bromure

Bromure Secure, ephemeral computing in disposable Linux VMs on macOS. → Full details, screenshots, and downloads at bromure.io This repo ships two sibling apps, both built on Apple's Virtualization.framework: Bromure — every browser session runs in a throwaway Linux VM. Close the window, the VM i...

sage

Sage Safety for Agents — Agent Detection & Response for AI coding assistants Sage is a lightweight security layer that protects AI agents from executing dangerous actions. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them against multiple threat detection layer...

clawdstrike

Clawdstrike EDR for the age of the swarm. Fail closed. Sign the truth. Status: pre-1.0 beta. Public APIs are stable; defaults may still tighten before 1.0. Clawdstrike is a policy engine, an EDR, and a signed audit chain in one binary. An AI agent's toolcall sits in the same event taxonomy as a...

PentestGPT

!Contributorscontributors-shieldcontributors-url !Forksforks-shieldforks-url !Stargazersstars-shieldstars-url !Issuesissues-shieldissues-url !MIT Licenselicense-shieldlicense-url !Discorddiscord-shielddiscord-url PentestGPT AI-Powered Autonomous Penetration Testing Agent Published at USENIX...

aimap

AIMap Internet-scale discovery and security testing platform for exposed AI agent infrastructure. AIMap finds, fingerprints, and security-tests publicly exposed AI endpoints — MCP servers, Ollama instances, vLLM/LiteLLM proxies, LangServe chains, Gradio apps, ComfyUI nodes, and more. Think Shodan...

agent-skills

Elastic Agent Skills Elastic Agent Skills — built by the people who built Elastic — deliver native platform expertise directly to your AI coding agent. This is the official Agent Skills library, compatible with agentic IDEs such as Cursor, GitHub Copilot, Windsurf, Gemini CLI, and more. Skills...

CyberStrike

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी The first open-source AI agent built for offensive security. Automated...

TarantuBench

TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...

miasma-toolkit

Miasma / Shai-Hulud toolkit Incident analysis + detection/remediation tooling for the Miasma worm a Mini Shai-Hulud variant that injects auto-run payloads into AI-agent / IDE configs and npm/GitHub repos. ⚠️ Disclaimer — no warranty. This is a community defensive toolkit provided "as is" , without...

burp-ai-agent

Custom AI Agent The bridge between Burp Suite and modern AI. A note on the name: This extension is published as Custom AI Agent formerly Burp AI Agent. It was renamed to comply with PortSwigger's BApp Store naming requirements and to avoid confusion with Burp Suite's built-in Burp AI provider. Th...

sdk

@cosignet/sdk Thin, zero-dependency TypeScript client for Cosignet — human-in-the-loop approval for high-risk AI-agent actions, with payload-bound passkey signatures. Put a human in the loop before a dangerous action runs: pause it, get an explicit passkey approval from a person Face ID / Touch I...

SkillSpector

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. In the 31,132-skill analyzed...

readme2demo

readme2demo — verified tutorials & demo videos from your README ▶ readme2demo generating its own tutorial: an AI agent runs this repo's README in a sandbox, a fresh container replays every step, then the demo is rendered. Full self-run output in examples/readme2demo · run against another project ...

coderunner

CodeRunner: A local sandbox for your AI agents CodeRunner helps you sandbox your AI agents and its actions inside a sandbox. Key use case: You can run multiple Claude Code or AI agents in our sandbox without any fear of data loss and exfilteration. Quick Start Prerequisites: Mac with macOS and...

pentest-harness

Pentest Harness Heaven for Hackers — the professional security testing workspace. An open-source, dark-first AI agent harness for authorized penetration tests, bug bounty research, security labs, and CTF engagements. Built on a plugin architecture where every layer — model adapters, tools,...

onecli

The agent harness built for teams. A pro assistant for companies. Give every employee a secured, sandboxed personal agent. Website · Docs · Discord Quick Start Cloud-hosted: onecli.sh Self-hosted git clone https://github.com/onecli/onecli.git && cd onecli pnpm install pnpm run setup Open...

red-clippy

Red Clippy Your agent tests. Red Clippy keeps the record. Open-source pentest management built to be operated by an AI agent. Connect it to Claude Code over MCP and it runs the engagement alongside you: scope and assets, recon observations, methodology coverage, and findings with CVSS and evidenc...

sigma-ai

AgentShield Sigma Rules What is This Repository? This repository contains detection rules that help identify when an AI agent is being attacked or manipulated. Think of it as a library of "threat signatures" -- each rule describes a pattern that, when matched against an agent's log data, signals...

hush

Give your agents boundaries you can read. Get decisions you can verify. What · Quickstart · How it works · SDKs · CLI · Policies · Docs · Spec What is HushSpec? HushSpec is an open specification for the security controls an AI agent operates under. Write a policy in YAML, evaluate it in Rust,...

clawguard

🦞 ClawGuard v3 Enterprise AI Agent Security Toolkit - SKILL.md Driven Active Defense Core Concept The core defense of ClawGuard v3 is not in the code, but in SKILL.md! Each module's SKILL.md itself is a complete defense guide: Tells the Agent when to trigger Guides the Agent how to detect Provide...