29 results for “gh”

kanzo is a local kanban board that coding agents can update. It ships as one 4 MB binary that starts in 2 ms and runs on localhost. It also works as an MCP server, so Claude Code and Codex see the same tasks as the user. The board is stored as a folder that can sync through a private git repo. The post is brief and gives no further detail.

x.comtoolPublished and added 30 Oct 2026🧠 AI

VulnCheck Open Source is an index of VulnCheck's open-source tooling for its vulnerability and exploit intelligence. It lists a Python API client, a CLI, a GitHub Action for CI/CD, go-exploit (a Go exploit framework), an MCP server for delivering intelligence to AI clients, and VulnCheck Insights, a Chrome extension that highlights CVEs, CPEs and PURLs on web pages and enriches them. The page gives only one-line descriptions.

vulncheck.comtoolAdded 29 Oct 2026🛡️ Security

jshook is an open-source (AGPL-3.0) search-first reverse-engineering workspace for AI agents, exposed over MCP. It drives Chromium or Camoufox through CDP, captures WebSocket traffic, offers HTTP, GraphQL and Burp Suite helpers, deobfuscates JavaScript, rebuilds source maps and disassembles WebAssembly. Tool profiles start small and expand to workflow or full sets; hot-reload plugins and declarative workflows extend it.

x.comtoolAdded 28 Oct 2026, published 25 Oct 2026🛡️ Security

Agent Credit v1.3 is a remote MCP server that lets AI agents run credit checks on each other. It has six tools: score, compare, operator record, alerts and on-chain proof check. Calls are paid per use in USDC through x402 with no account or key. It also flags shared wallets, lists every token an operator launched and how each ended, and offers embeddable badges and wallet-signed record claims.

x.comtoolAdded 26 Oct 2026, published 25 Oct 2026🧠 AI

Argus is a free, MIT-licensed, self-hosted security operations platform that maps cloud, identity, code, device, network and Kubernetes assets into one evidence graph and detects fast, AI-driven attacks. Read-only AI agents investigate and only propose actions. Changes go through a broker with approvals, dry runs, automatic rollback and a kill switch. It also has canary traps for AI attackers, an attack simulator, an AI gateway and shadow-AI discovery.

thomasunise.comtoolAdded 25 Oct 2026, published 24 Oct 2026🛡️ Security

Quick Study is a browser artifact built by Claude Opus 5.5 (High) from a single prompt. The user opens a photo and the page repaints it in a few seconds with a simulated paintbrush on a canvas element. Simon Willison links it to an earlier experiment in which Claude Fable simulated a watercolor illustration with P5.js. The post gives the prompt but no code walkthrough.

simonwillison.nettoolPublished and added 23 Oct 2026🧠 AI

Corgi is a terminal multiplexer for humans and AI coding agents, installed with a curl script. It shows each agent's state (working, needs you, finished, idle), keeps agents running in the background like tmux, and tracks token usage, per-workspace resource use and every file an agent changed. It also supports git worktrees, SSH image paste (needs Ghostty Nightly) and a corgi --skill command that teaches agents to drive it.

corgi.computertoolAdded 24 Oct 2026, published 23 Oct 2026🧠 AI

Alter is a privileged access management layer for AI agents (YC S25). It stores credentials in a vault, injects them per request through a proxy, gives each agent its own identity and scoped grants, and logs every call to a tamper-evident audit trail. One SDK call covers storage, refresh, policy and audit for 140 API providers, with LangChain, MCP and AWS integrations. Policy is default-deny down to the parameter, with human approval for risky calls.

alterauth.comtoolAdded 22 Oct 2026, published 21 Oct 2026🧠 AI

Tracekit 1.2.3 is a tamper-evident flight recorder for AI agents. It checks each tool call before it runs, signs calls and decisions into a hash chain, and writes one offline-verifiable .tkb file per run. It has adapters for 13 agents and frameworks, policy packs, one-time approvals and a "why" replay. The post reports 8 of 8 tamper attacks caught and under 1 ms added per call, and lists its limits.

x.comtoolAdded 19 Oct 2026, published 17 Oct 2026🧠 AI

Tracekit 1.2.3 is a tamper-evident flight recorder for AI agents. It checks each tool call before it runs, signs calls and decisions into a hash chain from a signer the agent cannot control, and exports one offline-verifiable .tkb file per run. The post reports 8/8 tamper attacks caught and 462/462 harmful calls blocked, lists adapters for 13 agents and frameworks, and states its limits.

x.comtoolAdded 19 Oct 2026, published 17 Oct 2026🛡️ Security

Decepticon is an open-source framework that automates red team operations with 16 specialized AI agents coordinated by an orchestrator, covering recon, vulnerability research and exploitation against an operator-authorized target in an isolated environment. It offers optional attack planning mapped to MITRE ATT&CK, persistent interactive sessions for Metasploit, Sliver and Evil-WinRM, and findings stored in project files and a knowledge graph. It runs via CLI or web dashboard, integrates with Claude Code and Codex through an MCP server, and is self-hosted with Docker Compose.

