#Sarif

JetBrains

qodana-action

⚙️ Scan your Go, Java, Kotlin, PHP, Python, JavaScript, TypeScript, .NET projects at GitHub with Qodana. This repository contains Qodana for Azure, GitHub, CircleCI and Gradle

0sec-labs

foxguard

A blazingly fast security scanner, written in Rust. Batteries included, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥

Coff0xc

AutoRedTeam-Orchestrator

Enterprise AI Red Team Platform | 企业级AI红队平台 | 132 MCP Tools | Pure Python Engines | SDK+CLI+MCP | Auto-Download sqlmap/nuclei/ffuf | Production C2 | LLM Enhanced | Docker Sandbox | SARIF CI/CD | 1980 Tests

sbom-tool

sbom-tools

Semantic SBOM/CBOM diff, quality scoring, and TUI analysis tool for CycloneDX/SPDX — covering component changes, dependency shifts, license conflicts, vulnerabilities, cryptographic inventory grading, and PQC compliance (CNSA 2.0, NIST IR 8547).

Agent-Field

sec-af

AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and actionable evidence.

KryptosAI

mcp-observatory

Test, secure, and monitor MCP servers before agents depend on them.

gensecaihq

Shai-Hulud-2.0-Detector

Detect npm packages compromised in the Shai-Hulud 2.0 supply chain attack (Nov 2025). Scans for 790+ malicious packages, suspicious scripts, TruffleHog activity, SHA1HULUD runners, and secrets exfiltration. GitHub Action with SARIF support.

psastras

sarif-rs

A group of Rust projects for interacting with the SARIF format

owenrumney

go-sarif

Go library for SARIF - Static Analysis Results Interchange Format

PhpCodeArcheology

PhpCodeArcheology

PHP static analysis for architecture & maintainability — 60+ metrics, complexity analysis, dependency graphs, git churn hotspots, and AI-ready MCP server. Alternative to PHPMetrics.

davidmatousek

tachi

Threat modeling and AI-reasoning vulnerability detection harness for Claude Code — STRIDE + AI + MAESTRO

momenbasel

vulnhawk

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.

Null-Square

Null-CLi

Open-source AI pentest and compliance-readiness CLI by NullSquare.

momenbasel

malware-check

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

apisec-inc

AI-Surface

Find and govern AI attack surfaces in application code at PR time. Free, OSS, runs offline.

nsasoft

nsauditor-ai

NSAuditor AI — Open-source, AI-powered network security scanner. 27 plugins, CVE matching, MITRE ATT&CK mapping, verified vulnerabilities, continuous monitoring, MCP integration. Zero data exfiltration. MIT licensed.