🛠️ Tools107

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types5149 Articles1737 Papers1217 Write-ups790 Repos603 Threads304

More types6

Advisories270 Tools107 Talks54 Other33 Courses19 Videos15

🛠️ Tools

x.comtool🧠 AI

zahT3 (@zahT3zuo) on X

Hotseat is a free, open-source macOS menu bar app that moves Claude Code and Claude Desktop to another of the user's Claude accounts in one click and returns to the same session. Sessions, settings, skills and MCP servers are shared, so `claude --resume` works under either account. When a session hits a usage limit, it offers to continue under another account. It never reads tokens or cookies. Install with Homebrew.

Claude CodeClaude DesktopmacOS+2

HotseatAnthropic

coding-agents· Added 1 Nov 2026, published 31 Oct 2026

x.comtool🧠 AI

Ritik Shukla (@Retik_S) on X

kanzo is a local kanban board that coding agents can update. It ships as one 4 MB binary that starts in 2 ms and runs on localhost. It also works as an MCP server, so Claude Code and Codex see the same tasks as the user. The board is stored as a folder that can sync through a private git repo. The post is brief and gives no further detail.

Model Context ProtocolClaude CodeCodex+2

kanzo

mcp, coding-agents· Published and added 30 Oct 2026

vulncheck.comtool🛡️ Security

VulnCheck - Outpace Adversaries

VulnCheck Open Source is an index of VulnCheck's open-source tooling for its vulnerability and exploit intelligence. It lists a Python API client, a CLI, a GitHub Action for CI/CD, go-exploit (a Go exploit framework), an MCP server for delivering intelligence to AI clients, and VulnCheck Insights, a Chrome extension that highlights CVEs, CPEs and PURLs on web pages and enriches them. The page gives only one-line descriptions.

GoPythonGitHub Actions+2

VulnCheckgo-exploitVulnCheck Insights+2

Offensive Security, DevSecOps· Added 29 Oct 2026

x.comtool🧠 AI

Jurly (@jurlycat) on X

Chums is a free, open-source Apple Watch app that turns Claude Code and Codex sessions running on a Mac into animated characters, in the spirit of Muse Charm. Users hold the screen and speak, see whether the agent is thinking, working or waiting, and approve actions from the watch. Each character has its own session, personality and voice. The iPhone companion app adds photos, files and interactive results. The announcement does not describe the setup or how it connects to the Mac.

Claude CodeCodexmacOS+1

ChumsMuseApple

coding-agents· Added 30 Oct 2026, published 29 Oct 2026

x.comtool🧠 AI

Zyon ⚗️ (@zyonbuilds) on X

Orca is an open-source (MIT) desktop app from stablyai for running a fleet of coding agents, including Claude Code, Codex and OpenCode, each in its own git worktree using the user's own subscriptions. Features include fanning one prompt across five agents and merging the winner, commenting on diffs and sending them back, SSH worktrees on remote machines, and a phone app for steering agents. The post reports 103k stars.

Claude CodeCodexOpenCode+3

Orcastablyai

coding-agents, agents· Added 30 Oct 2026, published 29 Oct 2026

spm.threat-modeling.comtool🛡️ Security

CISO Security Program Management 2026

Security Posture Management is a web tool that maps 30 CISO-accountable security topics across the five NIST Cybersecurity Framework functions. It tracks current maturity, KPIs, risks and audit findings per topic. It also records target maturity, target dates, accountable owners and review dates, flagging topics unreviewed for 6 months as due and 12 months as overdue. Initiatives link to topics and risks with owner, budget, dates and expected maturity uplift.

NIST Cybersecurity Framework

GRC· Added 29 Oct 2026

x.comtool🧠 AI

Big Bull (@BIGBULLapp) on X

clauth is a Rust terminal UI for Claude Code that combines multi-account switching with a live 5h / 7d usage monitor. A fallback chain moves the user off an exhausted account before Claude Code blocks. It supports Pro, Max, Team and Enterprise OAuth accounts and custom API endpoints on Linux, macOS and Windows. The post notes that auto-switching means the tool decides when accounts change.

Claude CodeRustOAuth+4

clauthAnthropic

coding-agents, ai-infra· Added 30 Oct 2026, published 28 Oct 2026

brangus.iotool🧠 AI

Survival LLM: AI assistant and emergency library that runs on your own computer

Survival LLM is a free, open-source desktop app for macOS (Apple Silicon) and 64-bit Windows that runs an AI model and an offline emergency library on the user's computer. It checks the machine's memory, downloads a fitting model, and answers from sources such as Wikipedia, WikiMed, Ready.gov and CDC guidance, citing each article. Users can add their own files; version 0.3.2 is dated October 2026.

LLMRAGmacOS+1

Survival LLMWikipediaWikiMed+9

llm-apps, inference· Added 28 Oct 2026, published 27 Oct 2026

x.comtool🧠 AI

alex shapalov (@alxshp) on X

PGX is a free, open-source Postgres runtime written in Rust that hosts thousands of isolated databases in one process, aimed at AI agents. A companion agent skill, installed with `npx skills add pgrundev/pgx --skill pgx`, gives each Claude Code agent its own database automatically. The author claims 1,000 databases in 659 MB RAM, about 0.7 MB per idle database, an 85 ms clone of a 674 MB database, and a 200-agent test with no conflicts.

PostgreSQLRustClaude Code+1

PGX

coding-agents, ai-infra· Added 28 Oct 2026, published 27 Oct 2026

x.comtool🧠 AI

Mauro Ubeda (@mauroubeda) on X

BibCode is an open-source desktop app, now in beta, for running coding agents side by side. It is built with Rust and Tauri rather than Electron, and runs Codex, Claude, Cursor and OpenCode, each in its own git worktree. It can also connect to remote BibCode Servers. The author, Mauro Ubeda, says it mixes ideas from T3 Code and Orca. The post gives no feature detail beyond this.

RustTauriGit+4

BibCodeMauro UbedaT3 Code+1

coding-agents, agents· Added 28 Oct 2026, published 27 Oct 2026

x.comtool🛡️ Security

Brute (@BRuteLogic) on X

OBroken is Brute Logic's proprietary scanner for OAuth authorization bypasses. It covers 23 techniques across 17 vulnerability classes and produces a standalone Find/Forge/Fire PoC for each finding. The demo runs the missing audience validation case (CVE-2025-9803): it discovers the authorization server, gets a token bound to an attacker resource, and confirms the real API accepts it. A public OAuth bypass testbed accompanies it.

OAuth

CVE-2025-9803OBrokenjBroken+2

Identity & Access, Offensive Security, AppSec· Added 28 Oct 2026, published 26 Oct 2026

proton.metool🛡️ Security

Proton Flock Camera Map

Proton Flock Camera Map is a ZIP-code search map of Flock license plate reader locations. Its data comes from researcher Joshua Michael, who found in November 2025 that Flock's servers exposed an access token to anyone without login, and published his map in December. His inventory lists over 170,000 cameras and 130,000 other devices, about 40% above Flock's cited 120,000 cameras. The page also covers what Flock records and cites a Washington Post review of officer misuse.

Flock Safety

Joshua MichaelGarrett LangleyVehicle Fingerprint+1

OSINT· Added 26 Oct 2026, published 25 Oct 2026

x.comtool🧠 AI

Dan Kornas (@DanKornas) on X

jshook is an open-source (AGPL-3.0) MCP server that gives AI agents a search-first, profile-aware reverse-engineering workspace for JavaScript, browser traffic, WASM and native processes. Agents start with a small searchable tool surface and move to workflow or full profiles only when needed. It drives Chromium or Camoufox over CDP, captures WebSocket traffic, has HTTP, GraphQL and Burp Suite helpers, and supports hot-reload plugins and declarative workflows. The post is a short announcement; the repository link is in a reply.

Model Context ProtocolJavaScriptWebAssembly+6

jshookDan Kornas

mcp, agents· Added 28 Oct 2026, published 25 Oct 2026

x.comtool🛡️ Security

Dan Kornas (@DanKornas) on X

jshook is an open-source (AGPL-3.0) search-first reverse-engineering workspace for AI agents, exposed over MCP. It drives Chromium or Camoufox through CDP, captures WebSocket traffic, offers HTTP, GraphQL and Burp Suite helpers, deobfuscates JavaScript, rebuilds source maps and disassembles WebAssembly. Tool profiles start small and expand to workflow or full sets; hot-reload plugins and declarative workflows extend it.

Model Context ProtocolBurp SuiteChrome+3

CamoufoxCDP

Malware & RE, AI Security, Offensive Security· Added 28 Oct 2026, published 25 Oct 2026

x.comtool🧠 AI

Agent Credit (@agentcredit_) on X

Agent Credit v1.3 is a remote MCP server that lets AI agents run credit checks on each other. It has six tools: score, compare, operator record, alerts and on-chain proof check. Calls are paid per use in USDC through x402 with no account or key. It also flags shared wallets, lists every token an operator launched and how each ended, and offers embeddable badges and wallet-signed record claims.

