Skip to the page

Data / Repositories / Security

Security repositories on GitHub: 108 ranked by stars

108 public repositories tagged Security are on GitHub, with 729,809 stars between them; 69 had a push in the last 30 days. Most are written in Python (33), Rust (16), TypeScript (15). The most starred: trimstray/the-book-of-secret-knowledge (249,092), usestrix/strix (68,539), slimtoolkit/slim (23,427).

SpecStream is the live web data engine for teams and agents. It reads open-source repositories on GitHub and keeps what it reads, and this page groups that reading by topic. Ask for the repositories you track by topic, language, license or activity, and new ones and changes arrive in your sheet, CRM, Slack or agent.

Every repository, most starred first

RepositoryWhat it isLanguageStarsForksLicenseLast pushRead
trimstray/the-book-of-secret-knowledgeA collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.249,09214,474MITNov 19, 2024Oct 11
usestrix/strixOpen-source AI penetration testing tool to find and fix your app’s vulnerabilities.Python68,5397,595Apache-2.0Oct 14Oct 14
slimtoolkit/slimSlim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)Go23,427847Apache-2.0Sep 19Oct 14
chaitin/SafeLineSafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.Go22,7201,547GPL-3.0Sep 28Oct 8
drduh/macOS-Security-and-Privacy-GuideCommunity guide to securing and improving privacy on macOS.Shell22,5421,465MITOct 1Oct 11
gravitational/teleportThe easiest, and most secure way to access and protect all of your infrastructure.Go20,9892,174AGPL-3.0Sep 17Oct 14
prowler-cloud/prowlerProwler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.Python15,0302,433Apache-2.0Oct 14Oct 14
sbilly/awesome-securityA collection of awesome software, libraries, documents, books, resources and cools stuffs about security.14,9672,417MITJan 11Oct 11
maurosoria/dirsearchWeb path scannerPython14,9512,453Oct 7Oct 14
bytebase/bytebaseDatabase governance built for humans and agents — controlling changes and access across every major database.Go14,564992Oct 14Oct 14
kubescape/kubescapeKubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration…Go11,7981,061Apache-2.0Oct 14Oct 14
majd/ipatoolCommand-line tool that allows you to search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps on the App Store, and download .ipa or macOS .pkg app packages.Go11,677985MITOct 11Oct 14
shadowsocks/shadowsocks-rustA Rust port of shadowsocksRust10,9271,457MITOct 11Oct 11
monero-project/moneroMonero: the secure, private, untraceable cryptocurrencyC++10,9163,534Oct 8Oct 11
lissy93/awesome-privacyA curated list of privacy & security-focused software and servicesAstro9,945674CC0-1.0Oct 10Oct 11
ashishb/android-security-awesomeA collection of android security related resourcesMakefile9,7431,581Apache-2.0Oct 6Oct 11
meirwah/awesome-incident-responseA curated list of tools for incident response9,4421,753Apache-2.0Jul 15Oct 11
superradcompany/microsandboxeasy, fast, programmable and local-first microVM runtime and libraryRust8,679479Apache-2.0Oct 14Oct 14
firerpa/lamdaAndroid Full-Stack Device Control Platform: WebRTC/H.264 remote desktop, UI/OCR/image-matching automation, one-click MITM, built-in Frida, proxy/VPN/frp/P2P networking, MCP/Agent…Python8,6001,163MITSep 27Oct 14
six2dez/reconftwreconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilitiesShell8,1781,240MITSep 26Oct 11
nomi-sec/PoC-in-GitHubPoC auto collect from GitHub. Be careful Malware.8,1201,364CC0-1.0Oct 14Oct 14
infoslack/awesome-web-hackingA list of web application security7,2891,363MITSep 18Oct 11
Tencent/AI-Infra-GuardA full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.Python6,868661Apache-2.0Oct 14Oct 14
superagent-ai/superagentSuperagent protects your AI applications against prompt injections, data leaks, and harmful outputs. Embed safety directly into your app and prove compliance to your customers.TypeScript6,763962MITAug 25Oct 14
microsoft/agent-governance-toolkitAI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top…Python6,4271,133MITOct 13Oct 14
kanidm/kanidmKanidm: A simple, secure, and fast identity management platformRust5,450368MPL-2.0Oct 8Oct 11
