Open Source Security Tools
Security tools help people find, assess, and reduce risks in software, networks, cloud environments, and digital services. They support tasks such as reviewing source code, detecting known vulnerabilities, mapping exposed assets, gathering public information, and testing defenses. Used throughout development and security operations, these tools can reveal weaknesses earlier and help teams understand their exposure, provided testing is authorized and findings are handled responsibly.
Open source options include static analyzers, dependency and vulnerability scanners, reconnaissance utilities, threat-detection tools, and penetration-testing frameworks. When choosing one, consider its license, maintenance activity, documentation, supported platforms, data handling, and fit with existing workflows. Check whether its findings are actionable and whether it requires specialist knowledge or infrastructure. These tools are useful to developers, security researchers, administrators, and organizations building or maintaining digital systems.
21 repositories · updated October 14, 2026
sliver: Run Cross-Platform Adversary Emulation
Sliver is a Go-based framework for authorized red-team testing, with cross-platform implants and multiple command-and-control options. It is actively maintained and suits teams that need to simulate adversary activity across macOS, Windows, and Linux.
ActiveHealth 66/100
SkillSpector: Scan AI Agent Skills for Security Risks
SkillSpector scans AI agent skills before installation, flagging suspicious instructions, risky code, and supply-chain issues. Use it for pre-install reviews, CI gates, or MCP-based scanning, with optional LLM analysis for context.
ActiveHealth 71/100
guardvibe: Scan AI-Written Code for Security Issues
GuardVibe is a local security scanner and MCP server for developers building with AI coding agents. It checks code, dependencies, configuration, and prompts, with rules tailored to modern web stacks.
ActiveHealth 41/100
llm-guard: Add Security Checks to LLM Interactions
LLM Guard is a Python toolkit for screening prompts and model outputs for risks such as prompt injection, harmful content, and sensitive data. It is archived, so consider it for existing integrations or evaluation, not as a maintained security layer.
ArchivedHealth 27/100
GHunt: Investigate Google Accounts and Assets with OSINT
GHunt is a Python framework for investigating Google-related data, including email addresses, Gaia IDs, Drive files, and BSSIDs. It suits OSINT researchers and authorized investigators who need CLI or library workflows with JSON export.
QuietHealth 35/100
malwoverview: Triage Malware and Hunt Threat Indicators
Malwoverview is a Python CLI for quickly investigating malware, files, URLs, IPs, domains, and vulnerabilities across threat-intelligence services. It combines local triage and IOC/YARA tools with optional API-backed lookups and AI enrichment.
ActiveHealth 41/100
PayloadsAllTheThings: Find Web Security Payloads and Bypass Techniques
A community-maintained reference of payloads and bypass techniques for web application security testing. Use it to research vulnerability scenarios, support authorized penetration tests, and find ready-to-use Burp Intruder files.
ActiveHealth 47/100
CloakQuest3r: Check for Exposed Origin IP Addresses
CloakQuest3r is a Python security research tool that checks whether websites behind Cloudflare or similar proxies may expose their origin IP. It combines subdomain scanning with historical IP and SSL certificate analysis for authorized defensive assessments.
QuietHealth 25/100
CertoraProver: Formally Verify Smart Contracts
Certora Prover checks smart contracts against formal specifications to find violations before deployment. It targets developers and security teams working with EVM-based chains, Solana, or Stellar who need automated verification.
ActiveHealth 57/100
QDoctor: Inspect Windows Systems for Rootkits and Threats
QDoctor is a Windows incident-response and anti-rootkit utility for examining system, process, kernel, network, and file activity. Responders can export structured host data for offline review or import it for investigation.
QuietHealth 15/100
Ghosting-AMSI: Intercept AMSI Scans Through RPC
Ghosting-AMSI is a PowerShell proof of concept for intercepting AMSI scan requests at the Windows RPC layer. It is aimed at security researchers studying AMSI and antivirus-provider communication, not routine application development.
InactiveHealth 17/100
Harden-Windows-Security: Apply Supported Windows Security Controls
A Windows security project with apps and guidance for hardening devices through built-in Microsoft security features. It covers system configuration, compliance checks, and application control for personal users and managed environments.
ActiveHealth 65/100