Directory
Open-source AI security tools
28 tools for securing AI agents and LLM apps, grouped by the job they do. Each description, license and maintainer comes from the tool's own repository. A daily job adds new tools and drops archived ones.
Last checked October 12, 2026 · [ JSON ]
Scanners
Check MCP servers, skills, agents and model files for malicious or unsafe content before you run them.
Agentic Radar
Apache-2.0splx-ai/agentic-radar · splx-ai
Security scanner for agentic workflows: analyzes agentic systems to show how they work and to find potential vulnerabilities. Can run in CI on every push.
Agentic workflows
AI-Infra-Guard
Apache-2.0Tencent/AI-Infra-Guard · Tencent Zhuque Lab
Red teaming platform that fingerprints AI infrastructure components against known CVEs and scans MCP servers, agent skills and agent workflows for risks. Also runs LLM jailbreak evaluations.
AI infrastructureMCP serversAgent skillsLLM jailbreaks
Fickling
LGPL-3.0trailofbits/fickling · Trail of Bits
Decompiler, static analyzer and bytecode rewriter for Python pickle files. Detects and analyzes malicious pickle and pickle-based files, including PyTorch files.
Pickle filesPyTorch models
MCP Scanner
Apache-2.0cisco-ai-defense/mcp-scanner · Cisco AI Defense
Python tool that scans MCP servers and tools for security findings, combining YARA rules, LLM-based analysis and the Cisco AI Defense inspect API. Runs as a CLI or a REST API server.
MCP servers
ModelScan
Apache-2.0protectai/modelscan · Protect AI
Open-source scanner from Protect AI that checks machine learning model files for unsafe code before they are loaded.
Model files
numbat
Apache-2.0perplexityai/numbat · Perplexity
Endpoint visibility for AI agent activity. Finds the agents on a machine and flags risky actions with CEL and YAML rules, such as a secret file read followed by egress. Shipped rules only monitor.
CodexClaude CodeOpenClaw
picklescan
MITmmaitre314/picklescan · mmaitre314
Security scanner that detects Python pickle files performing suspicious actions, including models hosted on Hugging Face.
Pickle filesHugging Face models
SkillSpector
Apache-2.0NVIDIA/SkillSpector · NVIDIA
Security scanner for AI agent skills. Checks a skill for vulnerabilities, malicious patterns and security risks before it is installed, using static analysis and an optional LLM review.
Agent skillsClaude CodeCodex CLIGemini CLIMCP servers
Snyk Agent Scan
Apache-2.0snyk/agent-scan · Snyk
Discovers agent components on a machine (agents, MCP servers, skills) and scans them for prompt injections and vulnerabilities. Formerly Invariant Labs' mcp-scan.
MCP serversAgent skillsCoding agents
Guardrails
Sit between your app and the model to filter inputs and outputs at runtime.
Guardrails
Apache-2.0guardrails-ai/guardrails · Guardrails AI
Python framework that runs input and output guards in an AI application to detect, quantify and mitigate specific risks, with validators from Guardrails Hub.
LLM applications
HOL Guard
Apache-2.0hashgraph-online/hol-guard · Hashgraph Online
Local policy layer that reviews an agent action before it runs, including shell commands, file access, package installs and MCP tool calls, then allows it, blocks it or asks for approval.
Claude CodeCodexCursorGitHub Copilot CLIGemini CLIMCP serversAgent skills
NeMo Guardrails
Apache-2.0NVIDIA-NeMo/Guardrails · NVIDIA
Open-source toolkit for adding programmable guardrails between application code and an LLM in LLM-based conversational applications.
LLM applications
Pipelock
Apache-2.0 (core), Elastic-2.0 (enterprise directory)luckyPipewrench/pipelock · Joshua Waldrep
Agent firewall. Inspects the HTTP, WebSocket, MCP and A2A traffic it mediates for secret exfiltration, prompt injection, SSRF and tool poisoning, and signs a receipt for each action it passes.
MCP serversA2AClaude CodeCodexCursorLangGraph
Purple Llama
MIT (evals), Llama 3.2 Community License (models)meta-llama/PurpleLlama · Meta
Meta's umbrella project of open tools and evals for building with open generative AI models, including the Llama Guard safeguard models and the CyberSecEval benchmarks.
