63 results for “ETW”

Doomformer compiles integer neural networks into ZDoom maps that run in ViZDoom. Voodoo dolls do the arithmetic, and sector light levels and plane heights hold the values. Python reads every value back and compares it with a NumPy integer reference at tolerance 0. It runs MNIST (97.16 % on all 10,000 digits, every pass exact), small transformers, a learning perceptron and a SUBLEQ machine. It is about 23,000 times slower than NumPy on a small MLP.

github.comrepoAdded 30 Oct 2026, published 29 Oct 2026🧠 AI

dontallow is a two-file Swift launchd agent for macOS 15 and later that clicks "Don't Allow" on the "find devices on local networks" prompt. It watches the UserNotificationCenter process through an Accessibility observer, supports pause and allowlist, and can decode the Local Network rule store to show orphaned rows. It explains why Chromium temp-bundle paths make the prompt recur, and gives a PPPC profile route for fleets.

github.comrepoAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

OnKey is a free, MIT-licensed singing trainer for Apple Silicon Macs. After a song ends in Spotify, Apple Music or browser YouTube, it separates the lead vocal with UVR's MDX-Net Karaoke 2, tracks pitch with CREPE and turns it into syllable-level notes with the GAME model. On later plays it scrolls the notes, draws the user's live pitch and scores each line. Analysis runs on-device, and the repo explains the build steps and network requests.

github.comrepoAdded 24 Oct 2026, published 22 Oct 2026🧠 AI

Python Cybersecurity Libraries is a curated GitHub list by Yogsec, shared in a post by cyb_detective. It groups Python libraries by task: network analysis, penetration testing, threat intelligence, reverse engineering and malware analysis, forensics and investigation, web application security, CTF, and machine learning for security. The tweet shows only the category names, not the individual libraries.

x.comrepoAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

grcskills is an MIT-licensed library of 60 SKILL.md files (Agent Skills format) that let coding agents draft and prepare governance, risk and compliance work: scope statements, statements of applicability, risk registers, audit prep, vendor review, policies, privacy, incidents and continuity. Each skill names where the agent must stop so a person decides. Installs are pinned to release tag v2026.10.19.2, and a validator rejects network commands and credential paths.

github.comrepoAdded 20 Oct 2026🛡️ Security

Antirion is an open-source AI gateway shipped as one Rust binary with a built-in admin console. It sits between apps and providers such as OpenAI, Anthropic, Bedrock, Vertex and vLLM, translating between OpenAI, Anthropic, Gemini and Bedrock dialects. It covers routing with fallbacks and circuit breakers, budgets, guardrails, caching, MCP and A2A gateways, SSO, and a benchmark against Bifrost 2.2.4 and LiteLLM 1.103.1.

github.comrepoAdded 21 Oct 2026, published 17 Oct 2026🧠 AI

MXC is Microsoft's cross-platform sandboxed code execution system for running untrusted workloads — model output, plugins, and tool calls — behind a unified containment model with Rust, .NET, and Node SDKs. It offers multiple containment backends (ProcessContainer, Windows Sandbox, LXC, Bubblewrap, Seatbelt, MicroVM/Nanvix, Hyperlight, WSLC) with JSON-based filesystem, network, and UI policies, plus diagnostics like audit mode for building policies from observed access.

github.comrepoAdded 8 Oct 2026🧠 AI

MXC is Microsoft's cross-platform sandboxed code execution system for running untrusted code such as LLM/agent output, plugins, and tools, offering containment backends ranging from OS-native process sandboxes (Windows Sandbox, LXC, Bubblewrap, Seatbelt) to full VMs (Nanvix MicroVM, Hyperlight). It exposes a unified JSON-based policy model for filesystem, network, and UI access controls, with Rust, .NET, and Node SDKs plus diagnostic tooling (audit mode, access-denied logging) to help developers tune containment rules for agentic workloads.

github.comrepoAdded 8 Oct 2026🛡️ Security

jev-ultrafast is an open-source browser automation agent (from Browser Use) that represents each page as an indexed element table and uses a 'TypeSafe' policy to speculatively predict both the next operation (CLICK, TYPE_TEXT, SELECT, SCROLL, WAIT, DONE, BLOCKED) and its target in a single network round trip, only invoking a small LLM (e.g. inception/mercury-2.5 via OpenRouter) to generate text when the operation is TYPE_TEXT. The repo includes a local inspector UI, Chrome automation via a 'Browser Harness' tool, offline tests, and published before/after benchmarks showing a Google Flights search dropping from a median 9.45s to 7.09s and browser protocol calls from 1,092 to 101 across repeated runs.

github.comrepoAdded 6 Oct 2026🧠 AI

Nuvex is a Solana-native verifiable compute and oracle protocol, still pre-mainnet, whose own README documents unresolved security gaps instead of hiding them: its VRF proof verification relies on solana-ecvrf 0.0.1 (RFC 9381 ECVRF-Edwards25519-SHA512-TAI) which has no known audit, max_fee is stored but never actually charged, and VRF fulfillment is first-come among any node meeting the configured stake/heartbeat threshold — meaning an operator who funds several keys at a low minimum stake can selectively pick which randomness output gets used. The deploy-mainnet script is stubbed to exit before any transaction, and unresolved design questions (fee shares, challenge/reject state transitions) are tracked as explicitly blocked ADRs rather than quietly shipped.

