Tools

keygraphhq/shannon

Shannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…

usestrix/strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

silentchainai/silentchain

AI-powered vulnerability scanner extension for Burp Suite with multi-provider support (Ollama, OpenAI, Claude, Gemini)

vigolium/vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

nuguardai/nuguard

opensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis

momenbasel/vulnhawk

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.

ananay/wp2shell-lab

Validation target: minimal WordPress core slice reproducing the wp2shell (CVE-2026-63030 + CVE-2026-60137) REST-to-SQLi chain

use-tusk/tusk-cli

Automated testing suite with live traffic record and replay

offensive360/sast-scan-action

GitHub Action for Offensive360 SAST scans and SARIF results. See the open-source program for eligibility and setup.

traceforce/mcp-xray

Unified security scanner for MCP servers with config, pentest, and repo-scan modes. Generates SARIF reports for CI/CD integration, detects secrets,…

skysliently/cve-2022-22947-pb-ai

一个由AI生成的漏洞验证应用

offensive360/mcp-server

MCP server that runs SAST scans on local codebases and returns findings with severity and fixes, enabling AI assistants to perform security analysis…

owasp/agent-security-regression-harness

Executable security regression testing for agentic applications and MCP-integrated systems.

agentsid-dev/agentsid-scanner

Security scanner for MCP servers. Grades auth, permissions, injection risks, and tool safety. The Lighthouse of agent security.

trailofbits/slither-mcp

MCP server for Slither static analysis of Solidity smart contracts

ronf98/cve-2024-11972-poc

CVE-2024-11972 in Hunk Companion <1.9.0 allows unauthenticated attackers to exploit insecure REST API endpoints and install vulnerable plugins,…

csinexus/mcpshield

Drop-in fix for the unpatched MCP STDIO command-injection flaw (CVE-2026-30623 family)