Security tools

• OpenBaoMPL-2.0 Vault-compatible secrets engine after the Vault fork

  Free / OSS · MPL-2.0 · 8.5k GitHub stars

  VerdictMPL Vault-compat engine. Fork for license, not Infisical DX.

  CatchVault-engine / IdP-secrets lane, not Infisical app-secrets DX. This is the engine/compat fork, not the developer-secrets UI. Don’t assume a Cloud free tier.

• TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier

  Free / OSS · Apache-2.0 · 38.5k GitHub stars

  VerdictApache-2.0 security scanner. Fully free CLI; Aqua Platform is the paid cousin.

  CatchCLI/CI scanner — not Aqua Platform management UI/RBAC/policy SaaS. Vs Grype/Snyk: Aqua OSS default with broad target surface; Aqua Inc monetizes a separate commercial platform. You still triage and patch.

• GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key

  Free / OSS · OSS/MIT · 30.1k GitHub stars

  VerdictMIT secrets CLI. Free forever; org Action wants free license key.

  CatchMaintainer marks feature-complete (security patches; focus shifting to Betterleaks). Official Action for GitHub org repos needs a free license key from gitleaks.io — personal accounts exempt. Not a full ASVS/SAST suite. False positives need allowlists.

• GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI

  Free / OSS · Apache-2.0 · 13k GitHub stars

  VerdictApache-2.0 SBOM vuln scanner. Free CLI; Enterprise is the paid cousin.

  CatchVuln scanner — not Trivy's IaC/secrets swiss-army, not Cosign signing, not Anchore Enterprise governance UI. You still triage CVEs. Anchore monetizes Enterprise separately.

• direnvMIT per-directory env loader for any shell

  Free / OSS · OSS/MIT · 15.5k GitHub stars

  VerdictMIT directory env. Free forever; allow once per project and stop polluting $PATH.

  CatchEach new .envrc needs `direnv allow`. Not a secrets vault — still files on disk.

• ageBSD-3 simple file encryption by FiloSottile

  Free / OSS · BSD-3-Clause · 24k GitHub stars

  VerdictBSD-3 file encryption. Free forever; pair with SOPS when the team outgrows ad-hoc scripts.

  CatchNot a password manager or key directory. You still distribute public keys yourself.

• AtuinMIT magical shell history with optional E2E sync

  Free / OSS · OSS/MIT · 32k GitHub stars

  VerdictMIT shell history. Free forever CLI + self-host sync; hosted sync stays optional.

  CatchShell history tool — not a prompt (Starship), not a jumper (zoxide), not Dotfiles sync. Desktop/Hub team features are a separate product line (Hub not self-hostable). Atuin AI is free while in testing — treat that as temporary.

• SOPSMPL-2.0 encrypts config values; keys stay readable

  Free / OSS · MPL-2.0 · 23.4k GitHub stars

  VerdictMPL-2.0 secrets-in-git. Free forever; use age underneath when you want KMS-free recipients.

  CatchVs age (file encryption) and Infisical (secrets product): SOPS is the *structured config encryptor*, not a password manager and not a hosted vault UI. You still design key distribution, rotation, and who can decrypt in CI. Binary mode encrypts whole files when structure does not apply.

• SemgrepLGPL-2.1 SAST engine; Free Edition caps repos/contributors

  Free / OSS · LGPL-2.1 · 17.1k GitHub stars

  VerdictLGPL SAST. Free forever CLI; Free Edition SaaS for small teams; Teams when AppSec wants the paid platform.

  CatchVs Trivy/Gitleaks (scanners): Semgrep is SAST/SCA-shaped AppSec, not container CVE inventory or git-history secret regex alone. Teams starts ~$30/contributor/mo per product; Secrets is a separate SKU. Free Edition caps contributors/repos — OSS CLI without the SaaS seat is the uncapped escape hatch.

• resticBSD-2-Clause encrypted, deduplicated backups to many backends

  Free / OSS · BSD-2-Clause · 36.7k GitHub stars

  VerdictBSD-2-Clause backup CLI. Free forever encryption + dedup; pay only for where the blobs live.

  CatchYou still own the repository password (lose it = lose data) and the backend bill/ops. Not a SaaS backup console with support SLAs. Scheduling, monitoring, and restore drills are on you. Complementary to object stores (Garage), not a replacement for app-level PITR.

• SyftApache-2.0 SBOM CLI for images and filesystems (pairs with Grype)

  Free / OSS · Apache-2.0 · 9.7k GitHub stars

  VerdictApache-2.0 SBOM CLI. Free forever; generate the bill, then let Grype/Trivy argue about CVEs.