github.comrepoPublished and added 2 Oct 2026🛡️ Security

OpenShell is NVIDIA's open-source runtime for safely running fleets of autonomous AI agents: each agent runs in an isolated sandbox where kernel-level controls enforce a declared policy over file access, syscalls, and network connections, and credentials are injected only for approved endpoints rather than exposed to the agent directly. Policy changes are checked with formal verification to flag risky new access (new hosts, new API methods) before they're approved, and the project ships a CLI, gateway, Kubernetes/Helm deployment, and a tutorial running OpenCode against an OpenRouter model.

github.comrepoAdded 1 Oct 2026🛡️ Security

OpenShell is NVIDIA's open-source runtime for running fleets of autonomous AI agents inside isolated sandboxes. Declarative policies cover filesystem, syscall, process and network access. These are enforced at the kernel level, and credentials are injected only into requests bound for approved endpoints. Policy changes are checked with formal verification so risky new access waits for human review. It ships a CLI, a gateway control plane (Helm deployment on Kubernetes), SDKs, extensibility hooks (middleware, interceptors, compute drivers) and installable agent skills, and it can run agents such as OpenCode.

github.comrepoAdded 1 Oct 2026🧠 AI

OpenShell is NVIDIA's open-source runtime for running fleets of autonomous AI agents with restricted, policy-governed access to files, system calls, network, and credentials. It enforces policy at the kernel level inside isolated sandboxes (per-agent, with Docker/Podman/virtualization backends) and uses formal verification to flag risky policy changes — such as an agent gaining a new host or API access with credentials — before they take effect, so changes can wait for human review. It ships a CLI, a gateway control plane, Kubernetes/Helm deployment, and installable agent skills for writing and debugging sandbox policies.

github.comrepoAdded 29 Sep 2026🧠 AI

OpenShell is NVIDIA's open-source runtime for running fleets of autonomous AI agents in isolated sandboxes, enforcing per-agent policies on filesystem, syscall, and network access at the kernel level and injecting credentials only for approved endpoints. Policy changes go through a formal-verification step (an 'advisor'/'prover') that flags newly granted risky access, such as a new host reachable with credentials, before it's applied, and it deploys via Docker/Podman/host virtualization or Kubernetes with Helm.

github.comrepoAdded 29 Sep 2026🛡️ Security

Recat is a local, Bun-based web workspace for reviewing security findings, including ones produced by AI agents such as Hermes, Codex and Claude Code. It reads a folder of finding.json, README and PoC evidence per project, and offers a dashboard by severity, status and asset coverage (web, smart contract, mobile, desktop, network, hardware). It also has filters by vulnerability class, an evidence viewer, JSON and ZIP exports, password-protected access with a censored view, and a SKILL.md reporting skill that lets agents write findings straight to the source folder.

github.comrepoAdded 16 Oct 2026, published 27 Sep 2026🛡️ Security

SAPMAP is a BloodHound-style attack path mapper for SAP landscapes: it discovers SAP systems on a network, maps RFC trust connections, and implements real exploits (10KBLAZE/CVE-2020-6207 gateway trust, CVE-2025-31324 VisualComposer JSP webshell, a described CVE-2026-58240 Message Server rogue-registration flaw, and CVE-2026-31431 root LPE via AF_ALG page-cache patching) to chart lateral movement across ABAP, Java, HANA, and BTP-connected systems. Its AutoPwn mode chains scan → exploit → enrich → propagate across an entire landscape, and it includes an engagement-report generator, SecStore/RSECTAB credential decryption, SSH lateral movement, hash cracking via hashes.com, and a Tier-3 "evasion" module (SAL slot disable, DBTABLOG purge) paired with an extensive, specific blue-team detection guide (SAL/SM20, DBTABLOG gaps, kernel-param diffing, OS/network IOCs) for defenders to catch it.

github.comrepoAdded 26 Sep 2026🛡️ Security

git-pkgs is a Go rewrite of a Ruby tool that adds a git subcommand for tracking dependency changes across a repository's history, indexing manifests/lockfiles from 36+ package managers (npm, RubyGems, Cargo, PyPI, Maven, Composer, Go modules, etc.) into a local SQLite database. Beyond history/blame/diff, it offers supply-chain security commands: `vulns` (OSV-based CVE scanning with SARIF output for GitHub code scanning, plus blame/praise/exposure for remediation metrics), `licenses` (with drift detection and CI-friendly exit codes), `deprecated`, `provenance` (trusted-publishing/attestation checks), `integrity` (lockfile hash drift detection), `maintainers`/`health` (via ecosyste.ms metadata), and `sbom` export in CycloneDX/SPDX. It also supports a dependency-aware `bisect` to find when a vulnerability, license change, or capability (e.g. network access) was introduced, and ships GitHub Actions for CI integration.

github.comrepoAdded 25 Sep 2026🛡️ Security

magpie is a cross-platform menu bar app, TUI and CLI that lets you view and switch the model each installed AI coding agent (Claude Code, Codex, Gemini CLI, OpenCode, Cursor, Copilot CLI, Goose, Pi, etc.) is configured to use, editing each agent's config file surgically without disturbing comments or formatting. It runs a local gateway (127.0.0.1:3425) that translates between OpenAI Chat Completions, OpenAI Responses and Anthropic Messages APIs so every agent can point at one endpoint and use any provider's models, including routing groups that spread requests across multiple keys/subscriptions with configurable routing strategies (smart, order, rotate, usage). It can also reuse existing subscriptions (Claude Code, Codex/ChatGPT, Copilot, Devin, Gemini CLI) as providers for other agents without exposing or copying credentials, and supports encrypted profile backup/restore.

