Security & Testing Listings
Compare the best open-source listings for security & testing. Scanners, pentest helpers and test automation. Ranked by GitHub stars, with install commands, what each one can touch and scan reports where available.
Adrian
Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.
Claude Code Skills
Standalone skills for Claude Code and Codex: product discovery, architecture, implementation, technical foundations, reviews and delivery, with explicit scope and verification.
Super Board
Autonomous GitHub Project build → QA → review loop for Claude Code. One-line install.
Mitsu
Meet Mitsu, your chibi red-team operator. Connect your AI provider, set the scope, and she can take an authorized pentest from recon and attack-surface mapping through vulnerability discovery, > exploitation, and post-exploitation, armored with 165+ MCP-connected tools and live session intel. Guide every step or let her pwn autonomously. ( ◠‿◠)
MCP Ssh Manager
MCP server for SSH: let Claude Code, Codex and any MCP client run commands, transfer files and manage servers over SSH, with human approval, an encrypted vault and a live audit trail. Desktop app and CLI included.
Flounder
Autonomous white-hat security auditor for AI-driven code review, bug bounty research, exploit construction, and execution-grounded verification.
Blitzstrike
Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report.
Swift Testing Agent Skill
An agent skill focused entirely on Swift Testing, helping you write better tests, migrate from XCTest, improve test architecture, and adopt modern Swift testing patterns with confidence.
Swift Testing Agent Skill
Swift Testing agent skill for Claude Code, Codex, and other AI tools.
Mcpmark
MCPMark is a comprehensive, stress-testing MCP benchmark designed to evaluate model and agent capabilities in real-world MCP use.
AgentHound
Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.
Claude Code Owasp
Claude Code skill for OWASP security best practices (2025-2026). Includes Top 10:2025, ASVS 5.0, Agentic AI security, and 20+ language-specific security quirks.
Evil Winrm Py
Execute commands interactively on remote Windows machines using the WinRM protocol (just faster)
Laradashboard
⚡ Lara Dashboard - CMS by Laravel - All In One solution to start your Laravel Application from Basic to Enterprise. Manages Users, Roles, Permissions, Modules, Settings, Translations, Contents, Monitoring and every actions of your Laravel application. Complete solution for Laravel application with Tailwind, Livewire, Rest API, Unit-Tests and more.
Vigil
Vigil SOC: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.
Gravitas
Make Gemini code like Claude Models. Forces it to inspect files before editing, plan changes, test its work, and back up every “done” with actual evidence.
Offensive Claude
Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest
Sapper V2
Autonomous pentest legion — AI commander + worker swarm + layered fact-intent graph. 3rd Tencent Intelligent Attack-Defense online champion (634 teams · 8h unattended · 1B tokens beat 4.5B). The Nüwa Test: give AIs Create/Language/History, let a civilization grow.
Flutter Skill
AI-powered E2E testing for 10 platforms. 253 MCP tools. Zero config. Works with Claude, Cursor, Windsurf, Copilot. Test Flutter, React Native, iOS, Android, Web, Electron, Tauri, KMP, .NET MAUI — all from natural language.
Agent Skills Guard
一款提供Agent Skills安全扫描和可视化管理的桌面应用 | A desktop application that provides security scanning and visual management for Agent Skills.
BugTraceAI
Open-source, self-hosted web pentesting suite with agentic scanning, analyst tools, API testing, model checkpoints and MCP integrations.
Finding Unknowns Skills
14 installable skills for Claude Code, OpenAI Codex, and Hermes: find unknowns, clarify requirements, manage context, test assumptions, and verify bug fixes with regression evidence.
Tracekit
Tamper-evident tracing, policy gates and cross-checks for AI agents: see what the agent did, and why.
H1 Brain
MCP server that connects AI assistants to HackerOne for bug bounty hunting
List refreshed November 15, 2026. Data comes from public GitHub repositories.