sandbox-runtime

Anthropic 沙箱运行时（srt） 一个轻量级沙箱工具，用于在操作系统层面强制对任意进程实施文件系统和网络限制，无需容器。 srt 使用原生操作系统沙箱原语（macOS 上的 sandbox-exec，Linux 上的 bubblewrap）以及基于代理的网络过滤。它可用于沙箱化智能体、本地 MCP 服务器、bash 命令和任意进程的行为。 Beta 研究预览版 沙箱运行时是为 Claude Code 开发的研究预览版，旨在实现更安全的 AI 智能体。它作为早期开源预览版发布，以帮助更广泛的生态系统构建更安全的智能体系统。由于这是早期研究预览版，API...

MakerChecker

🛡️ MakerChecker The open-source security layer for AI agents. Deny-by-default enforcement, human approvals, and a cryptographically signed audit trail — so your agent runs only what it's granted and provably can't approve its own work. Website · Live Demo · mc scan · Docs Your agents keep running...

apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...

cloudrasp-log4j2

靖云甲·应用程序自我防护模块 - Log4j2 专版 English 本项目为靖云甲为 Log4j2 CVE-2021-44228 专项构建的本地版本。使用不需要联网。 请务必测试后再应用于生产环境！ 应用程序自我防护模块通过 RASP 技术，将探针注入至 Java 应用中。对 log4j2 的攻击检测是通过检测程序上下文来实现的，也可为非 Web 业务程序提供保护。 该防御模块会默认阻断通过 log4j2 发起的 JNDI 注入。 值得注意的是 虽然 Oracle 在 6u211、7u201、8u191、11.0.1 默认不再通过 JNDI 加载远程 class，但是攻击人员发现通过...

AMBER-ICI

AMBER ICI v5 AMBER ICI AMBER Investigative Command Interface is a local-first browser interface for investigative and analytical workflows powered by a local Ollama server. It includes: A single-model Analyst Console and multi-model Parallel execution A user-defined agent chain driven from the ma...

nono

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

zeek-caldera-detector

zeek-caldera-detector zeek-caldera-detector es un paquete basado en Zeek para detectar balizas beacons de Caldera y descargas de agentes. Está diseñado para identificar actividades sospechosas asociadas con los frameworks C2 de Caldera, incluyendo Sandcat, Ragdoll y Manx. Este paquete proporciona...

scenester

Scenester Scenester - una herramienta para capturar visualmente un sitio web proporcionando múltiples user-agents. Diseñada para ayudar en el descubrimiento de diferentes puntos de entrada en una aplicación. Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado p...

wifi-agent

wifi-agent wifi-agent Rogue access point. The program is made for educational purposes only for to see how the rogue access point method works. Any unnecessary use of the program is prohibited and the manufacturer has no responsibility for any illegal use by anyone. Use the tool at your own risk...

Medusa

Medusa Medusa es un agente multiplataforma compatible con Python 3.8 y Python 2.7. Instalación Para instalar Medusa, necesitarás tener Mythic v3 instalado en una computadora remota. Puedes encontrar las instrucciones de instalación de Mythic en la página del proyecto Mythic. Desde la raíz de...

vuln-list

vuln-list Collect vulnerability information and save it in parsable format automatically Source Directory| OS| Source| URL ---|---|---|--- alma/| AlmaLinux| AlmaLinux Errata| https://errata.almalinux.org/8/errata.json alpine/| Alpine Linux| Alpine secdb| https://secdb.alpinelinux.org/ amazon/1|...

aimap

AIMap Internet-scale discovery and security testing platform for exposed AI agent infrastructure. AIMap finds, fingerprints, and security-tests publicly exposed AI endpoints — MCP servers, Ollama instances, vLLM/LiteLLM proxies, LangServe chains, Gradio apps, ComfyUI nodes, and more. Think Shodan...

ssh-tpm-agent

SSH agent for TPM ssh-tpm-agent is a ssh-agent compatible agent that allows keys to be created by the Trusted Platform Module TPM for authentication towards ssh servers. TPM sealed keys are private keys created inside the Trusted Platform Module TPM and sealed in .tpm suffixed files. They are bou...

StepJack

StepJack: Evaluación de la seguridad de agentes de uso de computadora contra la inyección indirecta de prompts en múltiples pasos Configuración 1. Configuración del entorno de Python Primero, instala todas las dependencias y asegúrate de que estás ejecutando Python 3.10. conda create -n stepjack...

Maestro

Maestro Maestro es una herramienta de post-explotación diseñada para interactuar con Intune/EntraID desde un agente C2 en la estación de trabajo de un usuario sin requerir conocimiento de la contraseña del usuario, flujos de autenticación de Azure, manipulación de tokens ni consola de...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

l4j-fp1

falso positivo de log4shell Este es un proyecto web simple con una vulnerabilidad log4shell saneada. Para una versión sin sanear, consulte https://github.com/scabench/l4j-tp1/. El proyecto define un servicio get scabench.HelloWorldService simple que devuelve una cadena de texto plano hello world...

mcp-security-checklist

🔐 MCP Security Checklist A practical, community-maintained security checklist for teams building and deploying Model Context Protocol MCP servers and AI agent infrastructure. Why This Exists MCP is being adopted rapidly. Security guidance is lagging behind. This checklist gives security engineers...

xalgorix

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

xalgorix

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...