Stack Gems
Menu
WorkbenchBestNewSkillsLogAboutSubmit

Alternatives · Security

gstack alternatives (2026)

gstack: MIT opinionated Claude Code software factory when a solo founder wants plan→review→QA→ship roles out of the box — heavy setup and real-session browser power; pin it and audit what it can log into.

Its Catch: Blast radius: browser skills drive your real logged-in sessions (Aside on macOS) or import cookies from Chrome/Brave/Arc into its bundled browser — treat `/setup-browser-cookies` and the sidebar agent like handing over your accounts.

Below: 8 free or free-tier tools from the same category (security tools), free and open source first, then the closest match by shared tags. Each keeps its own Catch.

  1. 1.SkillSpectorApache NVIDIA scanner for agent skills before you install them

    Free / OSS · Apache-2.0 · 20.5k GitHub stars

    VerdictApache skill security gate when your agents install third-party skills — run it before the skill runs you.

    CatchVs Semgrep/Trivy-class general SAST: this is skill/MCP-skill oriented, not a whole-repo AppSec suite. Scanner signal ≠ proof a skill is safe forever — still review permissions and network egress; NVIDIA catalog signing is a separate trust path from running the OSS scanner alone.

  2. 2.Codex SecurityOpenAI vulnerability finder and patcher

    Free / OSS · Apache-2.0 · 11.1k GitHub stars

    VerdictApache-2.0 agentic vuln scanner from OpenAI. Use when you want validated findings plus patches and accept paying for the model calls.

    CatchThe CLI is open source but the scanning is model calls: you sign in (`cs login`) or use an OpenAI API key in CI, so real scans cost usage — set the cost limits it documents. Needs Node 22.13+/24/26 plus Python 3.10+. Some scan tiers require separate Trusted Access for Cyber approval. Vs semgrep and trivy (deterministic rule/CVE scanners, free and fast): Codex Security is the slower LLM lane that reasons about and fixes findings — run it beside them, not instead.

  3. 3.TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier

    Free / OSS · Apache-2.0 · 38.5k GitHub stars

    VerdictApache-2.0 security scanner. Fully free CLI; Aqua Platform is the paid cousin.

    CatchCLI/CI scanner — not Aqua Platform management UI/RBAC/policy SaaS. Vs Grype/Snyk: Aqua OSS default with broad target surface; Aqua Inc monetizes a separate commercial platform. You still triage and patch.

  4. 4.GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key

    Free / OSS · OSS/MIT · 30.1k GitHub stars

    VerdictMIT secrets CLI. Free forever; org Action wants free license key.

    CatchMaintainer marks feature-complete (security patches; focus shifting to Betterleaks). Official Action for GitHub org repos needs a free license key from gitleaks.io — personal accounts exempt. Not a full ASVS/SAST suite. False positives need allowlists.

  5. 5.GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI

    Free / OSS · Apache-2.0 · 13k GitHub stars

    VerdictApache-2.0 SBOM vuln scanner. Free CLI; Enterprise is the paid cousin.

    CatchVuln scanner — not Trivy's IaC/secrets swiss-army, not Cosign signing, not Anchore Enterprise governance UI. You still triage CVEs. Anchore monetizes Enterprise separately.

  6. 6.direnvMIT per-directory env loader for any shell

    Free / OSS · OSS/MIT · 15.5k GitHub stars

    VerdictMIT directory env. Free forever; allow once per project and stop polluting $PATH.

    CatchEach new .envrc needs `direnv allow`. Not a secrets vault — still files on disk.

  7. 7.ageBSD-3 simple file encryption by FiloSottile

    Free / OSS · BSD-3-Clause · 24k GitHub stars

    VerdictBSD-3 file encryption. Free forever; pair with SOPS when the team outgrows ad-hoc scripts.

    CatchNot a password manager or key directory. You still distribute public keys yourself.

  8. 8.AtuinMIT magical shell history with optional E2E sync

    Free / OSS · OSS/MIT · 32k GitHub stars

    VerdictMIT shell history. Free forever CLI + self-host sync; hosted sync stays optional.

    CatchShell history tool — not a prompt (Starship), not a jumper (zoxide), not Dotfiles sync. Desktop/Hub team features are a separate product line (Hub not self-hostable). Atuin AI is free while in testing — treat that as temporary.

FAQ

What are the best free alternatives to gstack?
SkillSpector, Codex Security, Trivy, Gitleaks, Grype. All are reviewed on Stack Gems in the same category (security tools); 8 free or open source.
What is the catch with gstack?
Blast radius: browser skills drive your real logged-in sessions (Aside on macOS) or import cookies from Chrome/Brave/Arc into its bundled browser — treat `/setup-browser-cookies` and the sidebar agent like handing over your accounts.
Is there an open-source alternative to gstack?
Yes: SkillSpector (Apache-2.0), Codex Security (Apache-2.0), Trivy (Apache-2.0), Gitleaks (OSS/MIT).

More