github.comrepoAdded 26 Sep 2026, published 23 Sep 2026🧠 AI

mu is a coding agent built on the pi framework that introduces a "judgment kernel": a small, fast auxiliary model (Jev, a hosted judge, or Laya, a local 322M-parameter model) answers bounded yes/no/choice/score questions at 35 named decision points per turn — deciding what stays in context, whether a tool call is risky, when a turn is done, and what one agent should tell another — so the large working model doesn't spend tokens/attention on bookkeeping. It also ships a "hive" multi-agent mode (2-6 read-only "bees" plus a main editing agent) with an append-only shared board and relation-checking (supersedes/contradicts/supports) between findings, plus a native desktop app with live judgment/board/hive views.

github.comrepoAdded 26 Sep 2026, published 22 Sep 2026🧠 AI

Foremerge is an open-source coordination protocol layered above Git for parallel coding agents (Claude Code, Codex, Cursor). Agents publish semantic intent (scopes like symbol/api/schema) before editing into a shared SQLite store under .git, so Foremerge can detect intent conflicts—like one agent replacing a class another is extending—that Git's text-diff merging would silently miss. It's advisory-only (no file locking), deterministic (no LLM judgment calls), and gates ChangeSet acceptance on Foremerge-run validation rather than agent self-reports.

github.comrepoAdded 26 Sep 2026, published 21 Sep 2026🧠 AI

jev-gateway is a local proxy that sits between coding agents (Codex, Claude Code, OpenCode, Kilo, Gemini CLI, Devin) and their LLM backend, intercepting only the tool-selection decision and routing it to TypeSafe's small, fast "Jev" model instead of the main reasoning model, while forwarding everything else untouched. It supports forced tool_choice, hint-based suggestions (for APIs like Anthropic's that can't force a tool mid-turn), a live dashboard for cost/latency/routing metrics, and a companion benchmark repo (jev-gateway-bench) showing routing helps most on debugging tasks but can hurt some models on feature-building tasks.

github.comrepoAdded 26 Sep 2026, published 18 Sep 2026🧠 AI

Maskit is a local privacy gateway that sits between AI coding tools (Cursor, Claude Code, Codex, ChatGPT, Claude, DeepSeek) and the model provider, automatically redacting sensitive data — API keys, database connection strings, private IPs, PEM keys, JWTs, PII like phone numbers/ID numbers — into placeholders before requests leave the machine, then streams responses back with the placeholders transparently restored. It works as a local reverse proxy (per-protocol ports for OpenAI/Anthropic/DeepSeek) plus a browser extension (Chrome/Edge MV3) that intercepts Fetch/XHR traffic on ChatGPT, Claude and DeepSeek web UIs, including redaction of uploaded Office documents. It also includes a lightweight local ONNX NER model for names/orgs/addresses, placeholder consistency across multi-turn conversations, and passive prompt-injection detection on model replies.

github.comrepoAdded 22 Sep 2026, published 15 Sep 2026🛡️ Security

Cosy (CosyRedactGateway) is a Node.js gateway that sits between programmers' LLM clients and OpenAI or Anthropic APIs. It replaces credentials found in JSON request text with reversible SHA-256-based placeholders, using high-entropy scoring, structured detectors and Gitleaks-compatible rules, and restores them in responses, SSE streams and tool arguments. It runs on Cloudflare Workers, Deno or locally, and documents its limits: auth headers are still forwarded, and misses are possible.

github.comrepoAdded 19 Oct 2026, published 11 Sep 2026🛡️ Security

Headroom is an open-source (Apache 2.0) local compression layer that sits between AI agents and LLM providers, compressing tool outputs, logs, RAG chunks, files and conversation history before they reach the model. It offers a Python/TypeScript library, a drop-in proxy, an `headroom wrap` mode for popular coding agents (Claude Code, Codex, Cursor, Copilot, Aider, etc.), an MCP server, cross-agent shared memory with dedup, and output-token reduction via verbosity steering and effort routing — all running locally with reversible compression (CCR) so originals stay retrievable.

github.comrepoAdded 23 Sep 2026, published 7 Sep 2026🧠 AI

Plamen is an open-source Python orchestrator that drives 18-100 Claude Code or OpenAI Codex CLI agents across 40+ phases to autonomously audit smart contracts (EVM/Solidity, Solana/Anchor, Aptos Move, Sui Move, Soroban, DAML/Canton) and L1 node-client infrastructure (Go/Rust consensus, p2p, mempool code), producing a severity-tiered AUDIT_REPORT.md with verified proof-of-concept exploits for each finding. It integrates MCP servers for Slither, ChromaDB and Solodit, ingests vulnerability corpora from Solodit, DeFiHackLabs and Immunefi to ground findings, and runs a PTY-supervised worker-pool architecture with checkpoint/resume, artifact-based completion gating, and a dedicated L1 mode with consensus-invariant and network-surface depth agents.

