Go · npm · PyPI
networking-incubator/coraza-kubernetes-operator
Web Application Firewall (WAF) for Kubernetes Gateways
Apache-2.0Sep 18, 2026 · metrics 2.10.0
All tags
Catalogue tag
#owasp
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
88 records
npm · PyPI
Agent-Threat-Rule/agent-threat-rules
Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable rules across 10 categories; merged into Microsoft AGT, Cisco AI Defense, MISP, OWASP, FINOS & SigmaHQ. MIT-licensed.
MITSep 9, 2026 · metrics 2.10.0
Go
CycloneDX/cyclonedx-go
Go library to consume and produce CycloneDX Software Bill of Materials (SBOM)
Apache-2.0Sep 23, 2026 · metrics 2.10.0
NuGet · RubyGems
GaProgMan/OwaspHeaders.Core
Inject OWASP recommended HTTP Headers for increased security in a single line
MITSep 27, 2026 · metrics 2.10.0
npm
KeygraphHQ/shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
AGPL-3.0Sep 16, 2026 · metrics 2.10.0
NuGet
Lombiq/UI-Testing-Toolbox
Web UI testing toolbox for Orchard Core applications with Selenium. It discovers so many issues that you'll get impostor syndrome.
BSD-3-ClauseSep 10, 2026 · metrics 2.10.0
Go
airomhq/airom
Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
cfgaudit/cfgaudit
Static security auditor for AI-agent configuration: Claude Code, MCP servers, Cursor, Codex, Copilot, Gemini CLI and more. 109 rules, SARIF output, OWASP LLM Top 10 mapping.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
Maven
CycloneDX/cyclonedx-maven-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
Apache-2.0Sep 14, 2026 · metrics 2.10.0
PyPI
jimmy058910/jmo-security-repo
JMo Security Suite - Terminal-first security audit toolkit with many tools, multi-target scanning, & compliance
Custom licenseSep 15, 2026 · metrics 2.10.0
—
owasp-noir/noir
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
MITSep 16, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-esbuild
Create CycloneDX Software Bill of Materials (SBOM) from projects built with esbuild or Bun.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
coreruleset/crs-linter
Rules checker and linter for the CRS project
Apache-2.0Sep 26, 2026 · metrics 2.10.0
Go
glsec/glsec
Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
PyPI · npm
PrismorSec/prismor
Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
Apache-2.0Sep 11, 2026 · metrics 2.10.0
—
CycloneDX/cyclonedx-cli
CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
PyPI
OWASP/Agent-Security-Regression-Harness
Executable security regression testing for agentic applications and MCP-integrated systems.
Apache-2.0Sep 20, 2026 · metrics 2.10.0
npm
lua-ai-global/governance
Zero-dependency TypeScript SDK for AI agent governance: policy enforcement, injection detection, tamper-evident audit, and standards mapping (EU AI Act, OWASP, NIST, ISO 42001)
MITSep 13, 2026 · metrics 2.10.0
npm
willfarrell/sast-json-schema
Meta-schema for the Static Application Security Testing (SAST) of JSON Schemas
MITSep 20, 2026 · metrics 2.10.0
NuGet
CycloneDX/cyclonedx-dotnet-library
.NET library to consume and produce CycloneDX Software Bill of Materials (SBOM)
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go · npm
CycloneDX/sbom-utility
Utility that provides an API platform for validating, querying and managing BOM data
Apache-2.0Oct 21, 2026 · metrics 2.10.0
npm
greenarmor/gesf
Compliance-as-Code framework that automatically enforces mostly all engineering standards.
MITSep 18, 2026 · metrics 2.10.0
PyPI
marshallguillory86/secure-code-agent
Deterministic security gate + bounded AI remediation prompts. NIST SSDF / OWASP ASVS / CWE Top 25 anchored. The security sibling to maintainability-agent.
MITOct 5, 2026 · metrics 2.10.0
npm · PyPI
sinewaveai/agent-security-scanner-mcp
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
MITOct 9, 2026 · metrics 2.10.0
npm
Null-Square/Null-CLi
Open-source AI pentest and compliance-readiness CLI by NullSquare.
Custom licenseSep 16, 2026 · metrics 2.10.0
PyPI
msaleme/red-team-blue-team-agent-fabric
AI agent security harness, adversarial testing: 623 executable tests in the v4.21.3 release, across MCP, A2A, x402/L402, decision governance, benchmark integrity, human-in-the-loop, skill supply chain. Four target shapes: a verdict must be able to be wrong AND to be right. OWASP Agentic v1.1 T1-T17, AIUC-1 19/20 (2026-Q1/Q2 set), NIST AI 800-2.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
npm
this-is-securl/securl
SecURL - passive external security posture scanner. Free hosted scanner, open-source engine, CI integration
MITSep 8, 2026 · metrics 2.10.0
PyPI
crucible-security/crucible
pytest for AI agents - Autonomous red-teaming, behavioral monitoring & security testing for LLM agents
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Go
RAJANAGORI/Nightingale
Nightingale Docker for Pentesters is a comprehensive Dockerized environment tailored for penetration testing and vulnerability assessment. It comes preconfigured with all essential tools and utilities required for efficient Vulnerability Assessment and Penetration Testing (VAPT), streamlining the setup process for security professionals.
GPL-3.0Sep 16, 2026 · metrics 2.10.0
PyPI · npm
vaquarkhan/MCP-Bastion
MCP-Bastion: The Zero-Infrastructure Runtime Middleware ,Enterprise-Grade Security Middleware for the Model Context Protocol (MCP)
Custom licenseSep 18, 2026 · metrics 2.10.0