PyPI · Go · npm
PurpleAILAB/Decepticon
Autonomous Hacking Agent for Red Team
Apache-2.0Aug 28, 2026 · metrics 2.10.0
All tags
Catalogue tag
#penetration-testing
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
41 records
npm
CyberStrikeus/CyberStrike
Open-source AI-augmented offensive security harness. 13+ autonomous agents, 150+ LLM providers, 5,300+ models, 7,600+ Ed25519-signed attack skills, 56+ built-in tools, 176+ MCP tools. MITRE ATT&CK, OWASP WSTG, CIS Benchmarks. Post-exploit: Linux/Windows/macOS/AWS/Azure/K8s/CI-CD. Web UI + Cloudflare Tunnel. Your AI red team.
AGPL-3.0Jul 23, 2026 · metrics 2.10.0
Go · Maven
praetorian-inc/titus
High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.
Apache-2.0Jul 19, 2026 · metrics 2.10.0
PyPI
usestrix/strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Apache-2.0Aug 5, 2026 · metrics 2.10.0
npm · RubyGems
dradis/dradis-ce
Dradis Framework: Collaboration and reporting for IT Security teams
GPL-2.0Sep 5, 2026 · metrics 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MITSep 6, 2026 · metrics 2.10.0
Go
goshs-labs/goshs
Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.
MITAug 13, 2026 · metrics 2.10.0
npm
pensarai/apex
AI-powered offensive security testing using autonomous agents, directly in your terminal.
Apache-2.0Sep 6, 2026 · metrics 2.10.0
Go
praetorian-inc/brutus
Fast, zero-dependency credential testing tool in Go. Brute force SSH, MySQL, PostgreSQL, Redis, MongoDB, SMB, and 20+ protocols. Hydra alternative with native nerva/naabu pipeline integration.
Apache-2.0Aug 7, 2026 · metrics 2.10.0
npm
KeygraphHQ/shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
AGPL-3.0Aug 5, 2026 · metrics 2.10.0
PyPI
infobyte/faraday
Open Source Vulnerability Management Platform
GPL-3.0Aug 29, 2026 · metrics 2.10.0
Go · npm
xalgord/xalgorix
Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
MITJul 17, 2026 · metrics 2.10.0
RubyGems
0dayInc/pwn
PWN is an open security automation framework that aims to stand on the shoulders of security giants, promoting trust and innovation.
MITSep 5, 2026 · metrics 2.10.0
npm
Null-Square/Null-CLi
Open-source AI pentest and compliance-readiness CLI by NullSquare.
Custom licenseAug 4, 2026 · metrics 2.10.0
PyPI · crates.io
maurosoria/dirsearch
Web path scanner
No licenseAug 19, 2026 · metrics 2.10.0
Go
Ullaakut/nmap
Idiomatic nmap library for go developers
MITJul 30, 2026 · metrics 2.10.0
PyPI
gamehunterkaan/autopwn-suite
AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.
Custom licenseJul 17, 2026 · metrics 2.10.0
Go
RAJANAGORI/Nightingale
Nightingale Docker for Pentesters is a comprehensive Dockerized environment tailored for penetration testing and vulnerability assessment. It comes preconfigured with all essential tools and utilities required for efficient Vulnerability Assessment and Penetration Testing (VAPT), streamlining the setup process for security professionals.
GPL-3.0Aug 4, 2026 · metrics 2.10.0
Go
go-appsec/interactsh-lite
Dependency-minimal Interactsh protocol client and server for out-of-band testing (OOB / OAST)
MITSep 5, 2026 · metrics 2.10.0
Go
go-appsec/toolbox
Collaborative application security testing between humans and agents via CLI and MCP
MITJul 17, 2026 · metrics 2.10.0
PyPI
ASCIT31/Dark-Moon
Autonomous AI pentesting engine, continuous offensive security across web, cloud, identity, CI/CD, IaC, databases, Active Directory, Kubernetes and IoT firmware. Agentic reasoning plus real exploit execution deliver proof-based vulnerabilities. Privacy gateway: the LLM never sees your real IPs, hosts or creds, nothing leaves your perimeter.
GPL-3.0Aug 4, 2026 · metrics 2.10.0
Go
zan8in/afrog
A Security Tool for Bug Bounty, Pentest and Red Teaming.
MITAug 28, 2026 · metrics 2.10.0
npm
pentoshi007/clai
Free AI coding & pentesting agent for your terminal
MITSep 5, 2026 · metrics 2.10.0
npm
KryptSec/oasis
Open-source AI security benchmarking CLI. Measure how AI models perform offensive security tasks with MITRE ATT&CK analysis and KSM scoring.
MITAug 28, 2026 · metrics 2.10.0
Go
go-harden/interactsh-lite
Dependency-minimal Interactsh protocol client and server for out-of-band testing (OOB / OAST)
MITJul 17, 2026 · metrics 2.10.0
—
mukul975/Anthropic-Cybersecurity-Skills
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Apache-2.0Aug 5, 2026 · metrics 2.10.0
Go
sayseven7/frameseven
Offensive web security scanner — OWASP Top 10 · MCP server · CLI · Go
MITAug 8, 2026 · metrics 2.10.0
—
Hacking-the-Cloud/hackingthe.cloud
An encyclopedia for offensive and defensive security knowledge in cloud native technologies.
Custom licenseAug 4, 2026 · metrics 2.10.0
Go
ddddddO/packemon
Packet monster (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ) TUI tool for sending packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). Windows/macOS/Linux
BSD-2-ClauseJul 20, 2026 · metrics 2.10.0
npm
Hyperyond/Hover
Open-source Vibe Testing suite: an MCP server for the coding agent you already run, a VS Code review cockpit, and CI. Your agent explores your app and crystallizes each flow into a plain @playwright/test spec you own — record == replay, runs in CI with zero AI.
Apache-2.0Sep 5, 2026 · metrics 2.10.0