github.comrepoPublished and added 7 Sep 2026🛡️ Security

choirboy-prompt is a cross-runtime agent-memory plugin that loads project lore, research indexes, and validated dossiers into agent sessions via SessionStart hooks (Claude Code, Codex) or full plain-text payloads (Kimi, OpenCode, Hermes), so new conversations continue from established project history instead of starting cold. It handles installation across multiple agent apps, migration of project artifacts between checkout locations, and includes a build/verify pipeline (build-context.py, test.sh) for authoring canonical lore files like prompt.md, user.md, and lore.md.

github.comrepoAdded 22 Sep 2026, published 31 Aug 2026🧠 AI

hunt.md is an open, portable Markdown format for writing threat-hunting playbooks as git-diffable documents combining YAML frontmatter with a typed graph of steps — queries, data collection, agent reasoning, human review, and response. The reference tool huntmd validates hunts (checking reachability, variable use, agent bounds, gated destructive actions) and converts between hunt.md, Huntbase definitions, OASIS CACAO v2 playbooks, and MISP events, with CACAO round-trip tested against 49 real playbooks from six projects.

github.comrepoAdded 3 Sep 2026, published 17 Aug 2026🛡️ Security

A curated GitHub list covering the full Android reverse engineering toolchain: decompilers (JADX, Apktool, Ghidra, IDA Pro), dynamic instrumentation (Frida, Objection, FriDump, jnitrace), deobfuscation tools (Simplify, Obfu[DE]scate, deoptfuscator), network interception (Burp Suite, MITMProxy, SSLsplit), anti-tamper/root-detection bypass tooling, and malware analysis frameworks (MobSF, Quark Engine, Cuckoo Droid). It also links training courses (Maddie Stone's RE training, Azeria Labs ARM assembly), books (Android Hacker's Handbook, Android Security Internals), and CTF/practice targets (UnCrackable Mobile Apps, KGB Messenger, Flare-On).

github.comrepoPublished and added 5 Aug 2026🛡️ Security

QM is an MIT-licensed, self-hosted "multiplayer" agent harness that lets a company deploy a shared coding/ops agent across Slack and a web app, with per-person and per-room isolated sandboxes, memory, keychains, permissions, and crons. Its security model centers on an org-wide posture (Strict pauses every tool call for approval; Auto blocks private-network access and applies optional content screening; Dangerous disables both) layered under a predeclared command policy that hard-denies things like recursive deletes, plus an explicit Isolated/Open sharing posture that governs cross-scope memory and file access with provenance labeling and audit trails. It supports pluggable harnesses (Pi, OpenCode, Codex, Claude Code) behind a common core and documents its threat model and operator assumptions in SECURITY.md.

github.comrepoAdded 3 Sep 2026, published 1 Aug 2026🛡️ Security

Awesome Malware Analysis is a curated GitHub list aggregating hundreds of tools and resources across the malware analysis lifecycle: honeypots (Cowrie, Dionaea, Conpot), sample repositories (VirusShare, Malshare, theZoo, VX Underground), IOC/threat-intel platforms (MISP, YARA, ThreatCrowd, URLhaus), online sandboxes (VirusTotal, Cuckoo Sandbox, Hybrid Analysis, any.run), static/dynamic RE tools (IDA Pro, Ghidra, Radare2, x64dbg, angr), deobfuscation utilities, network traffic analyzers (Wireshark, Bro, mitmproxy), and memory forensics frameworks (Volatility, Rekall). It also links essential books, blogs, and training material (Practical Malware Analysis, REMnux, FLARE VM) making it a de facto index for the malware analysis community.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

Flowsint is an open-source, self-hosted OSINT investigation platform that lets analysts visually explore relationships between entities (domains, IPs, ASNs, individuals, organizations, crypto wallets, emails, phones) via a graph interface backed by automated enrichers. It integrates recon modules like reverse/forward DNS resolution, WHOIS, subdomain discovery, ASN/CIDR mapping, breach-database checks, Maigret username search, and crypto wallet transaction/NFT lookups, storing all data locally for investigation privacy. The deployment docs also cover hardening steps for network exposure, including rotating AUTH_SECRET and MASTER_VAULT_KEY, binding backend services (PostgreSQL, Redis, Neo4j, API) to localhost, and a host-header allowlist to defend against DNS rebinding.

github.comrepoAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Sherlock is a command-line OSINT tool that checks over 400 social networks for the existence of a given username, outputting results to text, CSV, or XLSX files. It supports proxying, JSON-based site definitions, NSFW site inclusion, and browsing found accounts directly, making it a staple recon tool for investigators, red teamers, and social engineering research.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

OpenOSINT is a Python OSINT agent that wraps 20 investigation tools (holehe for email enumeration, sherlock for username lookup, sublist3r for subdomain enumeration, phoneinfoga for phone intel, plus HaveIBeenPwned, Shodan, VirusTotal, Censys, AbuseIPDB, IP2Location, DNS/SPF/DMARC checks, GitHub, and Bright Data-powered dorking/scraping) behind a natural-language AI interface that issues deterministic tool calls so findings can't be hallucinated. It ships as a REPL, CLI, MCP server (usable from Claude Code/Desktop, Cursor, Windsurf), or browser web UI, with an optional additive FollowTheMoney entity graph for correlating findings and pivoting between investigation results, plus documented reverse-proxy/credential-handling behavior for remote deployments.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