  CatchVs Grype (vuln *scan* from SBOMs/images) and Trivy (broader scanner): Syft is the *SBOM producer*, not the CVE verdict engine. Format choice and package coverage still need CI wiring; it does not replace signed attestations (cosign) or policy gates by itself.

• OSV-ScannerApache-2.0 OSV.dev vulnerability scanner for lockfiles and images

  Free / OSS · Apache-2.0 · 11.2k GitHub stars

  VerdictApache-2.0 OSV.dev scanner. Free forever; pair with Trivy/Grype/Syft, do not clone them.

  CatchVs Trivy/Grype (broader/image-first scanners) and Syft (*SBOM producer*): OSV-Scanner is the OSV.dev-native vuln CLI, not a replacement for every Trivy filesystem/misconfig check and not the SBOM generator. Complements those tools; do not expect identical CVE sets. Networked API unless you go `--offline`.

• Security Audit SkillMIT coding-agent skill for multi-phase security audits

  Free / OSS · OSS/MIT · 31.2k GitHub stars

  VerdictMIT agent security-audit skill. Phased findings vs mcp-security-audit; not a SaaS scanner.

  CatchSkill only — not a standalone SaaS scanner. Distinct from mcp-security-audit (awesome-copilot skill for .mcp.json / MCP config audits) and from OWASP ASI checklist skills: this is Cloudflare’s multi-phase code/security audit skill for a coding-agent host. You still need the agent runtime and any scanners the skill shells out to.

• ECCMIT agent ecosystem / coordination surface

  Free / OSS · OSS/MIT · 283k GitHub stars

  VerdictMIT agent coordination ecosystem. Skills+memory+security on top of host agents — not a host itself.

  CatchStill depends on host agents (Claude Code / Codex / Cursor / etc.) — ECC coordinates and tunes the harness; it is not a replacement coding agent. Vs OpenSpec (spec-driven change tooling) and Thurbox (tmux multi-agent TUI): ECC is the skills/memory/security ecosystem pack, not a spec framework and not a pane orchestrator.

• AURAApache-2.0 MCP-ready SRE agent platform for production incidents

  Free / OSS · Apache-2.0 · 399 GitHub stars

  VerdictApache-2.0 SRE agent platform. Use for production incident investigation with MCP and your own models; wire real telemetry first.

  CatchVs generic coding agents: AURA is an SRE/incident harness, not a repo coding ADE. Deepest value shows when wired to real observability backends (Mezmo and others); empty integrations will not invent incidents. Hosted Mezmo sessions are optional — self-host is the OSS path.

• CiliumeBPF networking, security, and observability for Kubernetes

  Free / OSS · Apache-2.0 · 25.7k GitHub stars

  VerdictApache-2.0 eBPF Kubernetes networking. Default when identity-aware policy and Hubble flows beat plain CNI.

  CatchVs flannel/Calico defaults: Cilium is the deeper eBPF control plane — more power, more kernel/datapath expertise. Isovalent/Cisco commercial layers exist around the same codebase; self-host OSS carefully for upgrades and Hubble ops.

• AI-Infra-GuardRed-team platform for agent, MCP, and skill infrastructure

  Free / OSS · Apache-2.0 · 6.9k GitHub stars

  VerdictApache-2.0 red-team platform for agent infrastructure. Worth running in a disposable, keyed environment; ship the attribution and scope every model credential.

  CatchVs Promptfoo and DeepEval: AI-Infra-Guard is an AI-infrastructure red-team platform, not only an eval runner; vs generic SAST, it understands agent/MCP/skill attack surfaces. Preserve the mandatory attribution — “Based on Tencent Zhuque Lab AI-Infra-Guard” — with the repository link in your deployment and derivative notices. Some tools also require an LLM_API_KEY, so a self-hosted scanner can still carry provider cost and credential risk.

• LitterBoxMalware and payload detection sandbox with LitterBoxMCP

  Free / OSS · GPL-3.0 · 1.6k GitHub stars

  VerdictGPL-3 defensive payload sandbox with LitterBoxMCP. Keep for development analysis in a disposable lab; do not present it as production-grade isolation.

  CatchVs Agent Substrate and coding sandboxes: LitterBox is a malware/payload detection sandbox with an MCP surface, not a general coding workspace or agent runtime isolation layer. The README says “Development use only”; production isolation is an unsolved risk. Windows administration and Linux KVM/Windows-container requirements can be substantial, and GPL-3.0 copyleft still applies to distributed modifications.

