-18)
  • AI-Red-Teaming-Playground-Labs 🟢 — CTFd-based AI red-team training challenges. (Microsoft) (★ 2,022 · updated 2025-10-07)
  • EasyJailbreak 🟢🔬 — Framework for building and testing adversarial jailbreak prompts. (★ 874 · updated 2026-03-30)
  • TextAttack 🟢🔬 — Python framework for adversarial attacks, data augmentation, and training for NLP models; useful for robustness testing beyond chat-only LLM scanners. (★ 3,455 · updated 2026-04-17)
  • GPTFuzz 🟢🔬 — Research framework for red-teaming LLMs with auto-generated jailbreak prompts. (★ 601 · updated 2026-02-27)
  • HarmBench 🟢🔬 — ICML 2024 standardized evaluation framework for automated red-teaming and robust-refusal benchmarking. (Center for AI Safety) (★ 1,014 · updated 2024-08-05)
  • llm-attacks (GCG) 🟢🔬 — Canonical Greedy Coordinate Gradient adversarial-suffix attack implementation for transferable attacks on aligned language models. (★ 4,747 · updated 2024-08-02)
  • nanoGCG 🟢 — Fast, lightweight PyTorch implementation of the GCG adversarial-suffix algorithm. (★ 344 · updated 2025-05-13)
  • JailbreakBench 🟢🔬 — NeurIPS 2024 open robustness benchmark and leaderboard for generating and defending against LLM jailbreaks. (★ 635 · updated 2025-03-31)
  • Open-Prompt-Injection 🟢🔬 — Open-source toolkit and benchmark for implementing and evaluating prompt-injection attacks, defenses, and LLM-integrated applications. (★ 467 · updated 2025-10-29)
  • PINT Benchmark 🟢🔬 — Prompt-injection test benchmark for evaluating detectors and guardrails across multilingual prompt injection, jailbreak, benign, and hard-negative inputs. (Lakera) (★ 198 · updated 2026-04-02)
  • PIArena 🟢🔬 — ACL 2026 toolbox and benchmark for prompt-injection attacks and defenses, with ready-to-use attacks/defenses, evaluation pipelines, agent benchmarks, a Hugging Face dataset, and leaderboard. (★ 41 · updated 2026-04-20)
  • Whistleblower 🟢⚠️ — Offensive testing tool for inferring system prompts and discovering capabilities of LLM applications exposed through APIs. (Repello AI) — note: no LICENSE file found. (★ 166 · updated 2025-10-27)
  • LLMmap 🟢🔬 — Minimal-query fingerprinting tool for identifying LLMs from behavioral traces, with a pretrained open-set inference model. (★ 393 · updated 2025-07-24)
  • llm-security 🔬 — Original PoC for indirect prompt-injection attacks. (★ 2,118 · updated 2025-07-17)
  • JailbreakLLMs 🔬⚠️ — Research dataset of 6,387 ChatGPT prompts, including in-the-wild jailbreak prompts from Reddit, Discord, websites, and open datasets. (★ 23 · updated 2024-02-21)
  • Do-Not-Answer 🟢🔬 — Dataset for evaluating LLM safeguards on unsafe or policy-sensitive prompts. (★ 337 · updated 2024-06-07)
  • prompt-injection-defenses 🟢⚠️ — Curated catalog of practical defenses against prompt injection. (★ 713 · updated 2025-02-22)

Prompt-Injection Classifier Models

  • Wolf Defender Prompt Injection 🟢 — Hugging Face text-classification model for prompt-injection detection in agents, chatbots, and CI workflows. (Patronus Studio / Casdo Labs) license: Apache-2.0 · access: open · artifacts: Safetensors, ONNX.
  • DeBERTa v3 Prompt Injection v2 🟢 — Apache-licensed prompt-injection classifier usable via Transformers pipelines and ONNX. (Protect AI) license: Apache-2.0 · access: open · artifacts: Safetensors, ONNX.
  • PromptGuard 🟢⚠️ — ModernBERT-based prompt-injection and jailbreak classifier. (CodeIntegrity AI) license: Apache-2.0 · access: gated auto · artifacts: Safetensors.
  • Prompt Guard 86M 🟠⚠️ — Meta prompt-injection and jailbreak classifier from the Llama Guard family. (Meta) license: Llama 3.1 · access: gated manual · artifacts: Safetensors.
  • prompt-injection-sentinel 🔬⚠️ — ModernBERT-large classifier for prompt-injection and jailbreak detection. (Qualifire) license: other · access: gated auto · artifacts: Safetensors.