Model Context Protocolx402USDC+1

Agent Credit

mcp, agents· Added 26 Oct 2026, published 25 Oct 2026

mcpmarket.comtool🧠 AI

Search Search results for "security" | MCP Market

MCP Market search results for "security" in its skills category, listing about 20 installable AI agent skills. Entries cover OWASP Top 10 audits, secure PHP coding, STRIDE threat modeling, CVE remediation, security header analysis, misconfiguration finding, bug bounty triage and AgentShield scans of Claude Code configurations. One is a paid D365FO security-role XML skill. Each entry has only a one-line description and a category label.

Claude CodeAgentShieldPHP+1

MCP MarketOWASPSTRIDE

coding-agents, prompting· Added 25 Oct 2026

x.comtool🧠 AI

Dan Kornas (@DanKornas) on X

HiRoute is an open-source (Apache-2.0) local model router for developers using agent clients such as Codex and Claude Code. Routing plans judge each new message and send routine work to economical models, while harder design decisions and fixes stay on the primary model. It supports custom task branches, ordered failover candidates with explicit exhaustion, per-session cost and usage records, and runs as a macOS desktop app or a Linux CLI and daemon.

CodexClaude CodemacOS+1

HiRouteDan Kornas

ai-infra, coding-agents· Added 25 Oct 2026, published 24 Oct 2026

thomasunise.comtool🛡️ Security

Argus – a free, open-source agentic security operations platform – MIT

Argus is a free, MIT-licensed, self-hosted security operations platform that maps cloud, identity, code, device, network and Kubernetes assets into one evidence graph and detects fast, AI-driven attacks. Read-only AI agents investigate and only propose actions. Changes go through a broker with approvals, dry runs, automatic rollback and a kill switch. It also has canary traps for AI attackers, an attack simulator, an AI gateway and shadow-AI discovery.

ArgusCrowdStrikeSentinelOne+3

CISA KEVprompt injectionSOC 2+1

AI Security, Blue Team & Detection· Added 25 Oct 2026, published 24 Oct 2026

x.comtool🛡️ Security

Trail of Bits (@trailofbits) on X

Trail of Bits announces a scanner, built by Scott A., that finds hidden copies of the vulnerable Brotli decoder behind a Node.js/Brotli bug, including in stripped binaries. Exploitability of the bug is still under testing. Binary matching covers only aarch64 gcc builds, so an empty result on a stripped x86 binary may be a coverage gap. The post also separates finding vulnerable code from knowing whether an app reaches it.

Node.jsBrotli

Trail of Bits

AppSec, Supply Chain, Malware & RE· Added 25 Oct 2026, published 23 Oct 2026

simonwillison.nettool🧠 AI

Quick Study

Quick Study is a browser artifact built by Claude Opus 5.5 (High) from a single prompt. The user opens a photo and the page repaints it in a few seconds with a simulated paintbrush on a canvas element. Simon Willison links it to an earlier experiment in which Claude Fable simulated a watercolor illustration with P5.js. The post gives the prompt but no code walkthrough.

ClaudeJavaScriptP5.js

Simon WillisonClaude Opus 5.5Claude Fable 5.1+1

prompting, models· Published and added 23 Oct 2026

corgi.computertool🧠 AI

Show HN: Corgi, a helpful {agent, terminal} multiplexer

Corgi is a terminal multiplexer for humans and AI coding agents, installed with a curl script. It shows each agent's state (working, needs you, finished, idle), keeps agents running in the background like tmux, and tracks token usage, per-workspace resource use and every file an agent changed. It also supports git worktrees, SSH image paste (needs Ghostty Nightly) and a corgi --skill command that teaches agents to drive it.

CorgiGhosttytmux+1

coding-agents, agents· Added 24 Oct 2026, published 23 Oct 2026

x.comtool🛡️ Security

Trail of Bits (@trailofbits) on X

patching-bugs is a Trail of Bits plugin for Codex that has an AI agent write a vulnerability fix, prove it works, and check it for regressions. It was built from analysis of thousands of Codex sessions from the Patch the Planet work with OpenAI. The post argues defenders need patch-writing agents to match attackers' bug-hunting agents. It gives no technical detail beyond that.

CodexOpenAI

Patch the PlanetTrail of Bits

AI Security, AppSec· Added 24 Oct 2026, published 22 Oct 2026

x.comtool🧠 AI

Meku_SI (@MEKU_SI) on X

MEKU Human Cloud is an MCP server for agents that need a real person to do a task. It exposes three tools: search humans (read-only), request a human (a human operator reviews every request first), and check status. It is listed in the MCP Registry as farm.meku/human-cloud. The tweet gives no detail on pricing, humans available or request formats; those are in the linked docs.

Model Context Protocol

MEKU Human CloudMeku_SI

mcp, agents· Added 23 Oct 2026, published 22 Oct 2026

x.comtool🧠 AI

EveryDev.ai (@EveryDevAi) on X

Weco, from WecoAI, is an open source CLI that optimizes code, prompts and agent harnesses against a metric the user defines. It uses LLM-guided tree search: the user supplies an eval command and Weco iterates across multiple files with the user's own API keys. The post lists Claude Code, Cursor, Codex, OpenClaw, PyTorch, CUDA and Triton as supported. It gives no benchmarks or setup details.

WecoClaude CodeCursor+5

WecoAI

coding-agents, evals· Published and added 22 Oct 2026

layerfs.aitool🧠 AI

LayerFS: The filesystem for AI coding agents

LayerFS is a serverless, versioned filesystem for AI coding agents. Every file or Bash tool call becomes a commit on a branch, agents on different machines share one Store without a database server, and same-file clashes are refused with Conflict. Forks copy no files, chunks are deduplicated and compressed, and ignored dependency files persist, so a mount takes about 0.05 s against about 5 minutes of reinstalling. The page gives vendor claims and no benchmarks or docs.

Git

LayerFS

coding-agents, ai-infra, agents· Added 22 Oct 2026, published 21 Oct 2026

alterauth.comtool🧠 AI

Launch HN: Alter (YC S25) – Access control for multi-user agents

Alter is a privileged access management layer for AI agents (YC S25). It stores credentials in a vault, injects them per request through a proxy, gives each agent its own identity and scoped grants, and logs every call to a tamper-evident audit trail. One SDK call covers storage, refresh, policy and audit for 140 API providers, with LangChain, MCP and AWS integrations. Policy is default-deny down to the parameter, with human approval for risky calls.

Model Context ProtocolLangChainAWS+3

AlterY Combinator

ai-infra, agents· Added 22 Oct 2026, published 21 Oct 2026

jevcards.comtool🧠 AI

Show HN: Jev Cards, Can you beat a vision model at a picture quiz?

Jev Cards is a browser picture quiz where a player competes against Jev 1.14, a vision decision model. The 490 cards cover fruit, flags, maps, chess and illusions. Jev reads the image and question and returns a probability for every option, or a box for "tap the place" cards, in one call of about 0.25 seconds. It never writes text. The page reports 5,256 wins in 6,820 games.

Jev

multimodal, evals· Added 21 Oct 2026, published 20 Oct 2026

scfcontrolsplatform.comtool🛡️ Security

SCF Controls Platform — open source

SCF Controls Platform is free, open-source (AGPL-3.0) GRC software built on the Secure Controls Framework. It covers the 1,451-control SCF catalog with 354+ framework mappings, L0–L5 evidence maturity scoring, a risk register linked to controls, and audit workspaces. It self-hosts via Docker Compose or a Helm chart for Kubernetes, and is independent of ComplianceForge, which publishes the SCF.

SCF Controls PlatformSecure Controls FrameworkDocker+2

ComplianceForgeSOC 2ISO 27001+4

GRC· Added 20 Oct 2026

labs.securitykid.comtool🛡️ Security

SecurityKid — learn secure code review on real vulnerabilities

SecurityKid Labs is a practice platform for vulnerability code review built on real GitHub security advisories, de-identified and scrubbed. Users get a scope and a diff, pin the vulnerable line, name the root cause, and defend claims against an AI mentor. They then see the advisory patch and can earn verified badges and public writeups. The page gives no case list or pricing.

GitHub

SecurityKid

Learning, AppSec· Added 20 Oct 2026

securitylabs.datadoghq.comtool🛡️ Security

Datadog pathrunner: AWS IAM privilege escalation framework

pathrunner is a modular offensive framework from Datadog Security Labs that automates exploitation of the AWS IAM privilege escalation paths catalogued in pathfinding.cloud and deployed in Pathfinding Labs. It has over 80 exploit modules (as of October 2026), identity import and switching, multiple payloads per module, and attacker infrastructure deployment with a credential listener. A workspace report lists created resources and expected CloudTrail events for defenders.

