Open Source Security Projects
Security is the practice of protecting systems, networks, applications, and information from unauthorized access, disruption, and misuse. It includes preventing attacks, identifying weaknesses, monitoring activity, and responding to incidents. Security tools help individuals and organizations reduce risk, safeguard privacy, control access, and maintain reliable services as threats and technology change.
Open source security tools range from vulnerability scanners and threat intelligence resources to encryption, network protection, access management, and isolated testing environments. When choosing a tool, consider its maturity, license, maintenance activity, documentation, system requirements, and compatibility with your existing workflows. Review how it handles sensitive data and whether it supports your threat model. These tools are useful to developers, security researchers, administrators, and anyone responsible for protecting digital systems.
156 repositories · updated October 17, 2026
sliver: Run Cross-Platform Adversary Emulation
Sliver is a Go-based framework for authorized red-team testing, with cross-platform implants and multiple command-and-control options. It is actively maintained and suits teams that need to simulate adversary activity across macOS, Windows, and Linux.
ActiveHealth 66/100
caldera: Automate Adversary Emulation and Red-Team Operations
Caldera is a self-hosted platform for emulating adversary behavior using the MITRE ATT&CK framework. It combines a command-and-control server, web interface, and extensible plugins for security testing and incident response.
ActiveHealth 58/100
sandbox-runtime: Restrict Process Access Without Containers
Anthropic Sandbox Runtime wraps processes with OS-enforced filesystem and network restrictions, aimed especially at AI agents and MCP servers. It is actively maintained, but remains a beta research preview with platform-specific setup and limitations.
ActiveHealth 66/100
OpenShell: Run AI Agents in Policy-Controlled Sandboxes
OpenShell runs autonomous AI agents in isolated sandboxes and applies policies to their file, process, and network access. It suits teams that need agents to use tools and credentials without unrestricted access to host data or services.
ActiveHealth 78/100
shoreguard: Manage NVIDIA OpenShell Agent Sandboxes
ShoreGuard adds a web UI, REST API, and Terraform workflow for managing NVIDIA OpenShell sandboxes, policies, and routed inference. It suits teams operating multiple gateways that need centralized access controls and auditability.
QuietHealth 25/100
nanoclaw: Run Secure AI Agents in Messaging Apps
NanoClaw runs AI assistants in isolated containers and connects them to messaging channels and scheduled tasks. It suits individuals who want a compact, customizable assistant they can inspect and adapt, with container-based boundaries around agent access.
ActiveHealth 68/100
seclab-taskflow-agent: Define AI Workflows in YAML
A Python framework and CLI for building multi-agent workflows from YAML, with MCP tools and configurable model backends. It is aimed at security research, code auditing, and other repeatable agent tasks.
ActiveHealth 45/100
AgentSec: Audit AI Agent Workflows for Security Risks
AgentSec statically analyzes AI agent workflows for excessive permissions and paths from untrusted input to dangerous capabilities. It is aimed at developers and security teams reviewing supported agent frameworks before deployment or as part of CI.
ActiveHealth 32/100
shepherd: Supervise Agents with Reversible Execution Traces
Shepherd records agent work as inspectable, reversible execution traces and keeps changes as proposals for review. It is aimed at developers building systems that supervise, replay, or manage the work of other agents.
NewHealth 42/100
agent-anvil: Test AI Agent Tool Use in CI
Agent Anvil evaluates tool-using AI agents through scenario-based runs, trace checks, and optional semantic grading. It helps teams catch unsafe or incorrect tool behavior before it reaches production.
NewHealth 42/100
e2a: Email API for Applications and AI Agents
e2a provides an email API and relay for applications and AI agents. It supports transactional sending, inbound mailboxes, and agent replies, with optional human review and hosted or Docker-based deployment.
NewHealth 63/100
bernstein: Govern and Orchestrate AI Agents
Bernstein coordinates AI-agent workloads through declarative policies, approval gates, and isolated task execution. It records runs for replay and offline verification, helping teams that need accountable, auditable automation.
ActiveHealth 80/100