42 results for “fal”

G-Krusch is an MIT-licensed, local-first Google Workspace hub built on Node.js 22 and SQLite WAL. It runs a 12-tool MCP server (SSE and Stdio) plus a REST bridge on port 5446 for Drive, Calendar and Gmail. It includes a 1,024-dimension hybrid Drive RAG with an embedding cascade (Ollama bge-large, then Gemini, then offline fallback) and FTS5 BM25. PDF extraction returns page citations. Tokens are kept in an AES-256-GCM vault; 30 of 30 tests pass.

x.comrepoAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

Antirion is an open-source AI gateway shipped as one Rust binary with a built-in admin console. It sits between apps and providers such as OpenAI, Anthropic, Bedrock, Vertex and vLLM, translating between OpenAI, Anthropic, Gemini and Bedrock dialects. It covers routing with fallbacks and circuit breakers, budgets, guardrails, caching, MCP and A2A gateways, SSO, and a benchmark against Bifrost 2.2.4 and LiteLLM 1.103.1.

github.comrepoAdded 21 Oct 2026, published 17 Oct 2026🧠 AI

Open-source Python CLI (`tra`) for autonomous trading desks in which LLM analysts (technical, macro, on-chain, sentiment) and validators only give opinions on figures the system computed. Fixed rules do the arithmetic: pricing the round-trip cost, applying risk limits, sizing, cost gates, and sending a single order with stop attached via ccxt (Bybit and OKX demo accounts tested). It supports multiple model providers with per-role models, effort settings and fallbacks. Every answer is parsed against a closed schema, every refusal is logged with the figure behind it, and models can tighten but never loosen controls. This makes it a concrete reference for keeping LLM agents away from arithmetic and money.

github.comrepoAdded 18 Oct 2026, published 13 Oct 2026🧠 AI

Talorys is an open-source, single-user personal AI assistant deployed with one command (npx create-talorys) into the user's own Cloudflare account. It uses a Cloudflare Agents SDK Durable Object with SQLite for conversations, memories, tasks, notes and automations, Workers AI (@cf/zai-org/glm-4.7-flash) for streaming chat with tool calling, and Durable Object alarms for reminders and scheduled AI routines. It stays within the Workers Free plan, with a private Worker behind a Pages Function service binding, owner-password auth, per-day AI usage guardrails, and fallback to non-AI features when quota runs out.

github.comrepoPublished and added 10 Oct 2026🧠 AI

ldraw-nova is an open-source agentic pipeline where an LLM agent (tested with models like Claude Opus 5.5 and GPT-6 Astra) takes a build prompt, reads LDraw-building instructions, and produces a plan.json describing a model's geometry. From that plan it writes a Python generator script that, when executed, outputs an LDraw (.mpd) 3D CAD source file, viewable in 3D/VR (Meta Quest 3) or exportable to Blender-editable glTF. The agent uses jev-rerank, a semantic search tool with reranking backed by TypeSafe's Jev System One model, to find suitable LEGO parts and example models, falling back to full-text search without an API key; it also uses headless rendering and collision/gap detection to self-inspect and iterate on designs.

github.comrepoAdded 3 Oct 2026, published 2 Oct 2026🧠 AI

Agent-Reach is a CLI and agent-"skill" layer that equips coding agents (Claude Code, Cursor, OpenClaw) with ready-made web-reading tool use: fetching arbitrary pages via Jina Reader, YouTube transcripts via yt-dlp, GitHub repos via gh CLI, Bilibili search, RSS via feedparser, and semantic web search via Exa through mcporter, with login-gated platforms (Twitter/X, Reddit, Xiaohongshu, Facebook, Instagram) added on request via cookies or OpenCLI browser sessions. Each platform module probes an ordered list of candidate backends and falls back automatically when one breaks (e.g. yt-dlp being blocked by Bilibili's anti-scraping), and an `agent-reach doctor` command reports which backend each channel is currently using. It positions itself as a "capability layer" that selects, installs and health-checks the right upstream tool for an agent rather than wrapping the reads itself.

