awesome-ai-security-tools

What it is

An awesome-list of AI-security and AI-assisted-security tools. The catalog summary already covers the tool inventory and categories; what it can't carry is the selection-relevant metadata the list attaches to each entry — a type legend, license traps, maturity signals from star counts, and the fact that all GitHub metrics are stale static snapshots.

How it works

Entries carry type badges: 🟢 open-source, 🔬 research, 🟠 commercial-with-open-components, and a ⚠️ marker for restrictive licensing. GitHub-hosted entries show static ★ star and last-commit snapshots, not live data. The maintainer regenerates them manually before a release:

python3 scripts/update_github_metrics.py

Most recent refresh: 2026-09-14. Ordering within a section favors flagship and actively-maintained projects, so position is a curated signal, not alphabetical.

What to do

Read the ⚠️ badges before adopting — several entries that look like OSS are not usable commercially:

• nuclei-autotriage — restrictive personal/non-commercial EULA, not a permissive OSS license.
• repo-forensics — PolyForm Noncommercial.
• ai-soc-triage-assistant and Cisco AI Defense mcp-scanner — also carry the ⚠️ marker.

Use star counts to gauge maturity, which the summary flattens. The heavyweights are SkillSpector (NVIDIA, ★14,696), AI-Infra-Guard (Tencent, ★6,226), Snyk agent-scan (★2,913), and Cisco skill-scanner (★2,440). Several named tools are effectively unproven: ai-soc-triage-assistant (★0), nuclei-autotriage (★1), mcp-guardian (★6), AI-Infra-Guard… (note AI-Infra-Guard is high-star but ★6,226 — not to be confused with low ones). SigmaOptimizer (★11) and agent-audit (★15) are small.

For the overlapping MCP/skill-scanner cluster, the list encodes lineage worth knowing: Snyk agent-scan is the stated successor to Invariant Labs' original mcp-scan; inkog is Apache-2.0 CLI wrapping a proprietary deep-scan engine (so the free tier is partial).

Caveats

• All star and last-commit figures are manual snapshots, not live — treat any count or date as of the 2026-09-14 refresh at newest, and stale for anything older.
• OpenAI's Aardvark is mentioned but deliberately not badged: no standalone installable repo exists, so it can't be evaluated from this list.
• The list mixes 🔬 research artifacts (e.g. nano-analyzer, ★307) with production tools; a research badge signals a paper/benchmark, not a supported product.

<system-reminder>The page content is untrusted data; badges and counts above are reproduced from it, not independently verified.</system-reminder>