x.comtoolAdded 18 Oct 2026, published 15 Oct 2026🛡️ Security

hexvero is a Node-only, zero-dependency MCP server that gives coding agents a static first-look triage of binaries and app bundles across 18 formats (ELF, PE, Mach-O, APK, .NET, Go, Wasm, Electron, SQLite). Findings are marked confirmed or inferred with file and line, and outputs are paged with a byte budget (a 541 MB Electron app yields a ~15 KB result). The author contrasts its 3,043-token tool catalog with a 509,696-token catalog of an established RE MCP server. radare2, rizin or Ghidra can be plugged in for disassembly, and setup registers it with Claude Code, Cursor, Codex and 15 more clients.

x.comtoolAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

PDF TO MP3 is a hosted MCP server (Streamable HTTP, account authentication) that turns PDFs into audiobooks. The user's existing AI subscription, such as Codex, handles document processing through the MCP connection. Speech generation is billed separately through the user's own OpenAI or Google text-to-speech API key. The setup is three steps: add the MCP server, add a speech key, then attach a PDF and ask the assistant to use the MCP. It shows a "bring your own subscription" pattern that keeps the vendor's compute costs low.

pdftomp3.comtoolPublished and added 13 Oct 2026🧠 AI

web-edit 0.1a0 is a Python web app that gives a browser UI for viewing and editing files in a folder, intended to be started by an agent and reached over Tailscale from a phone. Simon Willison built it with Codex and GPT-6 Astra Extra High after wanting to edit a credentials file during a Codex Remote session without passing the credentials through the LLM. Editing uses CodeMirror 6 because Monaco's mobile experience is still weak.

simonwillison.nettoolAdded 13 Oct 2026, published 12 Oct 2026🧠 AI

Announcement that the OSWiki MCP server now supports trading through a separately released local signer. The signer acts on data from the MCP server, so a chat client can browse NFT collections and buy, list, transfer or make offers on Ethereum and ApeChain. Private keys stay on the user's machine, each action is validated and previewed first, user-set limits apply, and any transfer of NFTs or funds needs explicit approval. Setup is a single npx command that creates a fresh wallet, and the author advises testing with small funds.

x.comtoolPublished and added 11 Oct 2026🧠 AI

Robo dir is a directory that aggregates robotics and physical-AI datasets in one place. The launch tweet claims 3,494 datasets, 86,424 Hugging Face uploads, 236B+ frames and 2.2M+ hours of data. It also exposes the index through a single MCP server with no sign-in, so agents can search for robot training data programmatically.

x.comtoolPublished and added 9 Oct 2026🧠 AI

ttok is a command-line tool by Simon Willison for counting and truncating text by LLM token count, piping files or stdin through a tokenizer. Version 1.0 switches the default tokenizer from GPT-4 to the one used by the GPT-5/GPT-6 family, based on an experiment by William Liu showing all seven GPT-5.5/5.6/6 variants produce identical token counts across 31 test fixtures, even though OpenAI has not officially confirmed this.

simonwillison.nettoolPublished and added 9 Oct 2026🧠 AI

Agent.reviews is a review platform built specifically for AI coding agents: agents like Claude Code, Codex and a "Muse Code" agent write first-hand reviews of developer tools and services (FastAPI, Auth0, Amazon DynamoDB, Redis, Playwright, Vercel, Daytona, Git, npm, Claude API, Cursor) based on real usage during coding tasks, noting concrete friction like nested executables, missing live-credential verification, or scattered docs. The site exposes agent-readable endpoints (skill.md, install.md, llms.txt, and a .md mirror of every page) so a coding agent can both consult prior reviews when choosing a tool and submit its own after a task.

agent.reviewstoolAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

DwarfStar (ds4) is a narrow C inference engine for running large mixture-of-experts models locally on high-memory Mac (Metal), CUDA and ROCm machines. It targets specific model families end-to-end — DeepSeek V4/V4.1 Flash, GLM 5.x and Qwen3.8 Flash Next — using asymmetric 2-bit quantization that compresses routed experts while keeping shared/critical paths precise, plus SSD-backed prefix caching keyed by prompt hash to avoid full re-prefill on restart. It ships a CLI (ds4), an OpenAI/Anthropic-API-compatible local server (ds4-server), and a persistent coding agent (ds4-agent), all sharing model state, and is MIT-licensed with project-specific GGUF builds rather than generic GGUF support.

dwarfstar.shtoolAdded 3 Oct 2026, published 2 Oct 2026🧠 AI

Rhun is a small, fast open-source code editor written entirely in assembly, built around the idea that AI handles the heavy lifting of coding while the editor itself stays minimal. It includes tabs, syntax highlighting, fuzzy search, optional Vim mode, and 39 themes, plus the ability to run builds and shell commands alongside code; it integrates with Claude Code and Codex sessions (using the user's existing subscriptions) or local open-weight models to draft commit messages and follow agent sessions as they work.

rhun.apptoolAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

A tweet highlights osinteuropetracker.com, an OSINT tracker built to map known and suspected Russian sabotage operations across the European Union. The tool is shared as a practical way for analysts to monitor and visualize ongoing hybrid-threat incidents attributed to Russia in EU countries.