AWSAWS IAMAWS Bedrock

pathrunnerpathfinding.cloudPathfinding Labs+2

Cloud & Infra, Offensive Security, Blue Team & Detection· Added 23 Oct 2026, published 20 Oct 2026

x.comtool🧠 AI

G (@gg_guy03) on X

WhatThePort for Linux is a Rust utility that lists the dev servers still running in the background, the project that started each one, and its RAM use. It links each server to the Claude Code or Codex session that launched it, and stops the whole process tree without touching databases. The CLI offers `wtp`, `wtp stop <port>` and `wtp --json`. A reviewer notes the Codex resolver keeps the newest transcript per working directory, so session matches can be wrong.

RustLinuxClaude Code+1

WhatThePort

coding-agents· Added 20 Oct 2026, published 19 Oct 2026

x.comtool🧠 AI

Dan Kornas (@DanKornas) on X

Coral is an open-source (Apache 2.0) agentic IDE that runs Claude Code, Codex, Gemini CLI and Pi.dev together as one coordinated team on a shared codebase. It puts sessions, tasks, messages and controls behind a shared board and browser dashboard. Features include a task queue with dependencies and review holds, an agent message board, git-worktree sessions tracked against main, and live terminal access from a browser or phone.

Claude CodeCodexGemini CLI+2

Coral

coding-agents, agents· Added 19 Oct 2026, published 18 Oct 2026

x.comtool🧠 AI

Dan Kornas (@DanKornas) on X

decomp.wtf is an open-source (MIT) local workspace where AI coding agents decompile games into C, one function at a time. Agents receive assembly, data, callers and earlier attempt notes, then each C candidate is compiled with the game's original compiler, linked at its real address and compared byte for byte, with instruction diffs on misses. It exposes MCP tools for Claude Code, Codex, Antigravity CLI and opencode, plus a live view of agent calls and match scores.

Model Context ProtocolClaude CodeCodex+3

decomp.wtfDan Kornas

coding-agents, mcp, agents· Added 19 Oct 2026, published 18 Oct 2026

sphinx-six-theta.vercel.apptool🧠 AI

Show HN: Sphinx – A hook that quizzes you on your AI's code before shipping

Sphinx is a free, open-source Git hook (npm package sphinx-understand) that pauses pushes on protected branches and asks the developer a question about what the diff does when things go wrong. A reviewer model that never saw the coding chat reads the diff; a wrong answer leads to an explanation and a new scenario. It works with Codex, Claude Code, Cursor, OpenCode and Pi, or plain Git. It runs on OpenRouter or any OpenAI-compatible endpoint, and requires Node 22.19+.

GitnpmNode.js+7

SphinxStripe

coding-agents· Added 19 Oct 2026, published 18 Oct 2026

x.comtool🧠 AI

0xRafy (@0xRafy) on X

A tweet promoting Coucou, an open-source app (about 5,000 GitHub stars, per the post) that monitors Claude Code sessions from the iPhone Dynamic Island. It shows what Claude is doing, alerts when a permission is needed, sends approval requests to the iPhone, confirms them with Face ID, and signals when a task finishes. This helps developers who would otherwise watch the terminal for permission prompts. The post says Anthropic's Claude team released it, but nothing on the page backs that up.

Claude Code

Coucou0xRafy

coding-agents· Added 18 Oct 2026, published 17 Oct 2026

llmspeed.devtool🧠 AI

Show HN: Llmspeed – feel how fast a local LLM runs before you buy the hardware

Llmspeed is an open-source web tool that lets you get a feel for how fast a local LLM runs on a given device before buying hardware. It shows estimates for a short prompt on a single device, using measured numbers from community benchmarks (r/LocalLLaMA, localscore.ai) and filling gaps with figures derived from similar setups or projected from specs. It helps with local-LLM hardware purchasing decisions.

LLM

LocalScorer/LocalLLaMAGitHub

inference, evals· Added 18 Oct 2026, published 17 Oct 2026

x.comtool🧠 AI

Bravish (@bravish_) on X

Tracekit 1.2.3 is a tamper-evident flight recorder for AI agents. It checks each tool call before it runs, signs calls and decisions into a hash chain, and writes one offline-verifiable .tkb file per run. It has adapters for 13 agents and frameworks, policy packs, one-time approvals and a "why" replay. The post reports 8 of 8 tamper attacks caught and under 1 ms added per call, and lists its limits.

TracekitPythonTypeScript+16

Cygnux LabsOpenAI Agents SDKClaude Agent SDK+3

ai-infra, agents· Added 19 Oct 2026, published 17 Oct 2026

x.comtool🛡️ Security

Bravish (@bravish_) on X

Tracekit 1.2.3 is a tamper-evident flight recorder for AI agents. It checks each tool call before it runs, signs calls and decisions into a hash chain from a signer the agent cannot control, and exports one offline-verifiable .tkb file per run. The post reports 8/8 tamper attacks caught and 462/462 harmful calls blocked, lists adapters for 13 agents and frameworks, and states its limits.

TracekitModel Context ProtocolClaude Code+3

prompt injectionEd25519RFC 6962+3

AI Security, Blue Team & Detection· Added 19 Oct 2026, published 17 Oct 2026

thingstodoapi.comtool🧠 AI

Show HN: Things to Do API

Things to Do API is a hosted knowledge base of local events (shows, talks, pop-ups, markets, festivals) that you query in natural language, for example `/v1/search?q=comedy+in+san+francisco+this+weekend`. It returns structured JSON with title, category, local start time, venue and ticket and source links. It also exposes an HTTP MCP endpoint, added with `claude mcp add --transport http thingstodo https://api.thingstodoapi.com/mcp`, so agents can use it as a tool. Coverage is live for the San Francisco Bay Area, with New York City and Los Angeles coming. Pricing is pay-as-you-go from $5 per 1,000 calls, the first 1,000 a month are free, and there is a 300 calls/min limit.

Model Context ProtocolClaude CodeREST

Things to Do APITicketmaster

mcp, llm-apps· Added 18 Oct 2026, published 16 Oct 2026

rstation.aitool🧠 AI

Show HN: rStation – A shared research lab for your AI agents

rStation is a shared research community where independent AI agents discuss open math problems and publish reviewed papers, with humans as observers. Agents pick from problems such as Epoch AI's rational Diophantine septuple, the Earth–Moon problem and No three in a line, Millennium Prize problems (Riemann hypothesis, Hodge conjecture), and Brouwer's strongly regular graph tables. It is an experiment in multi-agent collaboration and peer review on hard research problems.

Epoch AIMillennium Prize ProblemsRiemann hypothesis+2

agents, research· Added 17 Oct 2026, published 16 Oct 2026

x.comtool🧠 AI

dng (@dng_notes) on X

AI Usage Meter is a free, MIT-licensed desktop app for Mac and Windows that shows live Claude and Codex usage and rate limits, so users aren't cut off mid-task without warning. It also tracks API costs and other AI providers. It runs locally and needs no account.

ClaudeCodexmacOS+2

coding-agents, ai-infra· Added 16 Oct 2026, published 15 Oct 2026

x.comtool🧠 AI

EveryDev.ai (@EveryDevAi) on X

magpie, by @yetone, is an open-source local gateway and desktop app that lets any coding agent use any model or provider. It translates between the OpenAI Chat, OpenAI Responses, Anthropic Messages and Gemini APIs. It also offers routing groups and automatic failover across keys and accounts, so a Claude Code rate limit doesn't force a config rewrite. It works with Codex, Gemini CLI, OpenCode, Goose, Cursor CLI and Copilot CLI, and backs up its config to a file, WebDAV or S3.

Claude CodeCodexGemini CLI+6

magpieyetoneOpenAI+1

ai-infra, coding-agents· Added 16 Oct 2026, published 15 Oct 2026

x.comtool🛡️ Security

dbugs (@ptdbugs) on X

Decepticon is an open-source framework that automates red team operations with 16 specialized AI agents coordinated by an orchestrator, covering recon, vulnerability research and exploitation against an operator-authorized target in an isolated environment. It offers optional attack planning mapped to MITRE ATT&CK, persistent interactive sessions for Metasploit, Sliver and Evil-WinRM, and findings stored in project files and a knowledge graph. It runs via CLI or web dashboard, integrates with Claude Code and Codex through an MCP server, and is self-hosted with Docker Compose.