hahwul/dalfoxDalfox is a powerful open-source XSS scanner and utility focused on automation.Rust5,325568MITOct 14Oct 14
cheatsnake/backend-cheatsWhite paper for Backend developers5,230536MITFeb 2, 2025Oct 11
hahwul/WebHackersWeaponsWeb Hacker's Weapons / A collection of cool tools used by Web hackers. Happy hacking , Happy bug-huntingRuby5,088854MITSep 7Oct 11
zer0yu/Awesome-CobaltStrikeList of Awesome CobaltStrike Resources4,457756Sep 20, 2023Oct 11
ivre/ivreNetwork recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your…Python4,175699GPL-3.0Oct 1Oct 14
jekil/awesome-hackingAwesome hacking is an awesome collection of hacking tools.Python4,008642May 16Oct 11
rizinorg/rizinUNIX-like reverse engineering framework and command-line toolset.C3,949636LGPL-3.0Oct 10Oct 11
unikraft/unikraftA next-generation cloud native kernel designed to unlock best-in-class performance, security primitives and efficiency savings.C3,8881,517Oct 2Oct 11
TracecatHQ/tracecatOpen-source security automation platform for teams and AI agentsPython3,836433AGPL-3.0Oct 14Oct 14
WithSecureOpenSource/chainsawRapidly Search and Hunt through Windows Forensic ArtefactsRust3,684310GPL-3.0Sep 23Oct 11
arch3rPro/Pentest-WindowsWindows11 Penetration Suite Toolkit The First Windows Penetration Testing Environment on Mac M Chips3,600343Jun 28, 2025Oct 11
gmh5225/awesome-game-securityawesome game security [Welcome to PR]Python3,600512MITOct 14Oct 14
metorial/metorialConnect any AI model to 1200+ integrations (MCP, CLI, API)TypeScript3,366370Oct 14Oct 14
mikeroyal/Digital-Forensics-GuideDigital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.Python3,181400Jan 4, 2024Oct 11
CyberStrikeus/CyberStrikeOpen-source AI-powered offensive security harness for automated penetration testing.TypeScript3,148516AGPL-3.0Oct 14Oct 14
snyk/agent-scanSecurity scanner for AI agents, MCP servers and agent skills.Python3,138288Apache-2.0Oct 14Oct 14
lirantal/awesome-nodejs-securityAwesome Node.js Security resources3,047317Aug 14Oct 14
sheeki03/tirithTerminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs…Rust2,75197AGPL-3.0Oct 10Oct 11
danieldurnea/FBI-toolsOSINT Tools for gathering information and actions forensics2,700379Mar 12, 2025Oct 11
oxsecurity/megalinterMegaLinter analyzes 50 languages, 22 formats, 21 tooling formats, excessive copy-pastes, spelling mistakes and security issues in your repository sources with a GitHub Action…Dockerfile2,611313AGPL-3.0Oct 11Oct 11
crev-dev/cargo-crevA cryptographically verifiable code review system for the cargo (Rust) package manager.Rust2,34098Apache-2.0Jul 21Oct 11
stacklok/toolhiveToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.Go2,283319Apache-2.0Oct 14Oct 14
cyberagiinc/DevDocsCompletely free, private, UI based Tech Documentation MCP server. Designed for coders and software developers in mind. Easily integrate into Cursor, Windsurf, Cline, Roo Code…TypeScript2,107200Apache-2.0Feb 4Oct 14
hslatman/awesome-industrial-control-system-securityA curated list of resources related to Industrial Control System (ICS) security.Python2,033490Apache-2.0Oct 10, 2025Oct 11
cossacklabs/themisEasy to use cryptographic framework for data protection: secure messaging with forward secrecy and secure data storage. Has unified APIs across 14 platforms.C1,978159Apache-2.0Apr 24Oct 11
jiwoochris/artex-globalARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)Go1,8932,100AGPL-3.0Oct 14Oct 21
nix-community/lanzabooteSecure Boot & Measured Boot for NixOS [maintainers=@blitz @raitobezarius @nikstur]Rust1,879119GPL-3.0Oct 11Oct 11
wgpsec/AboutSecurityEverything for pentest. | 渗透测试知识库,以 AI Agent 可执行的格式沉淀安全方法论。Python1,790248Oct 10Oct 14
ossf/cve-bin-toolThe CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2…Python1,777670GPL-3.0Oct 7Oct 11
OpenOSINT/OpenOSINTAI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.Python1,753278MITOct 13Oct 14
Ge0rg3/requests-ip-rotatorA Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.Python1,679173GPL-3.0Jul 13Sep 21
mukul975/cve-mcp-serverProduction-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.Python1,624269Apache-2.0Oct 1Oct 14
scadastrangelove/awesome-ai-security-toolsA curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI…Python1,602401Oct 8Oct 11