• SkillSpectorApache NVIDIA scanner for agent skills before you install them

  Free / OSS · Apache-2.0 · 20.5k GitHub stars

  VerdictApache skill security gate when your agents install third-party skills — run it before the skill runs you.

  CatchVs Semgrep/Trivy-class general SAST: this is skill/MCP-skill oriented, not a whole-repo AppSec suite. Scanner signal ≠ proof a skill is safe forever — still review permissions and network egress; NVIDIA catalog signing is a separate trust path from running the OSS scanner alone.

• SubmarineMIT Rust/Tauri SSH & SFTP client — desktop + Android

  Free / OSS · OSS/MIT · 451 GitHub stars

  VerdictMIT Tauri SSH/SFTP when you want a focused native client — not Navop’s full ops suite; mid-★ devops fill.

  CatchVs Navop: Navop is the wider DB/RDP/AI ops suite; Submarine stays on SSH/SFTP done well. Vs Termius-class paid clients: no team vault cloud here — keys and sync are local/self-managed. Mid-★ (~374) kept as clean OSS remote-access fill; confirm Android/desktop release maturity for your workflow.

• AgentgatewayApache AI-native proxy — MCP & A2A security, obs, governance

  Free / OSS · Apache-2.0 · 5.4k GitHub stars

  VerdictApache MCP/A2A proxy when agents need governed tool and agent traffic — not LiteLLM/Weave/CCR model routers and not Nasiko harness control.

  CatchVs litellm / weave-router / claude-code-router / nasiko: LiteLLM is a multi-provider LLM proxy; Weave/CCR are coding-agent model routers; Nasiko is harness discover/route/trace — Agentgateway’s catch is MCP/A2A agentic connectivity proxy (security/obs/governance), not model routing alone. Ops weight of a full proxy; pin a release and map which MCP/A2A clients you actually terminate.

• MCP Scanner (Cisco)Apache MCP security scanner — YARA, LLM, Cisco AI Defense

  Free / OSS · Apache-2.0 · 1.1k GitHub stars

  VerdictApache MCP server/tool scanner when you must gate MCP supply chain — not SkillSpector skills-only, not AI-Infra-Guard red-team platform, not dcg host hooks.

  CatchVs SkillSpector / AI-Infra-Guard / destructive-command-guard: SkillSpector gates agent skills; AI-Infra-Guard is a broader red-team platform; dcg blocks destructive host commands — MCP Scanner’s catch is scanning MCP servers/tools/prompts/resources. Full Cisco AI Defense / VirusTotal paths need keys and network; treat OSS engines as the free bar and cloud engines as optional cost/trust.

• HOL GuardApache local antivirus for agents — MCP, skills, shell, packages

  Free / OSS · Apache-2.0 · 933 GitHub stars

  VerdictApache local agent antivirus when you need runtime allow/block on tools and MCP — not skills-only scanners and not MCP-server audit alone.

  CatchVs SkillSpector / mcp-scanner / destructive-command-guard / AI-Infra-Guard: SkillSpector scans skills pre-install; MCP Scanner audits MCP servers; dcg is a host deny-hook; AI-Infra-Guard is red-team platform — HOL Guard’s catch is runtime local policy/antivirus across agent actions including MCP calls. Policy false positives can stall agents; optional cloud is not required — keep local-first if that is the point.

• mcp-audit-toolMIT static audit of MCP client configs — poisoning, rugs, secrets

  Free / OSS · OSS/MIT · 431 GitHub stars

  VerdictMIT MCP client-config auditor when you gate `.cursor/mcp.json` before connect — not Cisco MCP Scanner servers and not HOL Guard runtime policy.

  CatchPackage: README PyPI badge may lag — install from the MIT git repo / pipx, not the unrelated PyPI name `mcpaudit` (different project). Vs mcp-scanner / hol-guard / skillspector: MCP Scanner audits MCP servers/tools; HOL Guard is runtime local allow/block; SkillSpector gates skills — mcp-audit-tool’s catch is client-config static audit. ★ still small; pin a commit; findings are leads, not proof.

• gstackMIT Garry Tan’s Claude Code role stack — plan, review, QA, ship

  Free / OSS · OSS/MIT · 137k GitHub stars

  VerdictMIT opinionated Claude Code software factory when a solo founder wants plan→review→QA→ship roles out of the box — heavy setup and real-session browser power; pin it and audit what it can log into.