github.comrepoAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

Sift is Stratus Security's open-source successor to Snaffler: a Native AOT credential/secrets scanner for pentesters that crawls local drives, SMB shares/subnets, Active Directory, SharePoint/OneDrive/Teams, Slack, and Jira/Confluence for exposed secrets. It supports Kerberos/NTLM/pass-the-hash authentication, resumable checkpointed scans, a JSON rule/ignore-rule system compatible with Snaffler's detection catalogue, and optional local-LLM (Ollama) validation to cut false positives without sending sensitive findings to a cloud API.

github.comrepoAdded 30 Sep 2026🛡️ Security

Tosint v1.0.0 is an open-source Telegram OSINT tool for analyzing bots and chats, exporting message history and media. The new release adds richer JSONL metadata output, optional SHA-256 hashing of exported media, bot/user authentication support, and an automatic fallback from MTProto-based history retrieval to ID-scan mode when dealing with restricted chats.

x.comrepoAdded 2 Oct 2026, published 30 Sep 2026🛡️ Security

universal-modder is a set of Agent Skills, a CLI (um) and a shared knowledge base (field notes in knowledge/) that let AI coding agents such as Claude Code, Codex, Gemini CLI, Cursor, GitHub Copilot and OpenCode find a PC game's engine, reverse-engineer its code, build a working mod, generate art/3D/sound assets via the fal MCP server (or a local ComfyUI server), test the mod in the running game, and write a field note for the next agent. It ships worked examples — a weapon/boss pack for Terraria via tModLoader, a new civilization for Age of Empires II DE, and a real-time Minecraft-inside-GTA-V passthrough mod — each documented with a field note of exact versions, routes and gotchas, and agents can open pull requests to grow the shared knowledge base.

github.comrepoAdded 6 Oct 2026, published 30 Sep 2026🧠 AI

respan-gateway is an open-source Rust LLM gateway shipped as a single binary with a built-in web UI. It lets OpenAI Chat Completions, Responses, Anthropic Messages and Gemini generateContent clients call any model, translating tools, images and reasoning. It adds named routes, fallback, retries, hedged races, MCP server fronting, per-call pricing, request logs and plugins.

github.comrepoAdded 22 Oct 2026, published 25 Sep 2026🧠 AI

A maintained, harness-portable fork of Capital One's open-source VulnHunter — an agentic AI tool that performs attacker-first forward analysis on source code to find exploitable vulnerabilities, falsify weak findings, and produce evidence-backed PoCs rather than pattern-matched SAST alerts. This fork adds containerized (Docker-based) exploit validation, measured-impact PoCs (rows leaked, amplification factor, etc.), and portability across agent harnesses (Claude Code, Codex, Grok, etc.) via environment-contract prompt files, plus an unattended operator (vulnhunter-run) and batch-scanning/benchmark harness tested against OWASP NodeGoat, Juice Shop, and WebGoat.

github.comrepoAdded 6 Oct 2026, published 22 Sep 2026🛡️ Security

A Docker-based exploitation lab for CVE-2026-26980, an unauthenticated blind SQL injection in Ghost CMS's Content API (versions before 6.19.1). The bug lives in slug-filter-order.js, where slug values from the array-notation filter syntax (filter=slug:['value']) are interpolated unsanitized into an ORDER BY CASE statement, letting NQL's single-quote-wrapped literals smuggle raw SQL past input validation; since MySQL treats || as OR and empty strings as falsy, attackers get a clean boolean oracle to extract data (e.g. admin email/password hash) from any Ghost site using only the publicly embedded Content API key. The repo includes exploit.py for full setup/verify/extract, a docker-compose lab spinning up both vulnerable (6.18.0) and patched (6.19.1) Ghost instances, and also mentions a second patched bug (jsonpath/static-eval prototype pollution in the {{#get}} Handlebars helper leading to RCE via themes).

github.comrepoAdded 21 Sep 2026🛡️ Security

adnullenum is a single-pass Active Directory enumerator that uses anonymous (null) SMB sessions over the \samr and \lsarpc named pipes to pull domain info, password/lockout policy, RID-cycled account inventory, per-user detail, and group membership without credentials. It consolidates what rpcclient, impacket's samrdump.py/lookupsid.py, enum4linux-ng, and NetExec each do separately into one run, falls back to LSA lookups when SAMR is locked down, flags interesting accounts (AS-REP-roastable, PASSWORD_NOT_REQUIRED, unconstrained delegation, etc.), and writes ready-to-use userlist.txt/computerlist.txt plus a reusable RID cache. The README also gives blue-team guidance on closing null-session access (RestrictAnonymousSAM, Pre-Windows 2000 Compatible Access group) and detecting it via Event 4661/4662/4624/5140.