PhishDestroy's shortdot-evidence is a daily-updated GitHub investigation into ShortDot SA, the Luxembourg registry operator behind the .icu, .bond, .cyou, .sbs, .cfd, .buzz and .qpon gTLDs, documenting that 51,985+ tracked domains impersonate brands like Chase, Binance, MetaMask and Ledger and that ~70% of registered domains in these zones carry no DNS records (metric-padding rather than legitimate use). It publishes machine-generated IOC/blocklist files and analytics built from a per-TLD zone-file pull cross-referenced against Spamhaus DBL, SURBL, OpenPhish, URLhaus, PhishTank and AlienVault OTX, and ties the zones to concrete criminal cases (FBI's LabHost domain list, Google v. DOES/Yucheng Chang RICO suits, the Revolver Rabbit XLoader/Formbook C2 campaign using 500k+ .bond domains). It also details structural conflicts of interest between ShortDot, its registry infrastructure provider Team Internet Group/CentralNic, registrar partner NameSilo, and the brand-protection vendor NameBlock, backed by Interisle Consulting Group phishing-volume statistics.

github.comrepoPublished and added 25 Jul 2026🛡️ Security

Spectre is a free, open-source Android app (min API 31) for observing and interacting with the surrounding wireless environment, combining passive monitoring of Bluetooth LE, Wi-Fi, cellular (2G-5G), and GNSS with a growing set of pentesting tools. Notable features include a BLE GATT inspector that can read/write characteristics on connected devices, a local-network scanner (TCP-connect host discovery, SSDP/UPnP, mDNS/DNS-SD, banner grabbing, reverse DNS), iBeacon broadcast spoofing, and a computed aggregate RF-exposure figure derived by correctly summing per-emitter power in linear watts rather than dBm. It also documents Android platform limitations affecting wireless recon, such as invisible 5G NSA signal, Wi-Fi scan throttling, and single-carrier cell visibility.

github.comrepoPublished and added 23 Jul 2026🛡️ Security

LSPromise is a GitHub repo and detailed writeup documenting a complete Android privilege-escalation exploit chain from an untrusted local app to root/kernel, with no memory corruption required. It chains a logic bug in Telecom's InCallController.java (CVE-2026-49881) that lets arbitrary code run inside system_server, pivots via ActivityManager reflection into com.android.networkstack to reach the DirtyFrag kernel 1-day (CVE-2026-43500/CVE-2026-43284), and then uses a DirtyPipe-style binary-patching technique (crash_dump, modprobe, vendor_file labeled kernel module) to disable SELinux and launch KernelSU with root. Tested on Pixel 10 running Android 17; the first bug was fixed in the September 2026 security bulletin.

github.comrepoAdded 2 Oct 2026, published 23 Jul 2026🛡️ Security

Gibson is a Rust-based network monitoring toolkit with a lightweight agent, server, and parser that maps process-to-network connections, detects cloud provider ownership (AWS/Azure/GCP/Cloudflare), flags beaconing candidates and EOL OS risk, and auto-generates iptables/Windows firewall rules. It supports AES-256-GCM encrypted uploads, ASN/ARIN-based IP ownership lookups, and SQL/JSON report exports for cross-host threat hunting.

github.comrepoPublished and added 22 Jul 2026🛡️ Security

Yolorouter is a free, self-hosted, single-binary LLM gateway that translates between the four major chat wire protocols — OpenAI Chat Completions, OpenAI Responses, Anthropic Messages, and Gemini generateContent — so a client built for one provider (e.g. Claude Code) can be pointed at any other. It adds multi-provider failover, round-robin upstream API key pooling with rate-limit/quota handling, per-key budgets and access control, a multi-user admin console with OAuth2/OIDC SSO, and native image/video generation support for OpenAI-shaped and non-OpenAI-shaped providers (DashScope, Volcengine Ark, Kling, MiniMax). It also ships cost-optimization features — deterministic system-prompt injection and tool-output compression for coding agents — backed by a published benchmark, plus built-in usage/cost observability.

github.comrepoAdded 2 Oct 2026, published 21 Jul 2026🧠 AI

A curated, verified awesome-list of AI-powered tools for smart contract and blockchain security, covering autonomous auditor agents (Hound, Plamen, Aether, SolidityGuard), commercial AI audit platforms (Sherlock AI, Cantina Apex, Zellic V12, Nethermind AuditAgent), MCP-based auditing plugins (Trail of Bits Skills, Claudit, Slither MCP, Solodit MCP Server), real-time on-chain ML monitoring (Forta Network, AnChain.AI), and benchmark/training datasets (EVMbench, SCONE-bench, ScaBench, SmartBugs). Every entry requires a real AI/ML/LLM component plus a specific Web3 security focus, with open-source entries needing 25+ GitHub stars, positioning it as a practical index for the emerging AI-driven smart-contract-audit tooling ecosystem.

github.comrepoAdded 3 Sep 2026, published 18 Jul 2026🛡️ Security

OpenNVR is a self-hosted, Docker-deployed network video recorder for ONVIF/RTSP IP cameras that is explicitly designed around a "sovereign, air-gapped by default" security architecture: network isolation between camera/gateway/analytics planes, Fernet-encrypted credentials at rest, RTSPS transport, and two default-deny gates (DEPLOYMENT_MODE=offline, AI_SOVEREIGNTY=local_only) that keep cloud and AI egress returning HTTP 403 until explicitly opened. It's positioned as a response to systemic IP-camera weaknesses (default creds, hard-coded keys, unsigned firmware, vendor cloud aggregation) exploited historically by the Mirai botnet and the 2021 Verkada camera-feed breach, and targets regulated buyers newly barred from Hikvision/Dahua/Uniview/Edimax-class vendors under NDAA §889 and 2025-26 FCC enforcement. Its pluggable AI Adapter Contract (Apache-2.0 SDK) lets third parties add detection/LLM capabilities out-of-tree, with correlation-ID audit trails and SHA-256 model fingerprinting for compliance evidence.

