Data / Repositories / Pentesting
Pentesting repositories on GitHub: 22 ranked by stars
22 public repositories tagged Pentesting are on GitHub, with 97,297 stars between them; 8 had a push in the last 30 days. Most are written in Python (10), Rust (2), Shell (1). The most starred: bee-san/Ciphey (21,675), maurosoria/dirsearch (14,951), 0x4m4/hexstrike-ai (12,786).
SpecStream is the live web data engine for teams and agents. It reads open-source repositories on GitHub and keeps what it reads, and this page groups that reading by topic. Ask for the repositories you track by topic, language, license or activity, and new ones and changes arrive in your sheet, CRM, Slack or agent.
Every repository, most starred first
| Repository | What it is | Language | Stars | Forks | License | Last push | Read |
|---|---|---|---|---|---|---|---|
| bee-san/Ciphey | Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes | Rust | 21,675 | 1,447 | MIT | Oct 13 | Oct 14 |
| maurosoria/dirsearch | Web path scanner | Python | 14,951 | 2,453 | Oct 7 | Oct 14 | |
| 0x4m4/hexstrike-ai | HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting… | Python | 12,786 | 2,612 | MIT | Aug 3 | Oct 14 |
| six2dez/reconftw | reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities | Shell | 8,178 | 1,240 | MIT | Sep 26 | Oct 11 |
| infoslack/awesome-web-hacking | A list of web application security | 7,289 | 1,363 | MIT | Sep 18 | Oct 11 | |
| androguard/androguard | Reverse engineering and pentesting for Android applications | Python | 6,353 | 1,165 | Apache-2.0 | Oct 12 | Oct 14 |
| kaifcodec/user-scanner | (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors… | Python | 5,395 | 542 | MIT | Oct 14 | Oct 14 |
| arch3rPro/Pentest-Windows | Windows11 Penetration Suite Toolkit The First Windows Penetration Testing Environment on Mac M Chips | 3,600 | 343 | Jun 28, 2025 | Oct 11 | ||
| zinja-coder/jadx-ai-mcp | Plugin for JADX to integrate MCP server | Java | 2,895 | 268 | Apache-2.0 | Sep 23 | Oct 14 |
| danieldurnea/FBI-tools | OSINT Tools for gathering information and actions forensics | 2,700 | 379 | Mar 12, 2025 | Oct 11 | ||
| wgpsec/AboutSecurity | Everything for pentest. | 渗透测试知识库，以 AI Agent 可执行的格式沉淀安全方法论。 | Python | 1,790 | 248 | Oct 10 | Oct 14 | |
| miscusi-peek/cheatengine-mcp-bridge | Connect your favorite AI agents directly to Cheat Engine via MCP. Automate reverse engineering, pointer scanning, and memory analysis using natural language. | Lua | 1,640 | 233 | MIT | Aug 14 | Oct 14 |
| Berkanktk/CyberSecurity | A collection of essential and foundational cybersecurity knowledge, thoughtfully organized for easy comprehension. | Python | 1,612 | 137 | Feb 24 | Oct 11 | |
| six2dez/burp-ai-agent | Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more | Kotlin | 1,542 | 228 | MIT | Oct 13 | Oct 14 |
| bountyyfi/lonkero | Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust. | Rust | 1,104 | 92 | Aug 16 | Oct 14 | |
| H-mmer/pentest-agents | Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops… | Python | 1,008 | 188 | Jun 12 | Oct 14 | |
| Wh0am123/MCP-Kali-Server | MCP configuration to connect AI agent to a Linux machine. | Python | 848 | 171 | MIT | Mar 17 | Oct 14 |
| FuzzingLabs/mcp-security-hub | A growing collection of MCP servers bringing offensive security tools to AI assistants. Nmap, Ghidra, Nuclei, SQLMap, Hashcat and more. | Python | 800 | 102 | MIT | Apr 8 | Oct 8 |
| Puliczek/awesome-mcp-security | Awesome MCP (Model Context Protocol) Security | 743 | 274 | Mar 3 | Oct 14 | ||
| appsecco/vulnerable-mcp-servers-lab | A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers. | JavaScript | 279 | 57 | MIT | Dec 18, 2025 | Oct 14 |
| skyvanguard/awesome-ai-pentesting | A curated list of AI-powered pentesting tools, frameworks, MCP servers, and resources for autonomous cybersecurity operations | Python | 77 | 14 | MIT | Oct 9 | Oct 14 |
| badchars/cve-mcp | 23-tool MCP server for CVE & vulnerability intelligence. NVD, EPSS, CISA KEV, GitHub Advisory, OSV — unified in one server. Risk scoring, bulk triage, exploit search. 2… | TypeScript | 32 | 8 | MIT | Sep 17 | Oct 14 |
By language
- Python 10
Related topics
- Security 12
- MCP 10
- Hacking 9
- MCP server 8
- Cybersecurity 7
- Penetration testing 6
- Security tools 6
- Bug bounty 5
- Bugbounty 5
- Osint 5
- Python 4
- AI 4
Read from GitHub by SpecStream between October 8, 2026 and October 14, 2026; each row shows the day its repository was read. Stars and pushes change every day, and the GitHub page is the current one. Forks and archived repositories are left out.