github.comrepoAdded 2 Oct 2026, published 17 Sep 2026🛡️ Security

A community-maintained GitHub list cataloging "decision models" (also called System One models): small/fast models that take a state plus caller-declared questions (Noul/true-false, Choice/multi-option, Score/rubric) and return a probability per answer in one forward pass, rather than generating text. It tracks the originating TypeSafe AI Jev model and its /v1/systemone API alongside competing hosted models (Upstage Solar Decide, Liquid AI's d1, OpenAI's Decisions API, Inception's Mercury Decide, Respan's Span-01), dozens of open-weight fine-tunes (Cloudflare's Clef, Perplexity's pplx-decider, AWS Strands Decider, Together AI's Tev1, and many Qwen3.5-based community models), zero-training logit-reading approaches, local runtimes (Ollama, Ollaya, llama.cpp-based servers), SDKs across a dozen languages, and a very long list of agent/coding-tool/MCP integrations (browser agents, code review, routing, game-playing demos) that use these models for fast, typed, in-the-loop decisions. The page is truncated at 40k of ~51k characters, so later sections (further toys, demos, and possibly benchmarks) are not reflected here.

github.comrepoAdded 2 Oct 2026, published 17 Sep 2026🧠 AI

Blitz Strike is an open-source Model Context Protocol server (TypeScript/Bun) that packages a structured 3-tier pentesting methodology — BLITZ (attack-surface recon), EAGLE-EYE (source-to-sink reachability tracing), and STRIKE (live validation before reporting) — into callable tools any MCP client (Claude Code, Cursor, Gemini, etc.) can drive with a single run_engagement call. It ships 130 self-written security tools, 317 indexed tool manuals, 58 data-driven escalation chains with negative-control checks, a Web3/Solidity audit module with Foundry proofs, and a regression/benchmark suite (453 checks, reported 1.0 detection / 0 false-positive rate) to make every finding verified rather than pattern-matched.

github.comrepoAdded 2 Oct 2026, published 12 Sep 2026🛡️ Security

Agent Egress Bench is an open, tool-neutral benchmark maintained by PipeLab (makers of Pipelock) that tests whether products mediating an AI agent's outbound traffic — proxies, egress firewalls, MCP wrappers, agent gateways — actually catch exfiltration attempts caused by prompt injection or misalignment, rather than testing the underlying model itself (that's left to AgentDojo, InjecAgent, CyberSecEval, AgentHarm, ASB). It ships a reproducible Go runner with a proxy/WebSocket/MCP/A2A adapter contract, an offline validator, DSSE-signed evidence bundles, and a CI-runnable GitHub Action, and separates containment from false-positive rate as two distinct scored axes with immutable case IDs and OWASP Agentic Top 10/MITRE ATT&CK mappings. Its governance explicitly permits third parties to publish results unfavorable to the maintainer's own Pipelock product.

github.comrepoAdded 12 Sep 2026🛡️ Security

GhostJS is an open-source Burp Suite extension by TrinetLayer that passively scans JavaScript, HTML, and JSON responses flowing through Burp for hardcoded secrets (AWS/GCP/Azure keys, Stripe/PayPal/GitHub tokens, JWTs, private keys, etc.) and hidden API endpoints, surfacing findings in a dedicated tab with severity, confidence scoring, remediation guidance, and Markdown export. It also actively fetches referenced <script> bundles using the tester's live session cookies and applies a false-positive filter to suppress doc-sample and placeholder keys, making it a practical recon aid during authorized web app pentests and bug bounty work.

