AIOstack

AI agents always look authorized. AIOStack tells you when they're not. AI agents act on behalf of users. They use real credentials, make real API calls, invoke tools, access APIs, and touch production systems. Most security tools see this activity as legitimate because, technically, it is. The re...

ExportHider

ExportHider ExportHider generates a C++ DLL template which contains a code stub that allows you to hide Exported Functions from the Export Directory of the DLL on the filesystem. After putting the function definitions and compiling the file, you won't see the hidden export functions through PE Fi...

droidground

DroidGround Website | Demo In traditional CTF challenges , it's common to hide flags in files on a system, requiring attackers to exploit vulnerabilities to retrieve them. However, in the Android world, this approach doesn't work well. APK files are easily downloadable and reversible, so placing ...

prismor

Prismor Runtime security for Claude Code, Codex, Langchain and other AI agents frameworks/harness. Prismor is highly customizable based on user's own policies. Observe or enforce mode to see agent activity in a local self-serve dashboard Website • Onboard with Skill...

blutter

Blutter Flutter Mobile Application Reverse Engineering Tool by Compiling Dart AOT Runtime Currently the application supports only Android libapp.so arm64 only. Also the application is currently work only against recent Dart versions. For high priority missing features, see TODO Environment Setup...

tarian

Tarian We want to maintain this as open-source to fight against the attacks on our favorite Kubernetes ecosystem. We can fight threats together as a community, by continuous contribution. Protect your Applications running on Kubernetes from malicious attacks by pre-registering your source code...

processhacker-mcp

processhacker mcp this is dynamic mcp server for runtime analysis and process hacking. it is like processhacker but for ai agents. setup 1. open folder in visual studio it has cmakelists 2. build all ctrl+shift+b 3. it makes ProcessHackerMCP.exe and extensions/ folder. 4. run exe. it communicates...

mastyf.ai

mastyf.ai Secure the Action Boundary, Not Just the Prompt. A local reference monitor and security gateway for AI agents and MCP. Your LLM proposes actions. Mastyf decides whether those actions reach the real world. Website · Quick start · Policy · Dashboard · GitHub !NOTE Enterprise & Cloud...

ironclaw

IronClaw Your secure personal AI assistant, always on your side English | 简体中文 | Русский | 日本語 | 한국어 Reborn Quick Start • Philosophy • Features • Installation • Configuration • Security • Architecture IronClaw Reborn Quick Start IronClaw Reborn is the standalone runtime on the reborn-integration...

macSubstrate

 macSubstrate - Substrate for macOS macSubstrate is a platform tool for interprocess code injection on macOS, with the similar function to Cydia Substrate on iOS. Using macSubstrate, you can inject your plugins .bundle or .framework into a mac app including sandboxed apps to tweak it in the...

dockle

Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start Dockle helps you: 1. Build Best Practice Docker images 2. Build secure Docker images Checkpoints includes CIS Benchmarks $ brew untap goodwithtech/dockle who use 0.1.16 or older version $ bre...

hush

Give your agents boundaries you can read. Get decisions you can verify. What · Quickstart · How it works · SDKs · CLI · Policies · Docs · Spec What is HushSpec? HushSpec is an open specification for the security controls an AI agent operates under. Write a policy in YAML, evaluate it in Rust,...

BlackDex

BlackDex BlackDex is an Android unpack tool, it supports Android 5.012 and need not rely to any environment. BlackDex can run on any Android mobile phone or emulator, you can unpack APK File in several seconds. Declaration This project is not directed against any encryption, it does not deal with...

EfiGuard

Overview EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager, boot loader and kernel at boot time in order to disable PatchGuard and Driver Signature Enforcement DSE. If you're just looking to try EfiGuard, skip to Usage. Features Currently supports all EFI-compatible...

ShadowClone

ShadowClone ShadowClone allows you to distribute your long running tasks dynamically across thousands of serverless functions and gives you the results within seconds where it would have taken hours to complete. You can make full use of the Free Tiers provided by cloud providers and supercharge...

RMS-Runtime-Mobile-Security

Runtime Mobile Security RMS 📱🔥 by @mobilesecurity Runtime Mobile Security RMS , powered by FRIDA, is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime. With RMS you can easily dump all loaded classes and relative methods, hook everything on the fly, trace metho...

ThreatMapper

ThreatMapper - Runtime Threat Management and Attack Path Enumeration for Cloud Native !NOTE This project is maintained by https://threatmapper.org Deepfence ThreatMapper hunts for threats in your production platforms, and ranks these threats based on their risk-of-exploit. It uncovers vulnerable...

frida

Frida Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Learn more at frida.re. Two ways to install 1. Install from prebuilt binaries This is the recommended way to get started. All you need to do is: pip install frida-tools CLI tools pip install frida...

darling

Darling Darling is a runtime environment for macOS applications. Please note that most GUI applications will not run at the moment. Download Packages for some distributions are available for download under releases. Build Instructions For build instructions, visit Darling Docs. Prefixes Darling h...

Anvil

Runtime-first privilege escalation and attack surface assessment for Windows thick clients. Anvil is a runtime-first privilege escalation and attack surface assessment tool for Windows thick client applications. Rather than scanning the filesystem blindly, it pairs Procmon capture with Windows...