six2dez/burp-ai-agentBurp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and moreKotlin1,542228MITOct 13Oct 14
occlum/occlumOcclum is a memory-safe, multi-process library OS for Intel SGXRust1,535252Feb 5Oct 11
aws-cloudformation/cloudformation-guardGuard offers a policy-as-code domain-specific language (DSL) to write rules and validate JSON- and YAML-formatted data such as CloudFormation Templates, K8s configurations, and…Rust1,390198Apache-2.0Sep 14Oct 11
fkie-cad/cwe_checkercwe_checker finds vulnerable patterns in binary executablesRust1,360146LGPL-3.0Sep 28Oct 11
affaan-m/agentshieldAI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App…TypeScript1,281284MITSep 10Oct 14
mongodb/kingfisherDetect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.Rust1,260123Apache-2.0Oct 7Oct 11
Zeyad-Azima/Offensive-ResourcesA Huge Learning Resources with Labs For Offensive Security Players1,174246Dec 9, 2025Oct 11
bountyyfi/lonkeroLonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.Rust1,10492Aug 16Oct 14
cisco-ai-defense/mcp-scannerScan MCP servers for potential threats & security findings.Python1,090143Apache-2.0Oct 13Oct 14
hahwul/jwt-hackJSON Web Token Hack ToolkitRust1,086131MITOct 8Oct 8
morluto/awesome-reverse-engineeringCurated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.Python1,052239CC0-1.0Oct 20Oct 21
hashgraph-online/hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.Python892158Apache-2.0Oct 14Oct 14
Wh0am123/MCP-Kali-ServerMCP configuration to connect AI agent to a Linux machine.Python848171MITMar 17Oct 14
FuzzingLabs/mcp-security-hubA growing collection of MCP servers bringing offensive security tools to AI assistants. Nmap, Ghidra, Nuclei, SQLMap, Hashcat and more.Python800102MITApr 8Oct 8
Puliczek/awesome-mcp-securityAwesome MCP (Model Context Protocol) Security743274Mar 3Oct 14
openqodex/openqodexOpen source code review that runs in your coding agent before you push. Scanners plus a separate AI reviewer, on your own login, no key.TypeScript70956Apache-2.0Oct 15Oct 15
SonarSource/sonarqube-mcp-serverOfficial SonarQube MCP Server for code quality and security in AI agentsJava664103Oct 14Oct 14
PaulDuvall/ai-development-patternsA comprehensive collection of AI development patterns for building software with AI assistance, organized by implementation maturity and development lifecycle phases. Includes…Python66355MITOct 13Oct 14
badchars/darknet-mcp-server66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit search, stealer logsTypeScript51472MITSep 22Oct 14
strands-agents/boxRun AI agents in a sandbox that restricts what they can execute, read, write, and reach on the network. Box combines OS isolation with default-deny Dogwood policies and credential…Rust45029Apache-2.0Oct 21Oct 21
zhuyansen/agent-skills-hubDiscover and compare open-source Agent Skills, tools & MCP servers — with quality scoring, trending analysis, and automated GitHub syncHTML44747MITOct 14Oct 14
gensecaihq/Wazuh-MCP-ServerProduction-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001)…Python25165MITOct 9Oct 14
frishtik/osint-tools-mcp-serverMCP server exposing multiple OSINT tools for AI assistants like ClaudePython24432MITAug 7, 2025Oct 14
tumf/mcp-shell-serverSecure MCP server for whitelisted shell command execution with stdin, argv pipelines, timeouts, and structured audit logging.Python20151MITOct 14Oct 14
bdg9412/artex-ko-plusARTEX 한국어판 ·AI 기반 침해사고 대응 기능 추가 (upstream: Autumn-27/ARTEX, AGPL-3.0)Go185160AGPL-3.0Oct 11Oct 15
mcp-shark/mcp-sharkWireshark-like forensic analysis for Model Context Protocol communications Capture, inspect, and investigate all HTTP requests and responses between your IDE and MCP serversJavaScript17915Apr 26Oct 14
itpropro/nuxt-oidc-authOIDC (OpenID connect) focused auth module for NuxtTypeScript16850MITOct 14Oct 14
c0tton-fluff/caido-mcp-serverMCP server for Caido proxy integration. Enables AI assistants like Claude Code to browse, analyse, and interact with HTTP traffic.Go13728MITOct 7Oct 14
cerberauth/awesome-openid-connectOpenID Connect, the authentication protocol and identity layer on top of OAuth 2.0 used in many SSO and adopted in many social logins (Apple, Facebook, Google, ...etc). Find this…HTML13131CC0-1.0Oct 1Oct 14