  CatchBlast radius: browser skills drive your real logged-in sessions (Aside on macOS) or import cookies from Chrome/Brave/Arc into its bundled browser — treat `/setup-browser-cookies` and the sidebar agent like handing over your accounts. 135k stars in ~7 months — rank on the workflows, not the counter. Claude Code is the only “full” tier; other hosts are advisory, and outside reviews expect Codex/Claude CLIs signed in. Team mode auto-updates every session (throttled hourly) — pin if you need reproducible agents. Vs mattpocock-skills / agent-skills / superpowers: those are smaller composable packs; gstack is a whole opinionated org chart with a browser runtime.

• FileBrowser QuantumApache-2.0 self-hosted web file manager — the maintained fork now that File Browser is archived

  Free / OSS · Apache-2.0 · 8.8k GitHub stars

  VerdictApache-2.0 self-hosted web file manager when you need browse/share/upload over a server path — free, and the place to move now that File Browser is archived; pin a release while v2 is in beta.

  CatchNot a drop-in upgrade from the original File Browser: configuration moved to `config.yaml` and the fork differs heavily, so plan a migration rather than swapping the image. v2.0.0 is in beta — pin a release. It is a web file manager, not a sync platform: no desktop or mobile sync clients like Nextcloud or Syncthing. Still put it behind TLS and your own auth when it faces the internet. If you are still on the archived upstream, upstream itself tells you to treat it as unmaintained.

• KubescapeApache-2.0 CNCF Kubernetes security — manifest and cluster scans, image CVEs, auto-fix, admission policies, MCP server

  Free / OSS · Apache-2.0 · 11.8k GitHub stars

  VerdictFree, broad Kubernetes posture scanning that fits in CI with one command — start with a single framework to tame the noise, and skip it if you have no Kubernetes.

  CatchCreated and still driven by ARMO, which sells a commercial platform on top, so expect docs and links to point there. Full-framework scans are noisy on a first run; pick one framework or a namespace scope before wiring it into CI. Image scanning wraps Grype, so it overlaps with Trivy if you already run that. The runtime operator is a real in-cluster footprint, not just a CLI.

• Codex SecurityOpenAI vulnerability finder and patcher

  Free / OSS · Apache-2.0 · 11.1k GitHub stars

  VerdictApache-2.0 agentic vuln scanner from OpenAI. Use when you want validated findings plus patches and accept paying for the model calls.

  CatchThe CLI is open source but the scanning is model calls: you sign in (`cs login`) or use an OpenAI API key in CI, so real scans cost usage — set the cost limits it documents. Needs Node 22.13+/24/26 plus Python 3.10+. Some scan tiers require separate Trusted Access for Cyber approval. Vs semgrep and trivy (deterministic rule/CVE scanners, free and fast): Codex Security is the slower LLM lane that reasons about and fixes findings — run it beside them, not instead.

• TruffleHogAGPL-3.0 secret scanner that finds leaked credentials and checks whether they still work

  Free / OSS · AGPL-3.0 · 28.6k GitHub stars

  VerdictThe scanner to run when you need to know which leaked keys are live — mind the AGPL and the outbound verification calls.

  CatchLicense first: AGPL-3.0 is copyleft, not permissive — check it with your legal team before embedding or modifying it in a product you distribute or offer as a service. Verifying a secret calls the real provider’s API with it, so scans make outbound requests and show up in that provider’s logs. Continuous monitoring of Slack, Jira, Confluence and similar tools is in the paid Enterprise product; the open-source CLI covers one-off and CI scans. Vs gitleaks (MIT, fast regex scanning, no live verification): TruffleHog tells you which leaks still work, at the cost of a copyleft license and network calls.

• Nginx UIAGPL-3.0 web UI for managing Nginx configs, certs and logs

  Free / OSS · AGPL-3.0 · 11.6k GitHub stars

  VerdictA handy Nginx admin panel for a small fleet — lock it down before you turn on the MCP side.

  CatchIt is a control panel with root-level power over your web server: never expose it to the internet without strong auth, and put it behind a VPN or allowlist. The MCP interface hands an agent the same power, so scope it carefully. AGPL-3.0 matters if you modify it and offer it to others over a network. Much of the community and docs traffic is in Chinese.

More with this tag (6)

• Technitium DNS Server — GPL-3.0 self-hosted recursive DNS server
• PrivateBin — Zlib zero-knowledge encrypted pastebin you self-host
• OpenLIT — Apache-2.0 OTel tracing, evals and guardrails for agents
• iron-session — MIT stateless encrypted cookie sessions for JavaScript
• Diun — MIT notifications when Docker images update
• Infisical — MIT secrets; Cloud Free forever 5 identities; ee/ needs LICENSE_KEY