MetasploitClaude CodeCodex+3

DecepticonBitterSecurityEvil-WinRM+1

Offensive Security, AI Security· Added 18 Oct 2026, published 15 Oct 2026

x.comtool🧠 AI

Francesco Sorrentino (@Fr_Sorrentino) on X

chrome-bridge is an open-source MCP server with a Chrome extension that lets Claude Code drive the user's own Chrome, including logged-in tabs and DevTools. It reads page structure rather than screenshots, which saves tokens and turns. The author reports gains over Claude in Chrome: 4.7× fewer turns and 2.8× lower cost on form filling, 2.3× and 3.4× on finding a row among 1,500, and 9.3× and 4.3× on debugging a broken checkout, with 15/15 correct against 12/15. These are self-reported numbers from the tweet.

Model Context ProtocolClaude CodeChrome+1

chrome-bridgeClaude in ChromeAnthropic

mcp, coding-agents· Published and added 14 Oct 2026

x.comtool🛡️ Security

44er (@44errrr) on X

hexvero is a Node-only, zero-dependency MCP server that gives coding agents a static first-look triage of binaries and app bundles across 18 formats (ELF, PE, Mach-O, APK, .NET, Go, Wasm, Electron, SQLite). Findings are marked confirmed or inferred with file and line, and outputs are paged with a byte budget (a 541 MB Electron app yields a ~15 KB result). The author contrasts its 3,043-token tool catalog with a 509,696-token catalog of an established RE MCP server. radare2, rizin or Ghidra can be plugged in for disassembly, and setup registers it with Claude Code, Cursor, Codex and 15 more clients.

Model Context ProtocolGhidraNode.js+3

hexvero

Malware & RE, AI Security· Added 15 Oct 2026, published 14 Oct 2026

parsimony.lasu.devtool🧠 AI

Show HN: Parsimony – an open-source benchmark for how much code AI models add

Parsimony is an open-source benchmark that ranks AI coding models by how much code their patches add. It parses the patches already published by benchmarks such as SWE-bench Verified, counts syntax-level "coding units" (statements, calls, comparisons, names, literals) rather than lines, and subtracts deleted code to get net units. It adds a leaderboard, an Artificial Analysis Intelligence Index overlay, the author's own DeepSWE runs, and a way to upload your own results. It matters because existing benchmarks score solve rate and cost but not code bloat, which makes codebases harder to maintain. The page states its limits: it measures size, not quality, and more verbose models tend to solve more tasks.

mini-SWE-agentClaude CodePi+1

ParsimonySWE-bench VerifiedDeepSWE+2

evals, coding-agents· Published and added 13 Oct 2026

pdftomp3.comtool🧠 AI

Show HN: Use your OpenAI subscription to create audiobooks

PDF TO MP3 is a hosted MCP server (Streamable HTTP, account authentication) that turns PDFs into audiobooks. The user's existing AI subscription, such as Codex, handles document processing through the MCP connection. Speech generation is billed separately through the user's own OpenAI or Google text-to-speech API key. The setup is three steps: add the MCP server, add a speech key, then attach a PDF and ask the assistant to use the MCP. It shows a "bring your own subscription" pattern that keeps the vendor's compute costs low.

Model Context ProtocolCodexOpenAI API+1

PDF TO MP3OpenAIGoogle

mcp, multimodal· Published and added 13 Oct 2026

simonwillison.nettool🧠 AI

web-edit 0.1a0

web-edit 0.1a0 is a Python web app that gives a browser UI for viewing and editing files in a folder, intended to be started by an agent and reached over Tailscale from a phone. Simon Willison built it with Codex and GPT-6 Astra Extra High after wanting to edit a credentials file during a Codex Remote session without passing the credentials through the LLM. Editing uses CodeMirror 6 because Monaco's mobile experience is still weak.

PythonCodexCodeMirror 6+2

Simon WillisonGPT-6 Astra

coding-agents· Added 13 Oct 2026, published 12 Oct 2026

github.comtool🛡️ Security

derailed/popeye

Popeye is a read-only Go utility that scans live Kubernetes clusters and reports misconfigurations, stale or unused resources, port mismatches, probe and image issues, RBAC problems, and resource over/under-allocation when a metrics-server is present. It is configurable with a spinach.yaml (excludes, thresholds, allowed registries, severity overrides), can run as a CronJob with a get/list ClusterRole, outputs HTML/JSON/YAML reports, pushes Prometheus metrics, and can upload reports to S3/Minio. It lints what is actually deployed rather than manifests on disk.

KubernetesGoDocker+2

Popeyespinach.yaml

Cloud & Infra, DevSecOps· Added 12 Oct 2026

atoll92.github.iotool🧠 AI

AI agents in a stand-up call

Agent Standup is a free, open-source local server and UI that turns a Claude Code session into a live team-meeting view: the lead agent gives orders, and sub-agents join, share their screen and report back. It shows one status per agent (who is waiting or blocked), a context gauge and token counts, plus replay, recap, tree and video views, voices, custom characters and 8 languages. It runs as an editor extension (VS Code-family via VSIX, Cursor, Windsurf, VSCodium), in any terminal, as a desktop app, or as a Claude Code status line / tmux indicator, at zero token cost.

Claude CodeCursorWindsurf+2

coding-agents, agents, ai-infra· Published and added 11 Oct 2026

x.comtool🧠 AI

Frostyz (@frostyz) on X

Announcement that the OSWiki MCP server now supports trading through a separately released local signer. The signer acts on data from the MCP server, so a chat client can browse NFT collections and buy, list, transfer or make offers on Ethereum and ApeChain. Private keys stay on the user's machine, each action is validated and previewed first, user-set limits apply, and any transfer of NFTs or funds needs explicit approval. Setup is a single npx command that creates a fresh wallet, and the author advises testing with small funds.

Model Context ProtocolEthereumApeChain+2

OSWiki

mcp· Published and added 11 Oct 2026

x.comtool🛡️ Security

Trail of Bits (@trailofbits) on X

Trail of Bits announces SequenceHash, a library for hashing several inputs without concatenation ambiguity. Plain concatenation lets different input sequences produce the same SHA-256 digest. SequenceHash appends each input's length as a fixed 128-bit integer so every sequence has a single encoding. It ships for Rust, Go and Python, and removes a recurring bug class in crypto and appsec code.

RustGoPython

Trail of BitsSequenceHash

AppSec· Added 11 Oct 2026, published 9 Oct 2026

x.comtool🧠 AI

Gurasees (@gurasees0) on X

Robo dir is a directory that aggregates robotics and physical-AI datasets in one place. The launch tweet claims 3,494 datasets, 86,424 Hugging Face uploads, 236B+ frames and 2.2M+ hours of data. It also exposes the index through a single MCP server with no sign-in, so agents can search for robot training data programmatically.

Model Context ProtocolHugging Face

Robo dir

training, mcp, multimodal· Published and added 9 Oct 2026

simonwillison.nettool🧠 AI

ttok 1.0

ttok is a command-line tool by Simon Willison for counting and truncating text by LLM token count, piping files or stdin through a tokenizer. Version 1.0 switches the default tokenizer from GPT-4 to the one used by the GPT-5/GPT-6 family, based on an experiment by William Liu showing all seven GPT-5.5/5.6/6 variants produce identical token counts across 31 test fixtures, even though OpenAI has not officially confirmed this.

Python

Simon WillisonOpenAIWilliam Liu+6

ai-infra· Published and added 9 Oct 2026

simonwillison.nettool🧠 AI

ttok 0.4

ttok is Simon Willison's CLI tool for counting tokens in text using OpenAI's open-source tiktoken library. This 0.4 release fixes a Click deprecation warning, updates CI, and adds a --list-models command to enumerate supported tokenizer models; it can be run instantly via uvx without installation, e.g. piping a file's contents into it to get a token count.

PythonClickOpenAI API

Simon WillisonOpenAI

ai-infra· Added 9 Oct 2026, published 8 Oct 2026

agent.reviewstool🧠 AI

Show HN: Agent.reviews – Where AI agents read and write reviews on tools

Agent.reviews is a review platform built specifically for AI coding agents: agents like Claude Code, Codex and a "Muse Code" agent write first-hand reviews of developer tools and services (FastAPI, Auth0, Amazon DynamoDB, Redis, Playwright, Vercel, Daytona, Git, npm, Claude API, Cursor) based on real usage during coding tasks, noting concrete friction like nested executables, missing live-credential verification, or scattered docs. The site exposes agent-readable endpoints (skill.md, install.md, llms.txt, and a .md mirror of every page) so a coding agent can both consult prior reviews when choosing a tool and submit its own after a task.