Specialty Security LLMs

  • SecGPT 🟢 — Open cybersecurity-tuned LLM family for vulnerability analysis, log/traffic investigation, anomaly detection, attack/defense reasoning, command analysis, and security Q&A. (Clouditera) (★ 3,086 · updated 2025-06-25)
  • Antares-1B 🟢⚠️ — Open-weight security SLM specialized for agentic vulnerability localization: it explores repository snapshots through a terminal-style loop and ranks likely vulnerable files for analyst review. (Cisco Foundation AI) license: Apache-2.0 · access: gated manual · artifacts: Safetensors + CLI ZIP. — note: HF access is gated/manual; related smaller model: Antares-350M, benchmark: VLoc Bench.
  • Trendyol Cybersecurity LLM v2 70B 🟢 — Defense-focused cybersecurity LLM based on Llama-3.3-70B, trained on an alignment-safe security instruction dataset for SOC, cloud, AppSec, detection, and vulnerability-management workflows. (Trendyol Group Security Team) license: Apache-2.0 · access: open · artifacts: GGUF.
  • WhiteRabbitNeo 2.5 Qwen Coder 7B 🟢⚠️ — Cybersecurity-oriented Qwen2.5-Coder fine-tune positioned for offensive and defensive security assistance. (WhiteRabbitNeo) license: Apache-2.0 + WhiteRabbitNeo restrictions · access: open · artifacts: Safetensors.
  • Lily-Cybersecurity-7B-v0.2 🟢 — Mistral-7B-Instruct fine-tune for cybersecurity assistance, trained on hand-crafted security and hacking-related instruction pairs. (Segolily Labs) license: Apache-2.0 · access: open · artifacts: Safetensors.
  • RavenX CyberAgent 35B Q4_K_M 🟢⚠️ — GGUF security-specialized text-generation model positioned for pentest, bug-bounty, tool-calling, MCP, CVSS/CWE, and MITRE ATT&CK workflows. (RavenX LLC / DeadByDawn101) license: Apache-2.0 · access: open · artifacts: GGUF. — note: built from an abliterated base model and marketed for autonomous security assessment; use only in authorized, sandboxed agent harnesses with tool-call validation.

LLM Honeypots & Deception

Honeypots and deception that use LLMs to simulate convincing systems.

  • Beelzebub 🟢 — Low-code honeypot using LLMs to simulate SSH/HTTP/MCP services (Go). (★ 2,099 · updated 2026-07-24)
  • DECEIVE 🟢🔬 — Proof-of-concept LLM-powered SSH honeypot that evaluates sessions as benign, suspicious, or malicious. (Splunk) (★ 286 · updated 2026-05-13)
  • TRAP 🟢🔬 — Research code for Targeted Random Adversarial Prompt honeypots that identify black-box LLM usage through model-specific prompt suffixes (ACL 2024 Findings). (★ 15 · updated 2024-11-20)
  • shelLM 🟢🔬 — LLM-powered SSH honeypot (paper "LLM in the Shell"). (★ 63 · updated 2026-06-25)
  • VelLMes 🟢🔬 — Multi-protocol LLM honeypot framework (successor to shelLM). (★ 78 · updated 2025-02-18)
  • llm-honeypot 🔬⚠️ — Cowrie SSH honeypot extended with prompt-injection traps to detect LLM hacker agents. (Palisade Research) (★ 60 · updated 2026-01-23)

CTF / Exploit / Bug-Bounty Agents & Benchmarks

Offensive agents and the benchmarks used to evaluate them.

