#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
gitleaks/gitleaksFast, open-source static analysis tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repositories, files, and stdin…
owasp/owasp-top-10-ai-infrastructure-security-risksA practical framework identifying and prioritizing the top security risks in AI datacenter infrastructure, covering hardware, networking, management…
cosai-oasis/ws4-secure-design-agentic-systemsRepository for CoSAI Workstream 4, Secure Design Patterns for Agentic Systems
aquasecurity/trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
bkuan001/halo-recordTamper-evident audit trails for AI agents: hash-chained Runtime Records, dependency-free, verifiable by anyone.
owasp/trisuella-aidlca-frameworkPolicy-governed LLMSecOps framework providing AST-based SAST, secret scanning, supply-chain and multi-cloud CSPM checks, AI-BoM generation, and CI/CD…
trailofbits/ficklingA Python pickling decompiler and static analyzer
asteroid-belt/skultoOffline and security-first tool for syncing and managing agent skills
snyk/agent-scanSecurity scanner for AI agents, MCP servers and agent skills.
prismorsec/prismorSelf-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt…
pypa/advisory-databaseCommunity-owned database of security advisories for Python packages on PyPI, providing structured vulnerability data in OSV format for integration…
renich/pyriteHardware-bound & Cloud-gated binary execution, cryptographic provenance, and anti-tamper envelope sealing for Crystal.
aaravmaloo/reveraThe credit score for npm packages. Analyze package reputation, maintenance, security, publisher trust, and ecosystem health before you install any…
swelljoe/flarLightweight CLI tool that runs AI coding agents inside isolated Bubblewrap sandboxes with strict filesystem, network, and credential isolation to…
owasp/sbom-vex-taint-analysisAutomated SBOM-to-VEX pipeline using a secure multi-agent AI system to analyze CVEs, reason about exploitability, and generate signed CycloneDX VEX…
owasp/docksecAI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.
fabriziosalmi/tanstack-compromise-checkerShell script to detect TanStack npm supply chain attack indicators (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx)
ransomleak/training-application-securityInteractive secure coding training with hands-on SCORM exercises covering OWASP Top 10 web and API vulnerabilities, Git/secrets exposure, and…