github.comrepoPublished and added 7 Sep 2026🛡️ Security

crypto-rag is an Indonesian-language CLI crypto assistant that pairs a static knowledge-base RAG pipeline with live market data tool calls, built on the principle that volatile numbers (price, funding rate, TVL, sentiment) must never be embedded in the vector store since they go stale instantly. It implements hybrid retrieval (BM25 keyword search + FAISS dense embeddings fused via Reciprocal Rank Fusion) over a 146-topic knowledge corpus, an optional cross-encoder reranker, and an intent router that dispatches price/derivatives/on-chain/sentiment queries to live sources (Binance, DefiLlama, Fear & Greed Index) versus concept questions to the corpus. A tool-calling agent handles multi-step queries, and an OpenAI-compatible LLM synthesis layer (works with StepFun, OpenAI, Groq, LM Studio, Ollama) grounds answers with citations and falls back to extractive answers when no LLM is configured.

github.comrepoAdded 2 Oct 2026, published 5 Sep 2026🧠 AI

BugScanner is an asyncio/httpx Python framework for recon and automated web vulnerability scanning, with a React and FastAPI dashboard. It covers subdomain enumeration (crt.sh, DNS brute force), TCP port scanning, fingerprinting, and modules for XSS, SQLi, CORS, SSRF, open redirect, JWT, IDOR and business logic, plus a Nuclei wrapper. A 5-rule false-positive filter with SPA detection, adaptive rate limiting, WAF detection and SARIF export are included.

github.comrepoAdded 20 Oct 2026, published 5 Sep 2026🛡️ Security

IAM Policy Autopilot is an AWS Labs open-source CLI/MCP server that statically analyzes application source code (Python, Go, TypeScript, JavaScript, Java) or a Terraform plan JSON to generate baseline least-privilege IAM identity-based policies, and can also parse AccessDenied error messages to suggest policy fixes. It integrates with AI coding assistants (Kiro, Claude Desktop, etc.) via MCP so assistants can auto-generate scoped IAM permissions instead of overly broad ones, with a --service-hints flag to reduce false-positive permission inclusion.

github.comrepoPublished and added 25 Aug 2026🛡️ Security

agentgg is an open-source, agentic SAST scanner that uses LLM agents to read source code, follow imports, trace the call graph, and confirm findings before reporting — aiming to reduce the pattern-matching false positives of traditional SAST. It runs locally or as a hosted service, supports full-repo scans or git-diff PR review, and works with multiple model providers (Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter, Ollama); agents are defined as markdown files with YAML frontmatter and are pulled from a community agents catalog.

github.comrepoPublished and added 23 Aug 2026🛡️ Security

Deep Eye is an open-source Python pentesting framework that orchestrates 11 AI providers (OpenAI, Claude, Grok, Gemini, Ollama, Groq, Mistral, OpenRouter, LiteLLM, LM Studio, and more) with automatic failover to generate context-aware attack payloads for 50+ vulnerability classes including SQLi, XSS, SSRF, IDOR, JWT and GraphQL flaws. It adds an RAG-indexed CVE intelligence DB built from NVD/MITRE/Exploit-DB, AI-based finding triage and false-positive filtering, Nuclei-style YAML templates, Playwright browser automation, CAPTCHA-solving (reCAPTCHA/hCaptcha/Turnstile/Arkose), mitmproxy interception, and auto-generated HackerOne-style bug bounty reports with PCI-DSS/SOC2/ISO 27001 compliance mapping, SARIF/JUnit export, scan diffing, and retest workflows.

github.comrepoAdded 3 Sep 2026, published 22 Aug 2026🛡️ Security

A defensive security review lab for MinIO pinned at commit 7aac2a2 (~RELEASE.2025-10-15+11), providing Docker-based single-node, two-node replication, and dual-OIDC environments plus per-finding repro.sh PoCs for issues including service-account key path traversal, server-update SSRF, cross-provider OIDC token acceptance, source-IP/X-Forwarded-For trust, tag-deletion replication bypass, batch job data exfiltration, and secrets exposed via config history. Each of 16+ findings (F-01 through F-16) has ANALYSIS.md with root cause, data-flow trace, and suggested fix, produced via a generate/judge/independent-verify pipeline with cross-vendor adjudication (including an OpenAI/codex-based verifier) and live validation on a lab-built Go binary; ~90 candidates were triaged with ~55 set aside as false positives or intended behavior.