LLM applicationsOpen-weight models
Red teaming
Attack your own LLM apps and agents to find prompt injection, jailbreaks and leaks first.
Anamorpher
Apache-2.0trailofbits/anamorpher · Trail of Bits
Crafts and previews image scaling attacks against multi-modal AI systems: images that reveal a prompt injection only once they are downscaled. Covers bicubic, bilinear and nearest-neighbor.
Multi-modal LLMsOpenCVPyTorchTensorFlowPillow
Augustus
Apache-2.0praetorian-inc/augustus · Praetorian
Go command line scanner that tests an LLM or endpoint against 210+ adversarial probes for prompt injection, jailbreaks, encoding attacks and data extraction, then writes a findings report.
LLMsOpenAIAnthropicAWS BedrockOllamaLangChainREST API endpoints
DeepTeam
Apache-2.0confident-ai/deepteam · Confident AI
Open-source red teaming framework for LLM systems that runs locally, built on the DeepEval evaluation framework.
LLM systems
garak
Apache-2.0NVIDIA/garak · NVIDIA
Generative AI red-teaming and assessment kit. Probes an LLM or dialog system for prompt injection, jailbreaks, data leakage, hallucination and other weaknesses.
LLMsChatbots
promptfoo
MITpromptfoo/promptfoo · Promptfoo
CLI and library for evaluating and red-teaming LLM-based apps and agents.
LLM applicationsAgents
PyRIT
MITmicrosoft/PyRIT · Microsoft
The Python Risk Identification Tool for generative AI: an open framework that helps security professionals and engineers find risks in generative AI systems.
Generative AI systems
Evals and benchmarks
Measure how well agents and defenses hold up against known attacks.
ADR (Agentic AI Detection and Response)
Apache-2.0uber/ADR · Uber
Uber's toolkit for agent security: inventories agents and MCP servers on endpoints, records agent traces, and ships ADR-Bench, a benchmark of 17 agent attack techniques, with two-tier detectors.
CursorClaude CodeCodexGitHub Copilot CLIDeepSeek HarnessMCP servers
AgentDojo
MITethz-spylab/agentdojo · ETH Zurich SPY Lab and Invariant Labs
A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents, from ETH Zurich and Invariant Labs.
LLM agents
Giskard
Apache-2.0Giskard-AI/giskard-oss · Giskard
Python library for evals, red teaming and test generation on agentic systems. Its Scan mode probes an agent for prompt injection, jailbreaks, harmful content and other OWASP LLM Top 10 risks.
LLM agentsMulti-step pipelinesOpenAIAnthropic
Sandboxes
Limit what agents and AI-generated code can touch on disk and on the network.
Agent Sandbox
Apache-2.0kubernetes-sigs/agent-sandbox · Kubernetes SIG Apps
Kubernetes controller and Sandbox resource for running isolated, stateful workloads such as agent runtimes. Isolation comes from the runtime, such as gVisor or Kata Containers. Go and Python SDKs.
KubernetesAgent runtimesgVisorKata Containers
Anthropic Sandbox Runtime (srt)
Apache-2.0anthropics/sandbox-runtime · Anthropic
Lightweight OS-level sandbox that enforces filesystem and network limits on any process without a container. Can sandbox agents, local MCP servers and bash commands. Beta research preview.
AgentsMCP serversBash commands
E2B
Apache-2.0e2b-dev/E2B · E2B
Open-source infrastructure for running AI-generated code in secure, isolated cloud sandboxes, controlled from JavaScript and Python SDKs.
AI-generated codeAgents
nono
Apache-2.0nolabs-ai/nono · nolabs, inc
Least-privilege sandbox for AI coding agents, with no container, VM or daemon. Hides SSH keys, cloud credentials and the rest of the disk from the agent. Delegated tools get their own policies.
Claude CodeCodexOpenCodeOpenClaw
ToolHive
Apache-2.0stacklok/toolhive · Stacklok
Runs each MCP server in an isolated container with a minimal permission file and no local credentials. Adds access policies, encrypted secrets and network isolation. CLI, desktop app or Kubernetes.
MCP serversClaude DesktopClaude CodeCursorVS CodeKubernetes
Listing is not an endorsement and not a security review. A tool is added when it is open source, maintained, in scope for AI security and used in practice. Missing one, or is something wrong? Use the contact page.