#1Tools for assessing the security of REST, SOAP, and GraphQL APIs.
Kitploit recommended
corazawaf/corazaGo-based Web Application Firewall library compatible with ModSecurity SecLang rules and OWASP Core Rule Set v4, providing real-time HTTP traffic…
owasp/offatAutomated API security testing tool that generates tests from OpenAPI specs, fuzzes inputs, and checks for OWASP API Top 10 vulnerabilities including…
unkn0wn-root/restermTerminal API client for HTTP, GraphQL, gRPC, WebSocket and SSE. Plain .http files you can diff and version, with scripted tests, workflows, mocks,…
mozilla/firefox-devtools-mcpModel Context Protocol server for Firefox DevTools - enables AI assistants to inspect and control Firefox browser through WebDriver BiDi
chaitin/safelineSelf-hosted WAF and reverse proxy that filters malicious HTTP traffic, blocks SQL injection, XSS, and bot attacks, with rate limiting and dynamic…
nuguardai/nuguardopensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis
mitmproxy/mitmproxy_rsRust components for traffic interception and redirection, enabling WireGuard device proxying and local app redirection across macOS, Windows, and…
projectdiscovery/chaos-clientGo client to communicate with Chaos DB API.
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
opaxial/cve-2026-9830CVE-2026-9830 Proof of Concept
spectolabs/hoverflyLightweight service virtualization/ API simulation / API mocking tool for developers and testers
forefy/reburpA Burp Suite extension that exposes the full Montoya API as a local REST API, with Swagger UI
six2dez/burp-ai-agentBurp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more
bifrost-proxy/bifrostHigh-performance HTTP/HTTPS/SOCKS5 MITM proxy in Rust with TLS interception, rule-based request rewriting, traffic capture, breakpoints, script…
pennacle-security/summitOpen-source web security testing platform: proxy, scanner and fuzzer in one CLI. By Pennacle Security.
albinowax/activescanplusplusBurp Suite extension that extends active and passive scanning with checks for host header attacks, XXE, expression language injection, shellshock and…
letsencrypt/test-certs-siteA simple server to host the valid, revoked, and expired certificates required by Section 2.2 of the CA/Browser Forum Baseline Requirements.
mda2av/http11probeAn open testing platform that probes HTTP/1.1 servers against RFC 9110/9112 requirements, smuggling vectors, and malformed input handling. Add your…