github.comrepoAdded 3 Sep 2026, published 21 Aug 2026🛡️ Security

REVLab is a Windows-local binary analysis workbench for PE files, Unreal Engine dumps and Unity game folders. Its graph workflow engine runs LLM analysis nodes as tool-calling operators: up to 6 tool rounds by default, a target path locked by the workflow, a saved tool_trace, and a read-only fallback when the gateway lacks tools support. Evidence is labelled static, runtime, inferred or blocked, and model output is capped at ai_inferred. An MCP server lets external agents read evidence and submit conclusions.

github.comrepoAdded 23 Oct 2026, published 11 Aug 2026🧠 AI

ops-engineering-skills is an open-source library of 296 Agent Skills covering DevOps, DevSecOps, cloud, Kubernetes, CI/CD, GitOps, security scanning, SRE, compliance, databases, messaging, service mesh, serverless, internal developer platforms, MLOps and AgentOps. Each skill is written once to the open SKILL.md standard with machine-checkable frontmatter and eight required sections (prerequisites, steps, pitfalls with fixes, worked example), and works natively across Claude Code, GitHub Copilot, OpenAI Codex, Cursor and Gemini CLI without a translation layer. It ships an automated validator, cross-reference integrity checks, a marketplace/plugin structure for Claude Code, and a generic install.sh/npx installer for any Agent-Skills-compliant agent.

github.comrepoAdded 22 Sep 2026, published 1 Aug 2026🧠 AI

OSINT Framework is a curated, categorized index of free (mostly) open-source intelligence tools and resources, organized by data type (username, domain, IP, email, social media, etc.) and rendered as an interactive tree at osintframework.com. Each entry in the underlying arf.json is tagged with metadata like whether it requires local install (T), a Google dork (D), registration (R), or manual URL editing (M), plus richer fields such as input/output type, pricing, and opsec notes. It's a long-standing community reference for recon and investigation tradecraft across infosec and other fields.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

Recon-Skills is a curated collection of SKILL.md playbooks for external web security assessments, organized into auth (SSO/OAuth/SAML/MFA), chains (multi-step attack-path analysis), infra, recon (subdomain/DNS/port/tech discovery, route/parameter/API mapping), and redteam (vulnerability-class and platform-specific validation) categories. Each skill documents prerequisites, procedure, pitfalls, and verification criteria, and the skills are designed to be followed manually or loaded as task context by an automation system for authorized penetration testing engagements. It includes a validator script (validate_skills.py) and style/contribution guides to maintain a consistent quality baseline across skills.

github.comrepoPublished and added 29 Jul 2026🛡️ Security

agentdescent is a Python framework that treats self-improving agents as an optimization problem: N workers propose diffs (edits) to a shared skill/prompt/harness artifact in parallel, and a barrier-free aggregator merges them via conflict resolution, fusion and statistical acceptance rather than gradient averaging, committing winners to a version-controlled ledger. It ships a single `evolve()` entry point with pluggable strategy, scorer, and proposal functions, an MCP server and CLI for agent-triggered runs, and faithful reimplementations of 20 published self-evolution algorithms (ACE, GEPA, EvoSkill, SkillOpt, ADAS, DGM, OpenEvolve, ERA, PromptBreeder, AFlow, Self-Refine, Reflexion, SICA, Gödel Agent, Voyager, SkillWeaver, Absolute Zero, R-Zero, Agent0, Genesis) that plug into the same engine for apples-to-apples comparison. The accompanying paper (Chen, 2026) gives a closed-form condition for when concurrent edits can merge and reports confidence intervals rather than false-precision p-values.

github.comrepoAdded 30 Sep 2026, published 24 Jul 2026🧠 AI

VulnHunter is Capital One's open-source agentic AI vulnerability scanner built as a set of Claude Code skills (/vulnhunt, /vulnhunter-fix, /vulnhunt-fix-verify) that runs on Claude Opus. Instead of pattern-matching like traditional SAST, it does attacker-first forward analysis from entry points, runs a "falsification engine" to discard unexploitable findings, and generates evidence-backed remediation patches; it also ships a headless agent runtime and a benchmarking harness tested against OWASP NodeGoat, Juice Shop, and WebGoat.

