crates.io80Excellenthealth index
Rust★ 1↓ 23.2K/moSep 13, 2026
Go80Excellenthealth index

catnet-io/engineCatNet engine — Go scanning engine, zero external dependencies, event-driven channel API
Go★ 0Sep 12, 2026
npm · PyPI78Goodhealth index

sinewaveai/agent-security-scanner-mcpSecurity scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
JavaScript · Python · TypeScript★ 122↓ 2,960/moOct 9, 2026
TypeScript · YARA★ 0↓ 17.4K/moSep 16, 2026

this-is-securl/securlSecURL - passive external security posture scanner. Free hosted scanner, open-source engine, CI integration
TypeScript · JavaScript★ 3↓ 718/moSep 8, 2026

agentgg-dev/agentggOpen source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own model.
TypeScript★ 300↓ 5,835/moSep 17, 2026
C# · Inno Setup★ 4,567Sep 30, 2026
Python★ 32↓ 3,376/moOct 21, 2026
TypeScript★ 137↓ 82.4K/moSep 15, 2026
crates.io · PyPI75Goodhealth index

jsinger67/scnr2Scanner/lexer with sufficient regex support and multiple scanner modes
Rust★ 3↓ 45K/moSep 15, 2026
Python · JavaScript★ 1,097↓ 137/moSep 9, 2026

abpai/harness-doctorFramework-agnostic agent-harness doctor: deterministic checks for good agent-harness practices
TypeScript★ 0↓ 19.4K/moSep 13, 2026
Python★ 3,956↓ 3,481/moSep 16, 2026
crates.io · npm71Goodhealth index
Rust★ 39↓ 960/moSep 18, 2026

manthanghasadiya/mcpsecAn AI-driven dynamic protocol fuzzer for the Model Context Protocol (MCP). Prove runtime exploitability by discovering state violations, transport crashes, and application-layer logic flaws (SSRF, LFI) before your AI agents do.
Python★ 24↓ 182/moSep 14, 2026

prodlint/prodlintYour vibe-coded app has hardcoded secrets, missing auth, and hallucinated imports. Find out in under a second.
TypeScript★ 15↓ 4,886/moSep 18, 2026
TypeScript · JavaScript★ 15↓ 19.5K/moSep 29, 2026
TypeScript★ 1↓ 2,985/moOct 16, 2026
Packagist67Goodhealth index
PHP★ 18↓ 2,358/moSep 18, 2026
Python★ 13↓ 3,463/moOct 1, 2026
Go★ 14Sep 17, 2026
TypeScript★ 0↓ 6,068/moSep 11, 2026

x-stp/rxdsMassively concurrent TLS certificate harvester with Feistel-permuted IPv4 scanning, template ClientHello, go from SSLv2 all the way to TLS1.3. JARM fingerprinting? Included.
Go★ 2Sep 8, 2026
Go · npm63Moderatehealth index

Autumn-27/ScopeSentryScopeSentry-Cyberspace mapping, subdomain enumeration, port scanning, sensitive information discovery, vulnerability scanning, distributed nodes
Go · Vue · TypeScript★ 1,624Sep 18, 2026
npm63Moderatehealth index

calllint/calllintPre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
TypeScript · HTML★ 2↓ 859/moSep 15, 2026
NuGet63Moderatehealth index
C#★ 126Oct 7, 2026
npm63Moderatehealth index
Shell · TypeScript★ 111↓ 42.4M/moAug 27, 2026
Packagist62Moderatehealth index

hryagstn/laravel-scalpelA zero-dependency, filesystem-level forensic scanner that detects signs of compromise in your Laravel application — obfuscated backdoors, rogue PHP files, tampered .htaccess directives, missing .env files, and unexpected filesystem changes.
PHP★ 29↓ 3,787/moSep 6, 2026
PyPI62Moderatehealth index

spark1security/n0s1Secret Scanner for Slack, Jira, Confluence, Asana, Wrike, Linear, Zendesk, GitHub, and GitLab
Python★ 80↓ 238/moSep 19, 2026
npm62Moderatehealth index

subodhkc/mcp-tenant-isolationStatic analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server, SARIF output, and GitHub Action.
TypeScript★ 4↓ 17.9K/moSep 20, 2026