Tools

facebook/mariana-trench

A security focused static analysis tool for Android and Java applications.

agent-field/sec-af

AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and actionable evidence.

keygraphhq/shannon

Shannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…

usestrix/strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

vigolium/vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

frida/frida

Main repo for hosting release binaries

nuguardai/nuguard

opensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis

symbioticsec/hermes-decomp

A powerful decompiler that lets you reverse-engineer React Native mobile apps by converting their compiled Hermes bytecode (.hbc) files back into…

pascal-lab/tai-e

An easy-to-learn/use static analysis framework for Java and Android

mobsf/mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and…

zinja-coder/jadx-ai-mcp

Plugin for JADX to integrate MCP server

traceforce/mcp-xray

Unified security scanner for MCP servers with config, pentest, and repo-scan modes. Generates SARIF reports for CI/CD integration, detects secrets,…

theopaid/cve-2026-66746-http-response-splitting-via-unvalidated-response-header-values-rouille-

Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values (rouille)

owasp/agent-security-regression-harness

Executable security regression testing for agentic applications and MCP-integrated systems.

ananay/wp2shell-lab

Validation target: minimal WordPress core slice reproducing the wp2shell (CVE-2026-63030 + CVE-2026-60137) REST-to-SQLi chain

oscerd/cve-2026-46455

Reproducer for CVE-2026-46455 — Apache Camel camel-keycloak missing TokenVerifier.IS_ACTIVE check (expired access tokens accepted)