github.comrepoPublished and added 18 Jul 2026🛡️ Security

A GitHub repository (also published as a GitBook) of study notes compiled while pursuing the Hack The Box CPTS certification, structured to double as OSCP prep material. It covers networking fundamentals, enumeration, privilege escalation, Active Directory attacks, and pivoting with hands-on methodologies and tool usage rather than just theory.

github.comrepoAdded 3 Sep 2026, published 18 Jul 2026🛡️ Security

A GitHub repository compiling personal study notes and cheatsheets for HackTheBox's CPTS (Certified Penetration Testing Specialist) certification, organized by module: network enumeration (Nmap), web footprinting, file transfers, shells/payloads, Metasploit, password attacks, pivoting/tunnelling, Active Directory enumeration and attacks, web app attacks (SQLi, SQLMap, XSS, LFI, file upload, command injection, Ffuf), and Linux/Windows privilege escalation. It functions as a reference guide mirroring the official HTB Academy course structure rather than original research.

github.comrepoPublished and added 18 Jul 2026🛡️ Security

9router-go is a single-binary Go port of 9Router, an LLM gateway that sits between CLI coding tools (Claude Code, Cursor, Codex, Cline, OpenClaw, Gemini CLI, OpenCode) and 40+ AI providers/100+ models. It adds RTK token compression (claimed 20-40% token savings on tool_result content), tiered auto-fallback (subscription → cheap → free providers), multi-account round-robin, per-key proxy pools, and an embedded Svelte dashboard backed by SQLite, with database compatibility to share state with the original Next.js 9Router. It targets the practical problem of coding-agent subscription quota exhaustion and token cost, not a research contribution.

github.comrepoAdded 7 Oct 2026, published 18 Jul 2026🧠 AI

VulnHunter is Capital One's open-source agentic AI security scanner, implemented as a set of Claude Code skills (/vulnhunt, /vulnhunter-fix, /vulnhunt-fix-verify) that require Claude Opus. Instead of traditional sink-first SAST pattern matching, it reasons forward from attacker-accessible entry points (APIs, uploads, network messages), runs a 'falsification engine' to discard unexploitable findings, and generates evidence-backed exploit paths and targeted code fixes; it also ships a headless agent for CI/CD-scale scanning and a benchmarking harness against corpora like Juice Shop, WebGoat and NodeGoat.

github.comrepoAdded 22 Sep 2026, published 18 Jul 2026🛡️ Security

Skills Janitor is a Claude Code/OpenAI Codex plugin that inventories installed skills, subagents, and MCP servers, then lets users swipe-delete unused or duplicate ones to reclaim context window space. Its janitor-security and janitor-discover commands scan skill contents for known prompt-injection shapes: instruction-override phrases, 'don't tell the user' directives, payloads hidden in HTML comments or zero-width unicode, smuggled base64, and scripts that pipe network output into a shell or read credential stores, citing research that found injection in roughly a third of tested community skills. It also cross-references MCP server configs against real session-transcript usage to flag connected-but-never-called servers whose tool schemas silently consume context on every request.

github.comrepoPublished and added 15 Jul 2026🛡️ Security

NeMo Guardrails is NVIDIAs open-source Python toolkit (nemoguardrails) for adding programmable rails between an application and an LLM, covering input, dialog, retrieval, execution, and output stages. It ships built-in defenses against jailbreaks and prompt injection, self-check fact-checking and hallucination detection, sensitive-data masking, integrations with NVIDIA safety models, ActiveFence and PolicyAI moderation, LangChain, and a Colang DSL for defining conversational flow rails, plus a CLI/server and an evaluation tool for vulnerability scanning against sample bots.

github.comrepoPublished and added 14 Jul 2026🛡️ Security

api-relay-audit is a zero-dependency, locally-run Python security audit tool for AI API relays and LLM proxies that sit between a user and providers like Anthropic or OpenAI. It runs a 14-step check covering hidden prompt injection/extraction, context truncation, model-identity substitution, tool-call/package-command tampering, and SSE stream integrity, producing a reviewable Markdown report with LOW/MEDIUM/HIGH findings (inconclusive results stay visible rather than being marked clean). It also adds a web3 profile for wallet-safety probes (transfer guidance, signed-transaction refusal, private-key refusal) and is distributed as a standalone script, a DeepSeek Harness (DSH) plugin, and OpenClaw/Hermes agent skills.

github.comrepoPublished and added 4 Jul 2026🛡️ Security

Kogaro is a Go-based Kubernetes cluster-hygiene validator that continuously scans clusters (and can run one-off against manifests in CI/CD) for silent configuration failures: dangling references to missing ConfigMaps/Secrets/ServiceAccounts/IngressClasses, insecure pod/container SecurityContexts (root user, privileged mode, missing capabilities drops), missing resource requests/limits, container image/architecture mismatches, and NetworkPolicy coverage gaps. Each finding gets a structured KOGARO-CCC-XXX error code for automated alerting/ticketing, and it exposes Prometheus metrics with leader-election/HA support for production deployment via Helm.