github.comrepoAdded 19 Jul 2026🛡️ Security

9router-go is a single-binary Go port of 9Router, an LLM gateway that sits between CLI coding tools (Claude Code, Cursor, Codex, Cline, OpenClaw, Gemini CLI, OpenCode) and 40+ AI providers/100+ models. It adds RTK token compression (claimed 20-40% token savings on tool_result content), tiered auto-fallback (subscription → cheap → free providers), multi-account round-robin, per-key proxy pools, and an embedded Svelte dashboard backed by SQLite, with database compatibility to share state with the original Next.js 9Router. It targets the practical problem of coding-agent subscription quota exhaustion and token cost, not a research contribution.

github.comrepoAdded 7 Oct 2026, published 18 Jul 2026🧠 AI

VulnHunter is Capital One's open-source agentic AI security scanner, implemented as a set of Claude Code skills (/vulnhunt, /vulnhunter-fix, /vulnhunt-fix-verify) that require Claude Opus. Instead of traditional sink-first SAST pattern matching, it reasons forward from attacker-accessible entry points (APIs, uploads, network messages), runs a 'falsification engine' to discard unexploitable findings, and generates evidence-backed exploit paths and targeted code fixes; it also ships a headless agent for CI/CD-scale scanning and a benchmarking harness against corpora like Juice Shop, WebGoat and NodeGoat.

github.comrepoAdded 22 Sep 2026, published 18 Jul 2026🛡️ Security

Prempti is an experimental tool from the Falco project that intercepts tool calls made by AI coding agents such as Claude Code and Codex, evaluating shell commands, file reads/writes, web fetches, and MCP calls against customizable Falco YAML rules before execution. It runs in guardrails mode (deny/ask/allow enforcement with LLM-friendly denial explanations) or monitor mode (log-only), ships a default ruleset covering credential theft, sandbox-disable attempts, exfiltration, persistence, and MCP/skill poisoning, and provides a premptictl CLI plus a rule-authoring Claude Code skill. It explicitly notes it is not a sandbox or OS-level containment and is meant to complement, not replace, least-privilege environments.

github.comrepoPublished and added 4 Jul 2026🛡️ Security

CVE Lite CLI is an OWASP Lab Project CLI that scans npm, pnpm, Yarn, and Bun lockfiles against OSV and the npm advisory API and outputs copy-and-run fix commands instead of raw CVE lists, with parent-aware guidance for transitive dependencies. Beyond core CVE scanning it audits override/resolution hygiene, flags maintenance risk (deprecated direct deps and version drag blocking fixes), warns when a suggested fix falls inside a package manager's release-cooldown window (referencing the chalk/debug npm compromise), and emits SARIF, SPDX/CycloneDX SBOMs, and EPSS-based priority tiers, plus a GitHub Action that opens batched fix PRs.

github.comrepoPublished and added 31 May 2026🛡️ Security

Metis is an open-source agentic AI security code review framework built by Arm's Product Security Team that uses LLMs for semantic vulnerability detection rather than hardcoded rules. It performs deep security review across codebases (with C/C++ reachability analysis via a code graph), validates and triages findings from itself or third-party SAST tools to reduce false positives, and annotates SARIF output. It supports multiple LLM providers (OpenAI, Azure OpenAI, Anthropic, Gemini, AWS Bedrock, vLLM, Ollama, llama.cpp, LiteLLM) and vector-store backends (ChromaDB, PostgreSQL/pgvector, Qdrant) for RAG-based codebase indexing and querying.

github.comrepoPublished and added 31 May 2026🛡️ Security

AgentShield is a CLI/GitHub Action security auditor that scans a Claude Code .claude/ directory for hardcoded secrets, overly permissive Bash/tool allow rules, hook injection, risky MCP server configs, and agent prompt-injection surfaces, producing an A–F graded report with 268 rules across 15 modules. It adds runtime-confidence classification (active-runtime vs. template/docs/plugin-cache) to reduce false positives, a three-agent Claude Opus red-team/blue-team/auditor pipeline for adversarial analysis, MCP supply-chain provenance checks, SOC2/PCI/ISO compliance control mapping, SARIF output for GitHub code scanning, and tamper-evident evidence packs for CI/audit handoff.