AuthPlane/authserverOAuth 2.1 Authorization Server for the Model Context Protocol (MCP)Go816AGPL-3.0Oct 14Oct 14
badchars/osint-mcp-serverOSINT intelligence MCP server for AI agents — 37 tools, 12 sources. Shodan, VirusTotal, Censys, SecurityTrails, DNS reconnaissance, WHOIS, certificate transparency, BGP routing…TypeScript628MITMar 17Oct 14
clidey/deptrustdeptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm…Go613MITOct 11Oct 14
ejfkdev/djdj - Dynamic JS File Extractor - intelligently detects dynamically loaded JavaScript files by statically analyzing website HTML and JS codeGo604MPL-2.0Sep 28Oct 14
qianniuspace/mcp-security-auditA powerful MCP (Model Context Protocol) Server that audits npm package dependencies for security vulnerabilities. Built with remote npm registry integration for real-time security…TypeScript578MITJul 18, 2025Oct 14
TalEliyahu/AI-Security-NewsletterAI Security Newsletter - A monthly digest of AI security research, insights, reports, upcoming events, and tools & resources475Jun 28Oct 14
charlesjones-dev/ai-agent-pluginsPlugins for git and project workflows, code audits and release checks. All 13 run in Claude Code, and 8 also run in Codex and Cursor.Python353MITOct 14Oct 14
mishrasanjeev/grantexgrantex is the identity, authorization, and audit infrastructure for AI agents — the "OAuth moment" for the agentic internet. We provide a universal SDK and cloud service that…TypeScript339Oct 13Oct 14
badchars/cve-mcp23-tool MCP server for CVE & vulnerability intelligence. NVD, EPSS, CISA KEV, GitHub Advisory, OSV — unified in one server. Risk scoring, bulk triage, exploit search. 2…TypeScript328MITSep 17Oct 14
nirholas/ethereum-wallet-toolkitPython toolkit for Ethereum wallets: CLI tools + Model Context Protocol (MCP) servers for wallet generation, BIP39/BIP44 HD wallets, Web3 Secret Storage V3 keystores, and EIP-712…HTML265Oct 11Oct 14
MykytaStel/repopilotLocal, deterministic review of Git changes: weakened tests and CI gates, security boundaries, blast radius. CLI, GitHub Action, MCP server, and coding-agent plugins.Rust241Apache-2.0Oct 12Oct 14
olanokhin/openresearch-mcpZero-auth, security-hardened cross-domain research MCP server: web, academic, GitHub, news, weather, macro/finance, SEC, biomedical, Bluesky, YouTube. SSRF and prompt-injection…Python111Apache-2.0Jul 8Oct 14
eltociear/skill-audit-mcpStatic security scanner for MCP servers, agent skills & plugins: 17 attack patterns / 60 regex signatures, calibrated to a 1% false-positive rate over 196 public MCP servers. In…Python51MITSep 30Oct 14
Nessiahs/nuxt-keycloak-oidcA Nuxt module for integrating Keycloak via OpenID Connect (OIDC), providing SSR support, composables, and a developer-friendly authentication flow.TypeScript40MITMay 4Oct 14
subodhkc/mcp-tenant-isolationStatic analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server…TypeScript42MITOct 8Oct 14
vasikmansuri/agentconfig-doctorMCP security scanner & config linter for AI coding agents. Finds leaked secrets, risky commands, broad permissions and invalid MCP servers in Claude Code, Cursor and VS Code…TypeScript30MITOct 14Oct 14
muhammadwaqar12/mcp-server-auditSecurity audit checklist for third-party MCP servers before you install them10MITSep 6Oct 14
mcpbeat/best-mcp-serversMCP servers ranked by measured uptime and real installs — not stars. Daily change log, weekly ecosystem reports, open data.00CC-BY-4.0Oct 14Oct 14
munimtechnologies/self-hosted-ai-security-checklistSafe defaults and one-line tests for self-hosted AI: Ollama, Open WebUI, vLLM, LiteLLM, ComfyUI, n8n, Dify, Langflow, Flowise, RAGFlow, AnythingLLM. By MV2 of Munim, Inc., with AI…Python00Oct 14Oct 14
tomelias10/mcp-drift-checkStatic MCP package-reference mutability checker: Python CLI and GitHub Action. No discovered server execution. Broader config/baseline tools: Orynval Labs.Python05MITOct 11Oct 14

By language

Related topics

Read from GitHub by SpecStream between September 21, 2026 and October 21, 2026; each row shows the day its repository was read. Stars and pushes change every day, and the GitHub page is the current one. Forks and archived repositories are left out.