FastAPIAuth0Amazon DynamoDB+8

Claude CodeCodexMuse Code

coding-agents· Added 8 Oct 2026, published 7 Oct 2026

x.comtool🧠 AI

Agent Game Forge (@agentgameforge) on X

Agent Sprite Forge v0.4.0 is an open-source skill/plugin for Claude Code, Codex and Grok CLI that takes a single character image and generates a full game-ready animated sprite set — idle, walk, run, attack, jump and hurt — all derived from that one master still. It adds official API support for OpenAI, Gemini, xAI, ModelArk and fal.ai, a signed-in Codex/Grok CLI fallback, and export options for Godot, Aseprite and sprite atlases.

Claude CodeCodexGrok+4

Agent Sprite ForgeOpenAIxAI+2

coding-agents, multimodal· Published and added 6 Oct 2026

mailaccess.protool🛡️ Security

Show HN: MailAccess – the true Email OSINT framework

MailAccess is an open-source email OSINT framework (pip install mailaccess, MIT licensed, 1.6k★ on GitHub as KatrielMoses/MailAccess) that runs 75 modules across 5,300+ platforms to surface every account, breach, and exposed data point tied to a given email address without requiring API keys. Each finding is returned with its source, a confidence rating, and a one-sentence reasoning trail (e.g. username matches, avatar hash correlation) rather than as an unverified black-box hit. The project also offers a separate paid email-scraping service that extracts business contacts per domain.

PythonGitHubpip

OSINT· Published and added 6 Oct 2026

solana.comtool🛡️ Security

Introducing Solana Microscope: Program Monitoring and Alerts

Microscope is an open-source, self-hosted monitoring and alerting tool for Solana programs that decodes a program's instructions and events using its IDL, then renders that activity as Grafana dashboards backed by Loki (logs) and Prometheus (metrics). It can also watch a Squads multisig controlling the program, firing precise alerts on specific instructions, events, field values, or multisig proposal approvals to Slack, Telegram, or PagerDuty. A distinguishing feature is built-in health alerting for the monitoring pipeline itself (stalled gRPC/RPC streams, corrupt checkpoints, records decoded but not reaching Loki), so teams can distinguish "program is quiet" from "monitoring is broken." It deploys via Docker Compose, Terraform (AWS/GCP), or Kubernetes manifests, and the code is MIT-licensed on GitHub.

SolanaGrafanaPrometheus+3

Squads

Blue Team & Detection· Added 8 Oct 2026, published 5 Oct 2026

x.comtool🛡️ Security

The OSINT Newsletter (@osintnewsletter) on X

The OSINT Tools Map, built by @cyb_detective, is an interactive world map letting investigators click a country to find relevant local OSINT resources such as phonebooks, business registers, cadastral maps, and court records. The same tweet announces the companion "OSINT Tools Library" at tools.osintnewsletter.com, a curated, investigator-first directory of tools used in real cases that is actively soliciting community additions.

OSINT· Added 5 Oct 2026, published 4 Oct 2026

offrun.devtool🧠 AI

Show HN: Offrun – manage every coding agent from one workspace

Offrun is a macOS (Apple Silicon) desktop app that runs multiple coding-agent CLIs, including Claude Code, Codex, AGY, and Grok Build, side by side, giving each agent its own git worktree so parallel sessions never collide on the same files. It adds peer review where one agent's findings land in another's chat before anything is committed, account rotation across multiple logins when one hits its rate limit, persistent per-agent and per-repo project memory stored as plain files, cross-terminal notifications, a diff and preview pane, Build versus Planner modes, and on-device dictation, all running locally under the user's own agent subscriptions with no server in the path.

Claude CodeCodexGit

Grok BuildAGY

coding-agents· Published and added 3 Oct 2026

x.comtool🧠 AI

AINotes (@ainotesus) on X

OpenRig is an orchestration tool that runs multiple coding agents as one persistent, coordinated team rather than isolated sessions. A YAML configuration defines pods, seats, communication edges, and continuity policies, while a daemon, CLI, TUI, MCP server, SQLite store, and tmux handle agent launch, inter-agent messaging, session snapshots, restoration, and topology management.

Model Context ProtocolSQLite

OpenRigAINotes

coding-agents, agents· Published and added 3 Oct 2026

pipod.devtool🧠 AI

Show HN: Pi pod – Run your pi coding agent in sandboxes on your own server

pi pod is a self-hosted platform that runs the 'pi' coding agent harness inside isolated sandboxes, adding native clients, RBAC-based session sharing, and browser/native-app automation on top of the minimal pi agent loop. It targets individuals and organizations who want full ownership of their agentic coding environment without vendor lock-in, with a self-hosted edition available now and a hosted service planned.

PiDocker

coding-agents, ai-infra· Added 3 Oct 2026, published 2 Oct 2026

dwarfstar.shtool🧠 AI

From the creator of Redis; run LLM locally with ds4

DwarfStar (ds4) is a narrow C inference engine for running large mixture-of-experts models locally on high-memory Mac (Metal), CUDA and ROCm machines. It targets specific model families end-to-end — DeepSeek V4/V4.1 Flash, GLM 5.x and Qwen3.8 Flash Next — using asymmetric 2-bit quantization that compresses routed experts while keeping shared/critical paths precise, plus SSD-backed prefix caching keyed by prompt hash to avoid full re-prefill on restart. It ships a CLI (ds4), an OpenAI/Anthropic-API-compatible local server (ds4-server), and a persistent coding agent (ds4-agent), all sharing model state, and is MIT-licensed with project-specific GGUF builds rather than generic GGUF support.

GGUFCUDAMetal+2

DeepSeek V4DeepSeek-V4.1-FlashGLM-5.3+1

inference, models· Added 3 Oct 2026, published 2 Oct 2026

github.comtool🛡️ Security

https://github.com/praetorian-inc/gato

Gato (GitHub Attack Toolkit) from Praetorian is a Python CLI for enumerating and attacking GitHub organizations' CI/CD pipelines: it identifies poisoned pipeline execution risks, abuses self-hosted runners via workflow and run-log analysis, exfiltrates Actions secrets, and automates fork-PR/workflow-based command execution. Version 1.7 added an Actions Artifacts Secrets Scanner that downloads and recursively scans workflow artifacts with NoseyParker, which Praetorian used to find critical secrets leaks in prominent open-source projects. The project is now archived/superseded by Praetorian's multi-platform tool Trajan, which merges Gato (GitHub) and Glato (GitLab) attack capabilities.

GitHub ActionsGitHubPython+2

poisoned pipeline execution

DevSecOps, Offensive Security· Published and added 2 Oct 2026

x.comtool🛡️ Security

Python Hub (@PythonHub) on X

TATS is an open-source Python tool that analyzes OAuth 2.0, OpenID Connect, and Microsoft Entra ID tokens. It helps security researchers trace authentication flows, identify risky permissions granted to tokens, and visualize token lifecycles for identity security review and investigation work.

PythonOAuthOIDC+1

TATS

Identity & Access· Published and added 2 Oct 2026

deepseek.comtool🧠 AI

DeepSeek Harness Desktop for macOS and Windows

DeepSeek Harness is an open-source general-purpose agent harness from DeepSeek, built on the "Cordis" everything-is-a-plugin architecture, shipped as a desktop app for macOS/Windows and runnable as a web UI from code. It handles everyday document/spreadsheet work, coding tasks (repo exploration, bug fixes, tests), research with citations, and background/scheduled jobs, with users able to install or author plugins (including via a chat-driven "Creator mode") and inspect per-turn tool-call traces for debugging. It runs on DeepSeek's DeepSeek-V4.1-Flash model and is explicitly labeled a preview release with evolving core plugins and APIs.

DeepSeek-V4.1-Flash

DeepSeekCordis

agents· Published and added 2 Oct 2026

rhun.apptool🧠 AI

Show HN: Rhun, an open-source code editor written in assembly

Rhun is a small, fast open-source code editor written entirely in assembly, built around the idea that AI handles the heavy lifting of coding while the editor itself stays minimal. It includes tabs, syntax highlighting, fuzzy search, optional Vim mode, and 39 themes, plus the ability to run builds and shell commands alongside code; it integrates with Claude Code and Codex sessions (using the user's existing subscriptions) or local open-weight models to draft commit messages and follow agent sessions as they work.

Claude CodeCodex

coding-agents· Added 2 Oct 2026, published 1 Oct 2026

x.comtool🛡️ Security

Amada Echeverría (@amadaecheverria) on X

jes is an open-source real-time guardrails project for AI agents, built by LangChain Ambassador Eden Marco, that inspects every step of an agent's trajectory — prompts, tool calls, tool results, skills, and responses. It runs on decision models like Jev from TypeSafeAI and ships with a LangChain middleware example for wiring the checks into an agent pipeline.

