We5ter/Scanners-Box

What it is

Scanners-Box (We5ter/Scanners-Box) is a README-only index of open-source security tools, available in English, Chinese and Spanish. The current version leads with AI-security categories. The older web, host, port and subdomain lists now sit below them. Each entry is one link with a one-line description and badges for language, last commit, stars and license.

What the page lists

The AI block comes first and has seven sections:

• Autonomous pentest agents: vxcontrol/pentagi (Go, runs engagements in a Docker sandbox with 20+ tools such as nmap, metasploit and sqlmap), KeygraphHQ/shannon (white-box web/API pentester), oritera/Cairn, SickHackShark, LuaN1aoAgent, Dark-Moon, and CyberStrikeAI (100+ tools, plus a built-in lightweight C2 framework).
• LLM-powered vulnerability scanners: AISLE nano-analyzer, vercel-labs/deepsec (on-demand review of large existing repos), vigolium.
• Auditing AI agents and apps: garak, rebuff, LLMFuzzer, Tencent AI-Infra-Guard (including MCP server risk detection), affaan-m/agentshield (268 rules across 15 modules, scored 0-100, CI gating, SOC 2 / PCI DSS / ISO 27001 mapping), Cisco mcp-scanner (YARA, LLM analysis).
• Agent runtime controls: NVIDIA OpenShell (declarative YAML policies, runs Claude Code, Codex and Copilot CLI in containers), Microsoft agent-governance-toolkit (policy packs mapped to the 10 OWASP Agentic Top 10 categories), agentkitai/agentgate (human approval routing), kubernetes-sigs/agent-sandbox (Sandbox CRD, gVisor/Kata).
• Agent skill auditing: NVIDIA SkillSpector and Cisco skill-scanner (YAML+YARA, LLM-as-a-judge, dataflow analysis).
• Vulnerability discovery and remediation skills: anthropics/defending-code-reference-harness, cloudflare/security-audit-skill.
• Agentic toolkits: h5i-dev/h5i (agent-driven web red-teaming that replays confirmed attack flows in CI).

The classic sections cover smart contracts (Mythril, Oyente, Securify2), container and cluster tools (Grype, Kubescape, CDK, KubiScan), internal-network frameworks, wireless, Android APK analysis, binary analysis, privacy compliance, and a long subdomain list (Amass, subfinder, OneForAll, ksubdomain).

What to do

• If the goal is securing agent deployments, go to the "Security Auditing for Agent Skills", "AI Agent Runtime Controls" and MCP/agent-config entries. They are the most direct, concrete additions here.
• For classic recon or container work, use the page to compare candidates, then check each repo's badges before choosing.

Caveats

• The fetch was truncated at 60,000 of 180,451 characters, ending in the subdomain section. The later categories in the contents list (web XSS, SQLi, weak passwords, middleware, code analysis, APT) were not seen, and neither were their entries.
• The page gives no evaluation, benchmarks or install steps. Descriptions are the maintainers' one-liners and should be checked in each repo.
• Many entries are offensive tooling (CrackMapExec, WiFi-Pumpkin, mass-bruter, CyberStrikeAI's C2). Use them only on authorized targets.
• A sponsor table (an LLM API aggregator) and a link to the maintainer's daily AI tool picks site appear near the top. They are not part of the index.