github.comrepoAdded 30 May 2026🛡️ Security

OWASP Noir is a static analysis (SAST) tool that reads source code to extract every endpoint an application exposes — paths, methods, parameters, headers, cookies, and their originating files — across 205 supported frameworks, with an LLM fallback (OpenAI/Ollama) for unsupported ones. The endpoint inventory (including shadow APIs and undocumented routes) is exported as JSON/YAML/OpenAPI/SARIF/cURL/Postman/HTML to feed DAST scanners (ZAP, Burp Suite, Caido, Gori), human security reviewers, and AI SAST auditors, with optional --ai-context enrichment (guards, sinks, validators, callees) and GitHub Action/CI integration.

github.comrepoPublished and added 24 May 2026🛡️ Security

CF-Hero is a Go-based recon tool that uncovers the real origin IP of Cloudflare-protected web applications by correlating current/historical DNS records (A, TXT/SPF), OSINT search engines (Shodan, Censys, ZoomEye), SecurityTrails historical DNS, and sub/related-domain host-header comparison. It validates candidate IPs by connecting directly over HTTP(S) and comparing HTML titles against the target, and supports custom JA3 fingerprints, proxies, and concurrent scanning to reduce false positives.

github.comrepoPublished and added 21 May 2026🛡️ Security

An "Awesome" GitHub list curating research papers, tools, and Claude/Codex "agent skills" focused on LLM-driven vulnerability detection, covering benchmarks (CVE-Bench, VulnGym, SecVulEval), autonomous pentesting/auditing projects (strix, Darkmoon, DeepAudit, AutoCVE, OpenAnt), and vendor-published security-audit skills (Anthropic's defending-code-reference-harness, Cloudflare's security-audit-skill, OpenAI's codex-security). It spans academic work on code-property-graph-guided detection, smart-contract auditing, reinforcement-learning-based reasoning for vuln analysis, and multi-agent false-positive triage.

github.comrepoPublished and added 13 May 2026🛡️ Security

OpenAnt is Knostic's open-source Apache 2 licensed LLM-based vulnerability discovery tool that runs source code through a two-stage pipeline, an agentic detection phase followed by an attack and verification phase, to filter out false positives and surface exploit-verified findings. It is a Go CLI with a Python analysis backend supporting Go, Python, and several beta languages including JavaScript, C, PHP, Ruby, Zig, Swift, and Rust, with pluggable LLM providers such as Anthropic, OpenAI, Google, Ollama, OpenRouter, and Bedrock, plus diff and PR scoped scanning for CI and a local web UI.

github.comrepoPublished and added 12 May 2026🛡️ Security

Betterleaks is a configurable secrets scanner built by the original Gitleaks author and team as its spiritual successor. It scans git history, local filesystems, GitHub/GitLab orgs, projects, PRs and MRs, Hugging Face repos, and S3-compatible buckets (including Cloudflare R2 and Common Crawl), and supports live credential validation via HTTP checks defined in its TOML config. Detection logic is expressed through prefilters and filters written in Expr (with legacy CEL compatibility), letting users tune regex matching, entropy thresholds, and multipart rule correlation for lower false positives.

github.comrepoPublished and added 10 May 2026🛡️ Security

claude-code-security-review is an official Anthropic GitHub Action that uses Claude Code to perform diff-aware, semantic security analysis of pull requests, flagging issues like injection, broken auth, hardcoded secrets, insecure crypto, and RCE via deserialization, then posting findings as PR review comments. It includes false-positive filtering tuned to exclude low-impact findings such as DoS, rate limiting, and open redirects, and ships a matching security-review slash command for local use inside Claude Code; the authors explicitly warn it is not hardened against prompt injection and should only run on trusted, reviewed PRs.

github.comrepoPublished and added 10 May 2026🛡️ Security

NetOrbit is a terminal-based (TUI) tool that uses Scapy to asynchronously capture outbound IPv4 packets and plots them in real time onto a Braille-rendered world map using GeoIP resolution (MaxMind-compatible with IP-API fallback). It requires root for raw-socket capture, filters out local/private/multicast traffic, and shows a live panel of recent connections (IP, country, protocol, size, interface) - a lightweight terminal alternative to a network-monitoring dashboard for spotting where a machine is talking on the internet.

github.comrepoPublished and added 7 May 2026🛡️ Security