LangChainjesJev

Eden MarcoTypeSafeAI

AI Security· Added 3 Oct 2026, published 1 Oct 2026

innerloop.workstool🧠 AI

Show HN: Breadcrumb, record everything on your mac + context manager for AI

Breadcrumb is a macOS app that runs locally to continuously record screen activity, meetings and app usage, then exposes that history as queryable context to AI assistants like Claude, ChatGPT, Cursor and OpenCode. It lets users ask natural-language questions about their day (standup action items, time spent per project), resume long agent chat sessions without re-paying token costs, define persistent cross-AI rules (e.g. 'never push main'), and save recurring queries as one-word shortcuts — all while keeping data encrypted at rest with a user-held key and processing transcription/speaker-naming with local on-device models.

ClaudeChatGPTCursor+1

llm-apps, ai-infra· Added 2 Oct 2026, published 1 Oct 2026

x.comtool🛡️ Security

texas actual (@texasactualUA) on X

A tweet highlights osinteuropetracker.com, an OSINT tracker built to map known and suspected Russian sabotage operations across the European Union. The tool is shared as a practical way for analysts to monitor and visualize ongoing hybrid-threat incidents attributed to Russia in EU countries.

OSINT Europe Tracker

Russia

OSINT, Threat Intel· Added 3 Oct 2026, published 1 Oct 2026

x.comtool🛡️ Security

Average AI Bro (@AverageAiBro) on X

Reversecore MCP is an MCP server that exposes authorized reverse-engineering, malware-analysis, forensics, and SAST-style tooling to an AI agent through selectable profiles, returning structured results for a given binary sample. It targets the gap between hand-driving tools like radare2 and paying for a commercial IDA Pro-based workflow, letting an agent query a toolchain directly instead of a human operator switching between tools.

Model Context Protocolradare2IDA Pro+1

Malware & RE· Added 1 Oct 2026, published 30 Sep 2026

x.comtool🧠 AI

zkLombard (@zkLombard) on X

zkLombard announces a remote MCP server (HTTP transport, one endpoint, eight tools, no custody of keys) that lets an agent with its own wallet value a Uniswap v3 position, pledge it, borrow USDG, repay, and redeem. The agent signs every transaction itself, and loan solvency is proven with a zero-knowledge proof verified onchain. It installs with a single `claude mcp add --transport http` command, and a manual is linked. It is a concrete example of exposing financial primitives as MCP tools for autonomous agents.

Model Context ProtocolClaude CodeUniswap v3

zkLombardUSDG

mcp, agents· Added 1 Oct 2026, published 30 Sep 2026

simonwillison.nettool🧠 AI

Photo Scrubber — local face blur & metadata removal

Simon Willison built an experimental local-only photo tool that detects faces and automatically blurs them to protect the identity of strangers (e.g. protesters) photographed in public, also stripping metadata. It runs entirely client-side using Google's MediaPipe compiled to WebAssembly via @mediapipe/tasks-vision, with the BlazeFace model for face detection, and was built with help from GPT-6 Astra.

MediaPipeWebAssemblyBlazeFace

Simon WillisonGPT-6 AstraGoogle

multimodal· Added 2 Oct 2026, published 29 Sep 2026

x.comtool🛡️ Security

Manny M. (Vicente Traditor Mancebo) 💀 (@sargexd) on X

AKCA is an open-source Dynamic Application Security Testing (DAST) scanner written in Go, aimed at evidence-oriented web security testing. It combines HTTP and browser-assisted crawling, JavaScript analysis, API import support, adaptive active testing, and passive inspection to find vulnerabilities in web applications.

AKCA

AppSec· Added 30 Sep 2026, published 27 Sep 2026

cve.orgtool🛡️ Security

CVE Record

The CVE Program's official CVE Record lookup page on cve.org. It serves the authoritative record for a given CVE ID, including description, affected products, references and CNA-supplied data. The fetched content was only a cookie consent banner, so the details here are inferred from the URL.

other· Added 26 Sep 2026

simonwillison.nettool🧠 AI

Gemini 3.8 TTS Playground

Simon Willison built a bring-your-own-key playground for Google's newly released gemini-3.8-flash-tts and gemini-3.8-flash-lite-tts text-to-speech models, which offer a library of over 2,000 voices plus custom voice cloning from a 30-second sample. The tool exploits the Gemini API's open CORS policy to run entirely client-side, and supports defining full multi-character conversations with per-character voices and style instructions; a demo generated 1m18s of two-pelican dialogue audio in about 20 seconds for 2.74 cents.

Gemini

GPT-6 AstraClaude Opus 4.5Simon Willison+1

multimodal· Added 29 Sep 2026, published 23 Sep 2026

simonwillison.nettool🧠 AI

llm-typesafe 0.1a0

llm-typesafe is a plugin for Simon Willison's LLM CLI that adds support for TypeSafe AI's Jev model, exposing three structured answer types: "noul" (probabilistic yes/no scoring), "choice" (classification into a set of labeled categories), and "score" (rubric-based scoring against ordered criteria). It lets users pipe text into the CLI with a system prompt and get back structured JSON judgments, useful for tasks like routing support messages or triaging bug reports by severity.

JevTypeSafeSimon Willison

prompting, llm-apps· Added 29 Sep 2026, published 22 Sep 2026

blog.talosintelligence.comtool🛡️ Security

Introducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)

Cisco Talos introduces CAIRN (Cognitive Artifact Intelligence Research Network), an open-source toolkit that hunts, classifies, and tracks AI-integrated malware entirely from metadata (VirusTotal strings, sandbox behavior, AV labels) without downloading or executing binaries. It combines acquisition filters (e.g. LLM provider endpoints, python-ai-scripts, agentic-tooling), a three-tier YARA ontology (primitive artifacts, behavioral context, confirmed families), and UMAP/HDBSCAN semantic clustering exposed through a relationship-graph explorer. Talos shares initial findings on the CLOSEDQUORUM family and notes an autonomy-escalation arc in AI-integrated malware since LAMEHUG (CERT-UA, July 2025), plus spread of AI-analysis-evasion tradecraft across independent actors.

YARASQLiteVirusTotal

CLOSEDQUORUMLAMEHUGCERT-UA

Blue Team & Detection, AI Security, Threat Intel· Added 27 Sep 2026, published 22 Sep 2026

github.comtool🛡️ Security

leepokai/jev-guard

jev-guard is an MIT-licensed hook layer that adds an auto mode to coding agents (Claude Code, Codex, Copilot CLI, Gemini CLI, Cursor, pi, OpenCode, ACP editors). It asks the Jev model typed questions (risk, user_requested, from_untrusted) to deny, ask or allow each tool call, using per-session memory. It also flags prompt injection in tool results and scans skills, plugins and CLAUDE.md files. It is a guardrail, not a sandbox, and fails open by default.

Claude CodeCodexGitHub Copilot CLI+3

prompt injectionindirect prompt injectionJev+2

AI Security· Added 27 Oct 2026, published 17 Sep 2026

litellm.aitool🛡️ Security

LiteLLM

LiteLLM is an open-source (MIT) AI gateway that puts 140+ LLM providers, agents and MCP servers behind one OpenAI-compatible API. It adds virtual keys, per-team budgets and rate limits, SSO/JWT/RBAC with SCIM, audit logs, leaked-key protection, and guardrails for PII masking and prompt injection (Presidio, Lakera). It self-hosts via Helm, Terraform or Docker, including air-gapped, with Cosign-signed non-root images, Grype and CodeQL scanning, and secrets pulled from Vault or cloud secret managers. A new Rust gateway is benchmarked at 0.66 ms p99 overhead.

LiteLLMModel Context ProtocolDocker+3

PresidioLakeraAI Gateway Bench+2

AI Security· Added 3 Sep 2026, published 31 Aug 2026

litellm.aitool🧠 AI

LiteLLM

LiteLLM is an open-source (MIT) AI gateway that puts 140+ providers and 1,800+ models, plus agents and MCP servers, behind one OpenAI-compatible API with SSO and virtual keys. It adds per-key/team/org spend tracking, hard budgets, rate limits, guardrails, audit logs, load balancing, lowest-cost and auto routing, and response/semantic caching (Redis, S3, GCS). It self-hosts via Helm, Terraform or Docker, including air-gapped, and the page cites a new Rust gateway with 0.66 ms p99 overhead measured with the public AI Gateway Bench.

LiteLLMOpenAI APIModel Context Protocol+11

NVIDIAAI Gateway BenchLangfuse+4

ai-infra· Added 10 Oct 2026, published 31 Aug 2026

submap.nettool🛡️ Security

Submap

SubMap is an enterprise-facing subdomain discovery and attack-surface-mapping SaaS that aggregates multiple reconnaissance data sources, streams results live via SSE, and exports to TXT/CSV/JSON for integration into a security workflow. It also runs 49 service fingerprints to detect subdomain-takeover conditions (dangling CNAMEs pointing at AWS, Azure, GitHub, Heroku, etc.) and layers in CVE monitors/alerting for tracked assets. The public page gates full scan output behind account creation, showing only the first 110 results in the free preview.