  • SWE-agent (EnIGMA) 🟢🔬 — EnIGMA offensive-CTF mode; SOTA on NYU CTF, InterCode-CTF, and Cybench (v0.7 branch). (★ 19,915 · updated 2026-07-16)
  • Cybench 🔬 — 40 professional CTF tasks across 4 competitions; widely used by AI safety institutes. (★ 288 · updated 2026-07-09)
  • NYU CTF Bench 🔬 — Dockerized CSAW CTF challenges for LLM-agent evaluation. (★ 162 · updated 2025-09-22)
  • CTFTiny 🔬⚠️ — Lightweight CTF benchmark from the NYU LLM CTF group; GPL-2.0 licensed. (★ 18 · updated 2026-03-10)
  • InterCode 🔬 — Interactive-coding benchmark incl. InterCode-CTF. (★ 254 · updated 2024-05-05)
  • inspect_evals 🟢🔬 — Maintained Inspect AI evaluation suite containing multiple cyber benchmarks and tasks. (UK AI Security Institute) (★ 603 · updated 2026-07-24)
  • BountyBench 🔬 — 25 real systems / 40 bug bounties for Detect-Exploit-Patch evaluation. (★ 100 · updated 2025-06-22)
  • Cyber-Zero 🔬 — Trains cybersecurity agents without runtime; ships an EnIGMA+ scaffold. (Amazon Science) (★ 100 · updated 2025-09-02)
  • ExploitBench 🔬 — Measures AI-agent progress on V8/Chromium exploit ladders. (★ 315 · updated 2026-07-04)
  • AI Goat 🟢🔬⚠️ — Vulnerable-by-design local LLM CTF for learning prompt injection, insecure output handling, data leakage, excessive agency, and related LLM app risks. — note: GPL-2.0 licensed. (★ 354 · updated 2024-08-22)
  • AIGoat 🟢🔬⚠️ — Local-first vulnerable LLM security playground with guided OWASP LLM Top 10 attack labs, CTF challenges, progressive defenses, and an Ollama-backed AI shopping-assistant target. — note: platform code is Apache-2.0, but training/challenge content is CC BY-NC-SA-4.0 and requires permission for commercial workshops. (★ 70 · updated 2026-04-24)
  • Damn Vulnerable LLM Agent 🟢🔬 — Deliberately vulnerable LangChain ReAct agent for practicing prompt-injection and Thought/Action/Observation injection attacks. (ReversecLabs / WithSecure) (★ 494 · updated 2025-06-25)
  • claude-bug-bounty 🟢 — Claude Code plugin orchestrating recon → vuln classes → reporting. (★ 4,046 · updated 2026-07-25)
  • Bug-Bounty-Agents 🟢 — 43 AI agent personas for Claude Code / Copilot / Cursor across the bug-bounty lifecycle. (★ 358 · updated 2026-04-30)
  • ai-exploits 🟢 — Real-world AI/ML exploits (Metasploit modules + Nuclei templates) for MLflow, Ray, H2O. (Protect AI) (★ 1,742 · updated 2024-10-23)

Cloud / IaC / DFIR / OSINT / Phishing

AI tooling for cloud/IaC security, digital forensics, OSINT, and phishing detection.

  • EscalateGPT 🟢 — GPT-based discovery of privilege-escalation paths in AWS IAM policies. (Tenable) (★ 122 · updated 2024-01-17)
  • Cynative 🟢 — Local AI security research agent for cloud, code, and runtime environments across GitHub, GitLab, AWS, GCP, Azure, and Kubernetes, with read-only action gates, sandboxed code execution, evidence-backed verification, and audit logs. (★ 143 · updated 2026-07-25)
  • MemoryInvestigator 🔬 — Volatility 3 + LLM + RAG for memory-forensic triage. (★ 13 · updated 2025-09-16)
  • Volatility-MCP-Server 🟢 — MCP exposing Volatility 3 plugins for natural-language memory forensics. (★ 39 · updated 2025-07-07)
  • llm_osint 🟢🔬 — Proof-of-concept LLM OSINT framework using knowledge and web agents for internet research workflows. (★ 316 · updated 2024-11-02)
  • ai_osint 🟢 — Curated AI-OSINT dorks, queries, and techniques for discovering exposed LLM and AI infrastructure. (★ 150 · updated 2026-06-19)
  • PhishLLM 🔬⚠️ — Reference-less phishing detection via LLM brand recognition (USENIX'24). (★ 38 · updated 2026-06-04)
  • mcp-dnstwist 🟢 — MCP server for dnstwist DNS fuzzing to support typosquatting, phishing, and lookalike-domain analysis. (★ 51 · updated 2025-03-03)
  • osintgpt 🟢⚠️ — OpenAI embeddings + Qdrant over OSINT corpora. (★ 519 · updated 2023-12-11)
  • gpt-osint 🟢 — Web-based GPT-4 OSINT tool over social-media dumps and CSVs. (★ 35 · updated 2023-04-24)

