Security

NPMscan MCP Plugin

The Big Brother is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.

Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.

Plugin for JADX to integrate MCP server

Fast, zero-dependency credential testing tool in Go. Brute force SSH, MySQL, PostgreSQL, Redis, MongoDB, SMB, and 20+ protocols. Hydra alternative with native nerva/naabu pipeline integration.

hydra

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening

Checklist of the most important security countermeasures when designing, testing, and releasing your API

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

Web path scanner

Claude Skills for Governance, Risk, & Compliance (GRC): Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, EU AI Act, ISO 42001, ISO 27701, DORA, CSRD, India's DPDPA, CMMC 2.0, NIST AI Risk, SWIFT, CCPA/CPRA, and others. Benchmark 89% (with skills) vs 55% (without skills). Updated Monthly.

Bug Bounty Methodology

Web-based Traffic and Cybersecurity Network Traffic Monitoring

Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.

Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

📡 Comprehensive collection of OSINT tools for cybersecurity professionals, researchers, and bug bounty hunters. Topics: information gathering, reverse search, red team, trust & safety, AI.

CVE2PoC is a tool that helps penetration testers, bug hunters, and security researchers quickly find public exploits or PoCs related to a CVE ID

Cameradar hacks its way into RTSP videosurveillance cameras

Scapy: the Python-based interactive packet manipulation program & library.

Dark Web OSINT Tool

🔍 Search anyone's digital footprint across 300+ websites

Local-first AI red team for web, API, and LLM application security. Attacker-style reasoning, evidence-backed findings, and skills for AI coding agents.

Rent the model. Own everything else. Free, open-source AI app for real work.

Community guide to securing and improving privacy on macOS.

The agentic pentesting environment that lives on your machine. AI agent teams, visual workflows and your own tools, 100% local.

AI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App integration. 🛡️

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

A static analysis security vulnerability scanner for Ruby on Rails applications

Open-source sandboxed agent harness for teams. Giving every employee a secured personal agent.

Automation to assess the state of your M365 tenant against CISA's baselines

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.

🔎 Username, email & phone OSINT — 9,700+ lookup checks from 19 projects, with profile enrichment, bulk searches, evidence graphs and expert-reviewed updates.

Security Scanner for Agent Skills

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.

A curated list of tools for incident response

Directory/File, DNS and VHost busting tool written in Go

🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

The OSINT toolkit for AI agents: Agent Skill, MCP server and CLI. Passive by default, no API keys to start, every finding cites its tool call.

Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.

A curated list of various bug bounty tools

Automated Adversary Emulation Platform

AI jailbreaks: 35 paste-ready AI jailbreak prompts for 25+ frontier and open-weight models - system prompts, AGENTS.md specs, and Ollama Modelfiles. Built for AI security research and red-team testing.

Reverse engineering and pentesting for Android applications

SOC, incident response and SecOps for Linux servers in one agent: learns each host, watches it with zero-token sensors, triages with a small model, and contains attacks under a root-owned policy. Optional hub for fleets.

Rust MCP server for comprehensive code intelligence - 90 tools, 32 languages, security scanning, call graphs, and more

Pentest Harness — Heaven for Hackers. A self-hosted AI agent harness for authorized pentests, bug bounty, security labs, and CTFs. Bring your own AI model API; sessions stay local.

List of API's for gathering information about phone numbers, addresses, domains etc

Vulnerability Intelligence Platform