Data / Repositories / Cybersecurity / Python
Python Cybersecurity repositories on GitHub: 14 ranked by stars
14 public Python repositories tagged Cybersecurity are on GitHub, with 82,780 stars between them; 10 had a push in the last 30 days. The most starred: usestrix/strix (68,539), kaifcodec/user-scanner (5,395), OpenOSINT/OpenOSINT (1,753).
SpecStream is the live web data engine for teams and agents. It reads open-source repositories on GitHub and keeps what it reads, and this page groups that reading by topic. Ask for the repositories you track by topic, language, license or activity, and new ones and changes arrive in your sheet, CRM, Slack or agent.
Every repository, most starred first
| Repository | What it is | Stars | Forks | License | Last push | Read |
|---|---|---|---|---|---|---|
| usestrix/strix | Open-source AI penetration testing tool to find and fix your app’s vulnerabilities. | 68,539 | 7,595 | Apache-2.0 | Oct 14 | Oct 14 |
| kaifcodec/user-scanner | (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors… | 5,395 | 542 | MIT | Oct 14 | Oct 14 |
| OpenOSINT/OpenOSINT | AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only. | 1,753 | 278 | MIT | Oct 13 | Oct 14 |
| mukul975/cve-mcp-server | Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more. | 1,624 | 269 | Apache-2.0 | Oct 1 | Oct 14 |
| Berkanktk/CyberSecurity | A collection of essential and foundational cybersecurity knowledge, thoughtfully organized for easy comprehension. | 1,612 | 137 | Feb 24 | Oct 11 | |
| morluto/awesome-reverse-engineering | Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols. | 1,052 | 239 | CC0-1.0 | Oct 20 | Oct 21 |
| marc-shade/world-intel-mcp | 139-tool MCP server for real-time global intelligence from free public APIs: markets, SEC filings, conflict, military, aircraft-cohort early warning, refugee and migration flows… | 944 | 153 | MIT | Oct 12 | Oct 14 |
| FuzzingLabs/mcp-security-hub | A growing collection of MCP servers bringing offensive security tools to AI assistants. Nmap, Ghidra, Nuclei, SQLMap, Hashcat and more. | 800 | 102 | MIT | Apr 8 | Oct 8 |
| google/mcp-security | 532 | 146 | Apache-2.0 | Oct 6 | Oct 14 | |
| gensecaihq/Wazuh-MCP-Server | Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001)… | 251 | 65 | MIT | Oct 9 | Oct 14 |
| gensecaihq/pfsense-mcp-server | Model Context Protocol (MCP) server for pfSense firewall management. Control firewall rules, VPNs, DNS, DHCP and diagnostics in natural language from Claude Desktop, Claude Code… | 108 | 21 | MIT | Oct 9 | Oct 14 |
| zoomeye-ai/mcp_zoomeye | A Model Context Protocol server that provides network asset information based on query conditions. This server allows LLMs to obtain network asset information and supports… | 82 | 19 | Sep 9 | Oct 14 | |
| skyvanguard/awesome-ai-pentesting | A curated list of AI-powered pentesting tools, frameworks, MCP servers, and resources for autonomous cybersecurity operations | 77 | 14 | MIT | Oct 9 | Oct 14 |
| olanokhin/openresearch-mcp | Zero-auth, security-hardened cross-domain research MCP server: web, academic, GitHub, news, weather, macro/finance, SEC, biomedical, Bluesky, YouTube. SSRF and prompt-injection… | 11 | 1 | Apache-2.0 | Jul 8 | Oct 14 |
Other languages
- TypeScript 4
- Go 3
Related topics
- Security 20
- MCP 12
- Osint 9
- Model Context Protocol 9
- Hacking 8
- Awesome list 8
- Pentesting 7
- Threat intelligence 7
- Claude 7
- MCP server 7
- Security automation 6
- Security tools 6
Every Cybersecurity repository
Read from GitHub by SpecStream between October 8, 2026 and October 21, 2026; each row shows the day its repository was read. Stars and pushes change every day, and the GitHub page is the current one. Forks and archived repositories are left out.