Tools

zaproxy/zaproxy

Open-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…

saffron-health/libretto

The AI toolkit for building reliable browser automations

nuguardai/nuguard

opensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis

go-appsec/toolbox

Collaborative application security testing between humans and agents via CLI and MCP

kerlenton/mcpsnoop

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal.

curtail-inc/hello-regrade-security

Find the vulnerability your tests were never written to catch. A ReGrade demo modeling CVE-2023-5968: catch a password-hash leak by comparing an app…

mitmproxy/mitmproxy

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

mobsf/mobile-security-framework-mobsf

Automated mobile application security testing framework for Android, iOS, and Windows. Performs static and dynamic analysis, malware detection, and…

traceforce/mcp-xray

Unified security scanner for MCP servers with config, pentest, and repo-scan modes. Generates SARIF reports for CI/CD integration, detects secrets,…

owasp/mastg

Comprehensive OWASP guide for mobile app security testing, reverse engineering, and verifying MASVS/MASWE weaknesses through static, dynamic, and…

jp/hermes-proxy

Hermes Proxy - HTTP Traffic Analyzer

owasp/vulnreach

Runtime-aware SCA — proves which CVEs are actually reachable, not just installed.

hahwul/mzap

⚡️ Multiple target ZAP Scanning

foxvr-sudo/bug-bounty-arsenal-v.3

50+ detectors across 10 categories, with continuous monitoring built in: schedule recurring scans, get alerted only on new findings, track your…

silentchainai/silentchain

AI-powered vulnerability scanner extension for Burp Suite with multi-provider support (Ollama, OpenAI, Claude, Gemini)

kaisonox/apiscope

An API hooking framework for intercepting and monitoring Windows applications

use-tusk/tusk-cli

Automated testing suite with live traffic record and replay

weirdmachine64/redom

A Burp Suite extension that brings full DOM rendering capabilities directly into Burp, enabling effective security testing of modern JavaScript-heavy…