#2Tools for observing malware behavior in isolated environments to understand its actions and impact.
Kitploit recommended
anthropic-experimental/sandbox-runtimeA lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.
0vercl0k/wtfDistributed, code-coverage guided snapshot-based fuzzer for user and kernel-mode targets on Windows and Linux, with emulator and hypervisor backends.
recurse-labs/recurseAgentic reverse engineering IDE with a pure-Rust multi-architecture disassembler, native decompiler, debugger, and LLM agent for binary analysis and…
kpolley/redaiAI-driven vulnerability discovery and live validation
invictus1306/functraceA function tracer
google/artemisNatural-language Android automation agent that drives real devices via ADB, captures Logcat and screenshots, and exposes an MCP server for AI IDEs…
zaproxy/zaproxyOpen-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…
michaels1011/ephemora-cellCapability-based WASM runtime for executing untrusted AI-generated code with enforced CPU, memory, time, I/O, and filesystem limits. Provides…
orbitcurve/firmware-reverse-engineeringAgent skills for firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting, packaged for Claude Code and…
androguard/androguardReverse engineering and pentesting for Android applications
gojue/ecaptureCapturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
fkie-cad/fact_coreFirmware Analysis and Comparison Tool
amd2g2zz/kunglao-agentThe reverse-engineering expert agent: plans its own analysis path, derives every fact from raw evidence, and converges under mechanical verification…
idamcp/idamcpMCP server integrating IDA Pro with AI agents, featuring a stateless gateway for multi-session management, a relational SQL query engine for binary…
anpa1200/aidebugEvidence-focused malware reverse engineering with deep PE/.NET inspection, Ghidra reconstruction, AI cross-checks, YARA, and ELF debugging
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
tracebyte8/systraceLinux system-call monitor using ptrace to trace file, process, network, and memory activity, with namespace isolation and machine learning…
snyk/agent-scanSecurity scanner for AI agents, MCP servers and agent skills.