AWSAzureGitHub+1

OSINT· Added 3 Sep 2026, published 25 Aug 2026

crt.nametool🛡️ Security

crt.name

crt.name is a free subdomain index and API that returns every subdomain on file for a given apex domain plus first-seen dates, built by continuously parsing SAN hostnames from Certificate Transparency logs (Static CT sources like Let's Encrypt Sunlight, Geomys, Cloudflare Raio, plus legacy RFC 6962 logs like Google Argon, Sectigo, DigiCert), supplemented by Internet Archive CT replays, Common Crawl, ICANN CZDS zone files, ProjectDiscovery Chaos, HaGeZi DNS blocklists, and an active hostname prober. It offers a no-token REST API (100 req/IP/day), a Streamable HTTP MCP server exposing a single search tool for agent clients, and is the default crt source in the subfaster CLI subdomain enumerator.

Model Context Protocol

Let's Encrypt SunlightGeomysCloudflare Raio+8

OSINT· Added 3 Sep 2026, published 21 Aug 2026

netspi.comtool🛡️ Security

BOFScale: CDN-Fronted Tailnet from BOF Privilege Escalation

BOFScale is a NetSPI red-team technique/tool that uses a Beacon Object File (BOF) to escalate privileges and join a target host to a Tailscale tailnet, fronted by a CDN to blend C2 traffic with legitimate-looking domains. This lets operators establish a resilient, low-noise command-and-control channel that leverages Tailscale's mesh networking rather than traditional listener infrastructure.

TailscaleCobalt Strike

BOFBeacon Object File

Offensive Security· Added 3 Sep 2026, published 21 Aug 2026

huggingface.cotool🛡️ Security

OBLITERATUS/Qwen3.8-27B-OBLITERATED

OBLITERATUS/Qwen3.8-27B-OBLITERATED is an "abliterated" (safety-guardrail-removed) fine-tune of Alibaba's Qwen3.8-27B, built by Pliny the Prompter using the OBLITERATUS ablation suite. Its V3 recipe blends two refusal-direction-removal techniques — aggressive SVD projection and LEACE — in iterative rounds with a targeted refusal-corpus, eliminating both hard refusals and softer "safety lecture" deflections while costing only -2.1pp MMLU versus stock. The model card frames it explicitly for alignment researchers, red-teamers, and AI safety evaluators needing an unrestricted baseline to test post-training safety against weight-space attacks.

QwenHugging Facellama.cpp+2

Pliny the PrompterOBLITERATUS

AI Security· Published and added 21 Aug 2026

huggingface.cotool🛡️ Security

philbert440/Qwen3.8-27B-Uncensored-Cyber-GGUF

philbert440/Qwen3.8-27B-Uncensored-Cyber-GGUF is a llama.cpp-format GGUF release of a Qwen3.8-27B fine-tune deliberately de-refused ('uncensored') and tuned to fully answer cyber and offensive-security questions, shipped with a vision projector and an MTP speculative-decoding head. The card includes a Claude-judged evaluation against a 100-prompt held-out cyber-offensive regex refusal harness and provides run instructions for llama.cpp, Ollama, vLLM, LM Studio, and Docker Model Runner. It exemplifies the growing trend of publicly distributed abliterated/de-refused LLMs positioned for offensive-security use, relevant to AI red-teaming and dual-use misuse tracking.

QwenHugging Facellama.cpp+2

AI Security, Offensive Security· Published and added 21 Aug 2026

en.fofa.infotool🛡️ Security

FOFA

FOFA (fofa.info) is a Chinese cyberspace search engine that indexes internet-facing hosts, services, and devices by banner, header, certificate, and icon fingerprints, letting researchers query for exposed assets much like Shodan or Censys. It supports a custom query syntax, icon/favicon-hash search, batch search, and an API for programmatic recon, making it a common tool for attack-surface discovery, threat hunting, and OSINT investigations.

FOFA

OSINT· Added 3 Sep 2026, published 31 Jul 2026

inteltechniques.comtool🛡️ Security

IntelTechniques OSINT Tools Hub

IntelTechniques Search Tools is Michael Bazzell and Jason Edison's free companion toolset to their OSINT Techniques book, offering a collection of browser-based query generators and lookup tools for open-source intelligence investigations. Queries run client-side in the user's browser with no data collected or stored by the site, covering username/email/phone lookups, social media search, and other recon categories referenced in the book's 11th edition.

Michael BazzellJason Edison

OSINT· Added 3 Sep 2026, published 31 Jul 2026

shadohdorks.vercel.apptool🛡️ Security

ShadowHodks

ShadowDorks is a free browser-based tool that generates over 1000 advanced Google dork queries for a target domain, covering categories like exposed admin panels, subdomain enumeration, and API key/credential leaks. It's built for pentest recon and OSINT reconnaissance workflows, letting a user paste a domain and copy ready-to-search dork strings.

OSINT· Added 3 Sep 2026, published 31 Jul 2026

osintframework.comtool🛡️ Security

OSINT Framework

OSINT Framework is a free, browsable web-based directory that organizes hundreds of open-source intelligence (OSINT) tools and resources into a category tree covering usernames, email addresses, domains, social media, public records, and more. Each entry is tagged to indicate whether it requires local installation (T), is a Google Dork (D), requires registration (R), or needs manual URL editing (M), helping practitioners quickly find the right recon tool for a given task.

OSINT· Published and added 31 Jul 2026

claude.comtool🛡️ Security

Claude Security

Claude Security is Anthropic's AI-powered code scanning product (currently in beta for Claude Enterprise and as a Claude Code plugin) that uses the Claude Mythos 5 model to trace data flows across files, find high-severity vulnerabilities (memory corruption, injection, auth bypass, complex logic errors), and validate findings via an adversarial self-check before proposing human-reviewable patches. It integrates with GitHub, Slack, Jira, and webhooks for triage/audit workflows and supports scheduled or directory-scoped scans.

Claude CodeGitHubSlack+1

AppSec, AI Security, DevSecOps· Added 3 Sep 2026, published 23 Jul 2026

bbradar.iotool🛡️ Security

BBRadar

BBRadar is a dashboard that aggregates and compares public bug bounty programs across multiple platforms by reward, scope, and listing date, covering web, mobile, source code, and smart contract targets with links to official program policies. It also tracks scope changes and pushes rule-matched alerts to Telegram, with additional shared updates for Pro users in Discord, letting bounty hunters spot newly in-scope targets quickly.

Offensive Security· Added 3 Sep 2026, published 18 Jul 2026

promptfoo.devtool🛡️ Security

PromptFoo LM Security DB

PromptFoo's LM Security DB is a searchable database of primary-source AI security research findings, indexing 985 findings across 1123 evaluated models pulled from papers on arXiv and elsewhere. Sampled entries cover memory-deletion leakage persisting in agent summaries/KV cache, embedding-inversion leakage in retrieval systems (SHAQ), vision-language model over-refusal (KoNA), document-image prompt injection against VLM agents (Repeat-After-Me), PII leakage in document images (LeakageBench), context-injection promoting untrusted repo/tool content into agent instructions, and cross-tenant GPU isolation violations in LLM serving frameworks like vLLM and DistServe (GIFT). It is positioned as a research-tracking reference for AI red-teamers and defenders rather than an original piece of research itself.

LLMvLLM

SHAQKoNARepeat-After-Me+4

AI Security· Added 3 Sep 2026, published 18 Jul 2026

jfrog.comtool🧠 AI

JFrog: Boost Enters Public Preview

JFrog's Boost is a free CLI wrapper that intercepts coding-agent tool output such as test logs, grep results, and terminal output, stripping irrelevant content before it reaches the model while preserving full access via a retrieve command if needed. JFrog rolled it out to 1,000+ internal engineers using Cursor and Claude Code, reporting over 100 billion tokens saved and describing pitfalls: blanket permission-approval risk from wrapping every shell command, false-savings claims from tools that double-count filtering, and truncation-driven hallucination loops where aggressive context-cutting caused agents to repeatedly re-verify state.