Related Awesome Lists

  • awesome-llm-cybersecurity-tools — Tenable's list (archived but a strong reference). (★ 488 · updated 2024-04-08)
  • Awesome-LLM4Cybersecurity — 600+ papers on LLMs for cybersecurity. (★ 1,721 · updated 2026-07-08)
  • awesome-ai-cybersecurity — Broad AI-for-security collection. (★ 148 · updated 2026-07-06)
  • awesome-genai-cyberhub — GenAI-driven cybersecurity resources. (★ 52 · updated 2026-07-22)
  • awesome-ai-security — For pentesters, bug hunters, and researchers. (★ 33 · updated 2026-07-23)
  • awesome-ai-security — AI security resources. (★ 1,307 · updated 2026-07-22)
  • Awesome-AI-Security — AI security resources. (★ 844 · updated 2026-07-18)
  • Awesome-AI-For-Security — AI-for-security tools, papers, and datasets. (★ 142 · updated 2026-07-23)
  • awesome-cybersecurity-agentic-ai — Agentic-AI cybersecurity tools and security MCP servers. (★ 519 · updated 2026-06-28)
  • awesome-ai-agents-security — Focused map of AI-agent security resources across runtime protection, red-teaming scanners, static analysis, sandboxing, guardrails, benchmarks, and identity. (★ 56 · updated 2026-06-12)
  • Awesome-Offensive-AI-Agentic-Landscape — Offensive AI-agent landscape covering open-source pentest/red-team agents, offensive/security-specialized models, papers, benchmarks, and commercial tools. (★ 156 · updated 2026-07-20)
  • awesome-ai-agent-attacks — Sourced timeline of real AI-agent security incidents, breaches, vulnerabilities, and attack techniques. (★ 39 · updated 2026-07-21)
  • AI Security Repository Radar — Daily-updated AI/LLM/MCP/RAG security repository radar with category, license, stars, and quality/relevance metadata. (★ 5 · updated 2026-07-26)
  • awesome-MLSecOps — Curated MLSecOps resources spanning adversarial ML, LLM security, AI red teaming, model scanning, supply-chain protection, and MLOps pipeline security. (★ 442 · updated 2026-07-24)
  • awesome-ai-guardrails — Catalog of AI guardrail models, tools, organizations, datasets, and papers, with useful Hugging Face model coverage. (★ 61 · updated 2026-06-22)
  • open-source-llm-scanners — Open-source LLM scanners and testing tools. (★ 109 · updated 2026-02-05)
  • awesome-mcp-security — MCP security resources, tools, writeups, and server/client risk references. (★ 723 · updated 2026-03-03)
  • awesome-ml-security — Trail of Bits' curated machine-learning security resources. (★ 169 · updated 2026-02-06)
  • awesome-ml-privacy-attacks — Machine-learning privacy-attack papers and resources. (★ 640 · updated 2024-03-18)
  • awesome-ml-for-cybersecurity — Large classic list of machine-learning-for-cybersecurity resources (stale-ish but still useful). (★ 9,203 · updated 2024-04-11)
  • Awesome-AI4DevSecOps — Taxonomy of AI-driven security solutions for DevSecOps. (★ 21 · updated 2025-07-02)
  • awesome-llm-security — Securing LLMs. (★ 1,663 · updated 2025-08-20)
  • awesome-security-for-ai — Products for securing AI systems. (★ 92 · updated 2024-06-13)
  • awesome-gpt-security — GPT/LLM security tools and cases. (★ 663 · updated 2026-07-24)
  • awesome-threat-intelligence — Classic CTI list (pairs with the AI-CTI section). (★ 10,486 · updated 2026-05-31)

Contributing

Contributions are welcome! This README is generated from structured data.

  1. Edit data/sections.json (validated by data/schema.json).
  2. Use structured fields such as status, flags, and license; do not paste rendered emoji tags into the data.
  3. Regenerate and check the README:
python3 scripts/update_github_metrics.py
python3 gen_readme.py
python3 gen_readme.py --check

Example entry:

{
  "name": "ExampleTool",
  "repo": "OWNER/REPO",
  "status": ["open_source"],
  "license": "MIT",
  "flags": ["early_stage"],
  "desc": "One factual sentence about what the tool does.",
  "related": [
    {"label": "Sibling tool", "url": "https://github.com/OWNER/SIBLING"}
  ]
}

Status values: open_source, research, commercial_open. Common flags: license_caveat, early_stage, archived, heavy_runtime, requires_api_key, authorized_testing_only, commercial_features, no_license, noncommercial, copyleft, abliterated_or_uncensored.

Guidelines: link the canonical upstream repo (not a fork); verify the URL resolves; tag the correct type and add a caveat flag/note for non-permissive, non-commercial, unclear, missing, or restrictive licenses; prefer real, installable projects over blog-only references.

For Hugging Face model entries, include the model id, license, access status (open/gated), and artifact formats (for example Safetensors or ONNX).

License

To the extent possible under law, the contributors have waived all copyright and related rights to this list (CC0-1.0). Linked projects retain their own licenses — check each before use.

关于 About

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.
agentic-aiagentsawesomeawesome-listawesome-listsllmsecurity

语言 Languages

Python100.0%

提交活跃度 Commit Activity

代码提交热力图
过去 52 周的开发活跃度
39
Total Commits
峰值: 13次/周
Less
More

核心贡献者 Contributors