ai-security

usestrix/strix

Autonomous AI agents that hack and patch your app like a red team — Strix deploys autonomous AI agents that act like real attackers, running actual exploits to find and validate vulnerabilities in your application, then help fix them. It targets developers, security teams, and bug bounty hunters who want automated, agent-driven pentesting instead of manual testing.

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

KeygraphHQ/shannon

An AI agent that pentests code and only reports proven exploits — Shannon is an open-source agent that reads your source code, maps attack paths, and actually executes exploits against web apps and APIs rather than just flagging suspected issues—no exploit, no report. Run it locally via npx for CI/CD or pre-production security checks; useful for appsec and devsecops teams wanting automated, evidence-based pentesting.

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

NVIDIA/SkillSpector

Vetting AI agent skills for hidden vulnerabilities before install — SkillSpector scans Claude Code, Codex, and MCP skills for prompt injection, data exfiltration, and supply-chain risks using 71 patterns across 17 categories. Backed by a 31,132-skill dataset where 26.1% showed vulnerabilities and 5.2% likely malicious intent, it's built for teams installing untrusted agent skills.

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

openai/codex-security

OpenAI brings agentic scanning to app security workflows — A new CLI and TypeScript SDK from OpenAI that uses Codex to find, validate, and patch vulnerabilities. It supports deep repo scans, SARIF/JSON/CSV export, GitHub code scanning import, and CI automation, aimed at devsecops teams wanting agent-driven security reviews.

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

nolabs-ai/nono

agent runtime security - zero trust, zero setup, zero latency agent sandboxing

stacklok/toolhive

Containerized, policy-enforced MCP servers for production use — ToolHive runs MCP servers in isolated containers, applying per-request identity and access policy and cutting token usage up to 85% via semantic tool search. A Kubernetes operator adds IdP integration, OTel tracing, and audit logs, serving developers, platform engineers, and self-hosting enterprises.

ToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.

uber/ADR

Uber's open-sourced security stack for enterprise AI agents — ADR is Uber's production-deployed security system for agentic AI, now open-sourced with its MLSys 2026 paper. It covers discovery of AI tools, cross-platform observability for coding agents like Cursor and Claude Code, a 300+ task benchmark against 17 attack techniques, and a two-tier threat detector—useful for security teams managing enterprise AI agent risk.

ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.

pashov/skills

AI skills that automate Solidity security audits — A set of installable agent skills from Pashov Audit Group bringing fuzz-suite generation (Echidna/Medusa), pre-audit threat-model scanning, and automated vulnerability auditing to AI coding assistants. Aimed at smart contract developers and security researchers wanting quick, repeatable Solidity audit workflows inside tools like Claude Code.

Pashov Audit Group Skills

h5i-dev/h5i

Rust web framework that proves its own code and attacks itself — h5i combines an axum-based Rust web framework with Lean 4 formal verification and built-in red-teaming CLI tools. Developers can extract app logic into Lean proofs, mutation-test them, and separately run framework-independent recon, crawling and request-replay tools against any website for automated vulnerability discovery.

An Axum-based Rust web framework for building and verifying web apps with Lean 4, featuring optional GPU acceleration and integrated development infrastructure for red-teaming and CI/CD.

antropos17/Aegis

Local, Windows-first security dashboard for watching AI agents — AEGIS is an Electron/Svelte desktop app that monitors AI coding agents like Claude Code on your own machine: process trees, file and network activity, token usage, and anomaly scoring against rolling session baselines. It adds opt-in action policies and MCP gateways plus experimental Hyper-V guest execution, aimed at developers who want local-first oversight of agentic tools rather than a cloud service.

Windows-first desktop oversight for AI agents: live monitoring, local security reviews, token usage, audit reports and opt-in action policies/MCP gateways. Experimental Hyper-V guest execution; macOS/Linux experimental.