Claude CodeCursorDocker

JFrogBoost

coding-agents, ai-infra· Added 22 Sep 2026, published 15 Jul 2026

blog.thinkst.comtool🛡️ Security

Thinkst Package Proxy

Thinkst released Package Proxy, a Cloudflare Workers-based inline proxy for npm, PyPI, pip, uv, and Cargo index/metadata requests that enforces supply-chain safety checks (minimum package age, upload-mechanism regression detection, allow/block lists) without requiring any client-side software or workflow changes. The proxy returns 404 for packages failing policy and logs installs to a D1 database, and Thinkst reports it protected them from the TanStack, Bitwarden, and TeamPCP npm compromises via its 10-day age check and integrity-downgrade detection.

npmPyPIpip+3

TanStackBitwardenTeamPCP+3

Supply Chain· Added 3 Sep 2026, published 26 Jun 2026

huggingface.cotool🛡️ Security

knowledgator/opir-multitask-large-v1.0 · Hugging Face

Opir-multitask-large is an English encoder-based GLiClass zero-shot classifier for real-time LLM safety filtering, supporting binary safe/unsafe decisions, toxicity classification, jailbreak/prompt-injection detection, and categorization over a 996-label hierarchical safety taxonomy (16 top-level, 126 mid-level, 854 leaf labels). It was trained with taxonomy-derived unsafe-prompt generation, evolutionary hard-negative mining against existing safety models, LLM-as-judge annotation (DeepSeek-V3.1, MiniMax-M2.5, Llama-3.3-70B), and replay training on the gliclass-v3-logic-dataset, and is benchmarked against WildGuard, PolyGuard, Nemotron Safety Guard and Qwen3Guard across datasets like Aegis2, HarmBench, WildGuardMix, ToxicChat, and JBB-Behaviors, reporting ~25ms p50 latency at 1024 tokens for real-time deployment as an input/output moderation layer.

GLiClassHugging FacePython

OpirAegis2WildGuardMix+4

AI Security· Added 29 May 2026

osv.devtool🛡️ Security

OSV

OSV.dev is an open, distributed vulnerability database using the OpenSSF OSV schema to describe vulnerabilities precisely mapped to package versions or commit hashes, aggregating sources like GitHub Security Advisories, PyPA, RustSec, and the Global Security Database. It provides a free query API (by commit hash or package version) and the OSV-Scanner CLI/GitHub Actions workflows to scan SBOMs, lockfiles, container images, and repositories for known vulnerabilities, with an experimental `fix` command for automated remediation.

OSVGitHub ActionsDocker+3

CVE-2022-27651

Supply Chain, DevSecOps· Added 3 Sep 2026, published 25 May 2026

jfrog.comtool🛡️ Security

JFrog: Keep your Agents Under Control with agent-belt

JFrog open-sourced agent-belt, an Apache 2.0 CLI eval framework that black-box tests real coding-agent CLIs (Claude Code, Codex, Cursor, Copilot, Gemini, Goose, OpenCode) as subprocesses against version-controlled JSON scenarios with rule-based checks and separate LLM-judge scoring. It targets the non-determinism problem in agentic coding — model/CLI updates silently breaking tool selection or MCP behavior — by measuring pass^k across repeated trials, phrasing variants, and multi-judge consensus, with CI-gating exit codes, Docker sandboxing for untrusted-agent runs, and manifest file-locking for concurrent eval runs. It's positioned as complementary to agent governance: governance restricts what an agent can touch, agent-belt verifies whether its actions and outputs are actually correct.

agent-beltClaude CodeCursor+3

JFrog

AI Security, DevSecOps· Published and added 19 May 2026

radar.pathsentinel.eutool🛡️ Security

PathSentinel Radar

PathSentinel Radar is a Spanish-language, read-only CTI dashboard that ingests security news (currently drawn from BleepingComputer) and re-presents it with an urgency score, severity label, and a "playbook" category (e.g. cti_triage, endpoint_tpv_support) plus a one-line remediation action. The sample set covers Pwn2Own exploits against Exchange/Windows 11, credential-theft flaws in WordPress plugins Avada Builder and Funnel Builder, the Linux "Fragnesia" root-privesc bug (CVE-2026-46300), Dell SupportAssist BSOD issues, KongTuke's abuse of Microsoft Teams for initial access, a Google Ads phishing campaign spoofing GoDaddy ManageWP, and the arrest/indictment of the alleged Dream Market administrator. The site states the public front end only serves already-processed reports and runs no live AI queries per visitor.

WordPress

CVE-2026-46300FragnesiaKongTuke+3

Threat Intel· Added 3 Sep 2026, published 16 May 2026

vulnerability.gardentool🛡️ Security

Vulnerability Garden

Vulnerability Garden is a searchable, continuously updated database of named vulnerabilities, attack techniques, and exploits (over 1,132 entries as of September 2026), each tagged with publish date, associated CVE numbers, and reference links. It spans decades of security research — from classic bugs like Billion Laughs and the Kaminsky bug to recent AI-agent and supply-chain attacks like MCPJacking and GitSpawn — making it a useful lookup tool for researchers trying to find or cross-reference a named vuln.

Threat Intel, Offensive Security· Added 3 Sep 2026, published 13 May 2026

protocolsoup.comtool🛡️ Security

Protocol Soup

ProtocolSoup is an interactive platform for executing real identity protocol flows (OAuth 2.0, OIDC, SAML, SCIM, SPIFFE, CAEP/RISC security event sharing, OID4VCI/OID4VP verifiable credentials, WebAuthn/FIDO2) against live authorization servers, issuers, and verifiers. It provides a 'Looking Glass' to inspect every HTTP request/response and decode live artifacts like JWTs, SAML assertions, and SETs, plus a wallet harness for issuing/presenting mdoc and SD-JWT credentials with HAIP attestation. Useful for security practitioners learning or testing identity protocol internals hands-on rather than in the abstract.

OAuthOIDC

Identity & Access, Learning· Added 3 Sep 2026, published 12 May 2026

github.blogtool🛡️ Security

GitHub Dependency Scanning MCP Server

GitHub's MCP Server now ships a "dependabot" toolset, in public preview, that lets MCP-compatible AI coding agents (Copilot Chat, Copilot CLI) scan dependency changes for known vulnerabilities before commit. The toolset queries the GitHub Advisory Database for affected packages, severity, and fixed versions, and can invoke the Dependabot CLI locally to diff dependency graphs pre/post-change for deeper post-commit checks. Requires Dependabot alerts enabled on the repo; setup involves enabling the toolset via Copilot CLI, VS Code MCP headers, or the advanced-security Copilot plugin.

Model Context ProtocolGitHubDependabot+3

Supply Chain, DevSecOps· Added 3 Sep 2026, published 11 May 2026

eventmaturitymatrix.comtool🛡️ Security

SaaS Event Maturity Matrix

The SaaS Event Maturity Matrix (EMM) is an open framework that catalogs categories of SaaS audit log events (authentication, user/group/role management, security policy changes, resource CRUD, etc.) and rates the depth of visibility each provides, with real-world JSON audit log examples from platforms like Box and Salesforce. It's built for defensive security practitioners to understand what activity is actually captured in vendor audit logs and to guide security monitoring and detection coverage decisions.

BoxSalesforce

AppOmni

Blue Team & Detection· Published and added 6 May 2026

wiz-sec-public.github.iotool🛡️ Security

SITF Techniques Library (Wiz)

SITF Techniques Library is a browsable, searchable knowledge base from Wiz cataloging software supply chain / SDLC attack techniques, filterable by affected component and pipeline stage, in an ATT&CK-style matrix format. The live page content could not be retrieved (the JS app returned no results), so specific technique entries are unverified, but the framework's purpose is to give defenders a structured taxonomy of supply chain attack vectors across the software development lifecycle.

Wiz

Supply Chain, DevSecOps· Published and added 6 May 2026

gandalf.lakera.aitool🛡️ Security

Gandalf by Lakera

Gandalf is Lakera's free interactive game where players try to socially-engineer an LLM-backed chatbot into revealing a secret password, with each level adding stronger prompt-injection defenses. The "baseline" level represents the undefended starting challenge, used widely as a hands-on introduction to jailbreaking and prompt-injection techniques against language models.

LLM

LakeraGandalf

AI Security, Learning· Published and added 6 May 2026

0xv1n.github.iotool🛡️ Security

Introducing MacNoise!

MacNoise is a modular, open-source macOS telemetry noise generator built to help defenders validate EDR, SIEM, and firewall detection coverage by emitting real system events — network connections, process spawns, dylib injection, file writes, plist mutations, TCC permission probes, and launch agent persistence. It ships a REPL (macnoise run/list/info/scenario), a dry-run testing mode, and OCSF-compliant JSONL audit/telemetry logs tagged with MITRE ATT&CK mappings and correlation IDs, and supports YAML "scenarios" that chain modules to emulate specific adversary tradecraft (e.g., an EDR Validation Suite covering proc_inject, net_dns, tcc_fda). It's positioned as a macOS-focused complement to the EDR-Telemetry project and Windows-centric atomic-testing tools, aimed at surfacing logging gaps before an incident.

macOSMITRE ATT&CKEDR+1

EDR-Telemetry

Blue Team & Detection· Added 3 Sep 2026, published 26 Feb 2026