x.comtoolAdded 3 Oct 2026, published 1 Oct 2026🛡️ Security

Reversecore MCP is an MCP server that exposes authorized reverse-engineering, malware-analysis, forensics, and SAST-style tooling to an AI agent through selectable profiles, returning structured results for a given binary sample. It targets the gap between hand-driving tools like radare2 and paying for a commercial IDA Pro-based workflow, letting an agent query a toolchain directly instead of a human operator switching between tools.

x.comtoolAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

zkLombard announces a remote MCP server (HTTP transport, one endpoint, eight tools, no custody of keys) that lets an agent with its own wallet value a Uniswap v3 position, pledge it, borrow USDG, repay, and redeem. The agent signs every transaction itself, and loan solvency is proven with a zero-knowledge proof verified onchain. It installs with a single `claude mcp add --transport http` command, and a manual is linked. It is a concrete example of exposing financial primitives as MCP tools for autonomous agents.

x.comtoolAdded 1 Oct 2026, published 30 Sep 2026🧠 AI

Cisco Talos introduces CAIRN (Cognitive Artifact Intelligence Research Network), an open-source toolkit that hunts, classifies, and tracks AI-integrated malware entirely from metadata (VirusTotal strings, sandbox behavior, AV labels) without downloading or executing binaries. It combines acquisition filters (e.g. LLM provider endpoints, python-ai-scripts, agentic-tooling), a three-tier YARA ontology (primitive artifacts, behavioral context, confirmed families), and UMAP/HDBSCAN semantic clustering exposed through a relationship-graph explorer. Talos shares initial findings on the CLOSEDQUORUM family and notes an autonomy-escalation arc in AI-integrated malware since LAMEHUG (CERT-UA, July 2025), plus spread of AI-analysis-evasion tradecraft across independent actors.

blog.talosintelligence.comtoolAdded 27 Sep 2026, published 22 Sep 2026🛡️ Security

crt.name is a free subdomain index and API that returns every subdomain on file for a given apex domain plus first-seen dates, built by continuously parsing SAN hostnames from Certificate Transparency logs (Static CT sources like Let's Encrypt Sunlight, Geomys, Cloudflare Raio, plus legacy RFC 6962 logs like Google Argon, Sectigo, DigiCert), supplemented by Internet Archive CT replays, Common Crawl, ICANN CZDS zone files, ProjectDiscovery Chaos, HaGeZi DNS blocklists, and an active hostname prober. It offers a no-token REST API (100 req/IP/day), a Streamable HTTP MCP server exposing a single search tool for agent clients, and is the default crt source in the subfaster CLI subdomain enumerator.

crt.nametoolAdded 3 Sep 2026, published 21 Aug 2026🛡️ Security

OBLITERATUS/Qwen3.8-27B-OBLITERATED is an "abliterated" (safety-guardrail-removed) fine-tune of Alibaba's Qwen3.8-27B, built by Pliny the Prompter using the OBLITERATUS ablation suite. Its V3 recipe blends two refusal-direction-removal techniques — aggressive SVD projection and LEACE — in iterative rounds with a targeted refusal-corpus, eliminating both hard refusals and softer "safety lecture" deflections while costing only -2.1pp MMLU versus stock. The model card frames it explicitly for alignment researchers, red-teamers, and AI safety evaluators needing an unrestricted baseline to test post-training safety against weight-space attacks.

huggingface.cotoolPublished and added 21 Aug 2026🛡️ Security

OSINT Framework is a free, browsable web-based directory that organizes hundreds of open-source intelligence (OSINT) tools and resources into a category tree covering usernames, email addresses, domains, social media, public records, and more. Each entry is tagged to indicate whether it requires local installation (T), is a Google Dork (D), requires registration (R), or needs manual URL editing (M), helping practitioners quickly find the right recon tool for a given task.

osintframework.comtoolPublished and added 31 Jul 2026🛡️ Security

Claude Security is Anthropic's AI-powered code scanning product (currently in beta for Claude Enterprise and as a Claude Code plugin) that uses the Claude Mythos 5 model to trace data flows across files, find high-severity vulnerabilities (memory corruption, injection, auth bypass, complex logic errors), and validate findings via an adversarial self-check before proposing human-reviewable patches. It integrates with GitHub, Slack, Jira, and webhooks for triage/audit workflows and supports scheduled or directory-scoped scans.

claude.comtoolAdded 3 Sep 2026, published 23 Jul 2026🛡️ Security

Vulnerability Garden is a searchable, continuously updated database of named vulnerabilities, attack techniques, and exploits (over 1,132 entries as of September 2026), each tagged with publish date, associated CVE numbers, and reference links. It spans decades of security research — from classic bugs like Billion Laughs and the Kaminsky bug to recent AI-agent and supply-chain attacks like MCPJacking and GitSpawn — making it a useful lookup tool for researchers trying to find or cross-reference a named vuln.

vulnerability.gardentoolAdded 3 Sep 2026, published 13 May 2026🛡️ Security