github.comrepoAdded 3 Sep 2026, published 25 Jun 2026🛡️ Security

HexStrike AI is an MCP server that exposes 150+ security tools (Nmap, sqlmap, Ghidra, Metasploit/MSFVenom, Trivy, Nuclei, TruffleHog, etc.) to MCP-compatible AI agents like Claude, GPT, or Copilot, letting them autonomously plan and execute network, web, binary, cloud, and CTF assessments. It ships 12+ specialized agents (BugBounty, CTF Solver, CVE Intelligence, Exploit Generator) that handle tool selection, parameter optimization, and attack-chain discovery, effectively turning an LLM into an autonomous pentest operator. The README includes explicit authorized-use guidance (pentests, bug bounty, CTF, red team) and warnings about the tool's broad system access.

github.comrepoAdded 18 Jun 2026🛡️ Security

Pipelock is an open-source (Apache 2.0 core) AI agent firewall that sits between agents and the network, mediating HTTP, WebSocket, MCP, and A2A traffic to detect secret exfiltration, prompt injection, SSRF, and MCP tool poisoning. It scans request/response bodies with a DLP engine (65 built-in patterns, checksum validation), streaming SSE inspection, and MCP tool-call chain analysis, then emits Ed25519-signed, hash-chained action receipts so decisions can be verified offline outside the agent runtime. It also offers OS-level containment (Landlock/seccomp/sandbox-exec), a kill switch, canary tokens, and integrations for Claude Code, Cursor, VS Code, OpenAI Codex, LangGraph, CrewAI, and other agent frameworks.

github.comrepoPublished and added 14 Jun 2026🛡️ Security

Shannon is an open-source autonomous AI pentester from Keygraph that analyzes application source code to map trust boundaries and attack paths, then uses browser automation and CLI tools to execute real proof-of-concept exploits against the running app before reporting a finding. It only reports vulnerabilities it can actually exploit (injection, XSS, SSRF, broken auth/authz), runs in an ephemeral Docker worker with any AI provider (Anthropic, OpenAI, xAI, AWS Bedrock, Ollama, vLLM, LM Studio, etc.), and ships GitHub Action/GitLab CI integrations that produce PDF/Markdown/JSON/SARIF reports and can gate releases on exploited-severity findings. It's licensed AGPLv3 and positioned to run continuous, code-informed pentests between annual human pentest engagements.

github.comrepoPublished and added 23 May 2026🛡️ Security

OpenCTI is an open source cyber threat intelligence platform for structuring, storing, and visualizing technical (TTPs, observables) and non-technical (attribution, victimology) threat data, built on the STIX2 standard with a GraphQL API and connector framework. It integrates with tools like MISP, TheHive, and MITRE ATT&CK, supports inferred relationships between data points, and offers both an Apache 2.0 Community Edition and a paid Enterprise Edition with additional features.

github.comrepoPublished and added 14 May 2026🛡️ Security

A companion GitOps playbook/repo for building a free, self-hosted "AWS-equivalent" Kubernetes platform from three bare-metal Linux boxes using k3s, Cilium, cert-manager, Traefik, Argo CD, Forgejo, Vault, Keycloak, kube-prometheus-stack, Loki, Kyverno, and Velero. It walks through the full security-relevant stack end to end: OS hardening (SSH lockdown, ufw, fail2ban), Cilium NetworkPolicy as CNI, Let's Encrypt DNS01 wildcard certs, Vault as the source of truth for secrets synced via External Secrets Operator (never committing secrets to Git), Keycloak OIDC for centralized identity across Argo/Grafana/Forgejo/Vault, Kyverno pod-security policies in audit-then-enforce mode, and Velero + Vault Raft snapshot backup/DR with quarterly restore drills. It closes with a candid list of what self-hosting gives up versus managed cloud (CVE patch cadence, DDoS exposure, compliance evidence, etcd/HA operational risk).

github.comrepoAdded 3 Sep 2026, published 13 May 2026🛡️ Security

hack-skills is a GitHub repo (yaklang/hack-skills) that packages offensive security knowledge into installable "Agent Skills" — one master entry, six category entries, and 102 deep-topic SKILL.md files across 14 domains including web/API security, auth, Linux/Windows/macOS privilege escalation, Active Directory attacks, mobile, binary exploitation, reverse engineering, crypto attacks, blockchain/smart contracts, AI/LLM security, network pivoting, and forensics. It's designed for AI coding agents (installed via `npx skills add yaklang/hack-skills` or a raw SKILL.md URL) to use during authorized pentesting, bug bounty, and CTF work, and explicitly strips destructive PoCs (DROP/TRUNCATE, FLUSHALL, service shutdown/DoS) in favor of non-destructive proofs like time-based SQLi and read-only recon, while retaining RCE/webshell/reverse-shell primitives as access proofs.

github.comrepoAdded 3 Sep 2026, published 13 May 2026🛡️ Security

SeldomMonster is a collection of Model Context Protocol servers built for Gemini CLI (but MCP-generic) that wrap free/community cyber threat intel APIs — GreyNoise, Malpedia, OpenCTI, AlienVault OTX, ransomware.live, IBM X-Force, YaraHub, blockchain transaction lookups, and r/netsec/r/blueteamsec feeds — plus a separate set of macOS tools (Nmap as the only third-party dependency) for discovering and hacking devices on the local network. It's a practical toolkit for wiring an LLM agent directly into IOC enrichment, ransomware tracking, and local network recon/exploitation workflows.

github.comrepoPublished and added 12 May 2026🛡️ Security

LuaN1aoAgent v2 is a TypeScript rewrite of an autonomous, authorized security-research agent built on the Pi SDK, splitting work into Planner, Executor, and Observer (Supervisor/Projector) roles that coordinate via a persisted task graph and an evidence-backed reasoning/operation graph. It runs Executors in per-task Docker sandboxes with a protocol-aware Go network Gateway that enforces IP/domain scope, supports CVE/advisory lookups via NVD and web search, browser rendering, and traffic capture/replay through an authenticated web workbench. The project targets authorized pentesting/CTF-style engagements, with explicit scope enforcement, SOCKS5 egress routing, and human-facing observability (TUI + web UI) for tracing hypotheses to confirmed vulnerabilities and exploits.

github.comrepoPublished and added 8 May 2026🛡️ Security

Ethical-Hacking-Labs is a free, practical tutorial/lab collection aligned with CEH study material, walking learners from foundational networking, Linux, and virtualization through footprinting, scanning, enumeration, vulnerability analysis, system hacking, malware, sniffing, social engineering, DoS, and session hijacking, plus a bonus forensics module. It targets complete beginners and requires only a lab VM setup (8GB+ RAM, 80GB disk, virtualization support) to follow along hands-on rather than just reading theory.

github.comrepoPublished and added 8 May 2026🛡️ Security

A collection of drop-in instruction/config files (AGENTS.md, CLAUDE.md, .cursor/rules, .aiignore, etc.) that give AI coding agents a shared security and privacy playbook: never read .env or secrets files, no hardcoded credentials, OWASP hygiene, PII protection, GDPR support, restricted filesystem/network access, no destructive commands without confirmation, mandatory tests, and dependency/CI change controls including typosquatting checks before adding packages. Each tool-specific file (Cursor, Copilot, Windsurf, Cline, Aider, Amazon Q, Junie, Devin, Cody) delegates to one canonical AGENTS.md so teams maintain a single source of truth across all agents in use.

github.comrepoAdded 3 Sep 2026, published 8 May 2026🛡️ Security

ProcMon-MCP is an MCP server that gives AI assistants like Claude direct access to Windows internals: live process enumeration, ETW kernel trace start/stop via logman/tracerpt, static PE import/export analysis with API category tagging, Security event log queries (audit IDs 4688/4624/4672/4648), and service/driver/minifilter enumeration. It's positioned as a POC for security researchers and reverse engineers who want an LLM that can query kernel traces, driver lists, and process memory instead of alt-tabbing to Task Manager or Process Monitor. Several tools (ETW tracing, Security log reads) require administrator privileges and can trigger UAC prompts.

github.comrepoPublished and added 7 May 2026🛡️ Security

NetOrbit is a terminal-based (TUI) tool that uses Scapy to asynchronously capture outbound IPv4 packets and plots them in real time onto a Braille-rendered world map using GeoIP resolution (MaxMind-compatible with IP-API fallback). It requires root for raw-socket capture, filters out local/private/multicast traffic, and shows a live panel of recent connections (IP, country, protocol, size, interface) - a lightweight terminal alternative to a network-monitoring dashboard for spotting where a machine is talking on the internet.

github.comrepoPublished and added 7 May 2026🛡️ Security

IronCurtain is a research-prototype runtime that constrains autonomous AI agents (Claude Code, Goose, or its own builtin agent) by compiling a human-written "constitution" into deterministic policy rules enforced on every MCP tool call. It treats the LLM as untrusted, mediating all filesystem/git/network/API access through a policy engine (allow/deny/escalate), a V8 isolate sandbox for its builtin agent, and a network-isolated Docker mode with a TLS-terminating MITM proxy for external agent tools. It also ships multi-agent workflow orchestration (e.g., a vulnerability-discovery pipeline with libFuzzer/AFL++ fuzzing gates) with human approval checkpoints.

github.comrepoPublished and added 7 May 2026🛡️ Security

A GitHub repo that automates Terraform compliance checks using Checkov and Conftest as policy-as-code scanners, wired into GitHub Actions with OIDC-based AWS authentication for CI/CD. Findings are mapped to specific NIST 800-53 controls — AC-6 (least privilege), SC-7 (network segmentation), SC-13 (encryption), AU-12 (audit generation), and CM-6 (configuration settings) — giving teams an auditable trail linking IaC scan results to compliance requirements.

github.comrepoPublished and added 6 May 2026🛡️ Security

AntiSSRF is a Microsoft-maintained secure code library (Microsoft.Security.AntiSSRF NuGet package, @microsoft/antissrf npm package) that validates URLs and network connections to prevent Server-Side Request Forgery, including an agent that blocks HTTP requests from reaching internal or sensitive IP ranges. It targets the common vulnerability pattern where user-supplied strings (URLs, filenames, workspace names, resource identifiers) are concatenated into server-side requests without validation, which can lead to internal service exposure, data exfiltration, or token theft.

github.comrepoPublished and added 6 May 2026🛡️ Security