Pentest-Swarm-AI is an open-source autonomous penetration testing tool built on a stigmergic swarm architecture. It coordinates multiple LLM-driven specialist agents (recon, classifier, exploit, report) via a shared blackboard with pheromone decay, enabling emergent attack paths without a central planner. The system integrates 30+ external security tools (nmap, nuclei, sqlmap, etc.), multiple LLM providers (Claude, OpenAI, Ollama, Gemini, LM Studio), and bug bounty platforms (HackerOne, Bugcrowd, Intigriti) for automated scope import and report submission. The architecture is a multi-agent system with a scheduler that dispatches agents based on blackboard predicates and pheromone levels. Key entry points include a CLI (Cobra commands: scan, init, playbook, submit, etc.), an API server (Fiber), a WebSocket hub for live streaming, a Next.js web dashboard, and an MCP server for IDE integration. Data flows: agents write findings to the blackboard with pheromone weights; the scheduler reads the blackboard and triggers agents whose predicates match; agents read findings, process them, and write new findings, creating a stigmergic feedback loop. External dependencies include PostgreSQL with pgvector for durable blackboard storage, LLM API endpoints, and the installed security tool binaries. The codebase demonstrates high craftsmanship with clean abstractions (tool adapter pattern, LLM provider interface, blackboard interface), extensive testing (unit, integration, e2e, benchmarks, LLM eval), and safety features (scope enforcement, provenance signing, rate limiting, false-positive caching). It is actively maintained with recent commits, CI/CD pipelines, and community engagement.
Hawk-Eye is a command-line application designed to scan various data sources for Personally Identifiable Information (PII) and secrets. It supports cloud storage (S3, GCS, Firebase), databases (MySQL, PostgreSQL, MongoDB, Redis), file systems, and collaboration platforms (Slack, Google Drive). The tool uses regex pattern matching and OCR to detect sensitive data in multiple file formats including images, PDFs, Office documents, and videos. The architecture is modular with a central dispatcher in main.py that routes commands to specific implementations in the commands/ directory. Shared functionality like file reading, OCR, and pattern matching is encapsulated in internals/system.py. This design allows easy extension to new data sources by adding new command modules. The tool is intended for security auditing and can be run standalone or integrated into scripts/CI/CD pipelines. Features include alert deduplication, severity-based reporting, and Slack/Jira integrations. Despite its comprehensive feature set, the tool maintains separation of concerns, making it maintainable and extensible. The use of third-party libraries for specific data sources keeps core logic focused on scanning and reporting.
This repository is a comprehensive library of machine-readable taxonomies (machine tags) for threat intelligence and information sharing, primarily designed for the MISP platform. It contains over 200 taxonomy definitions in a standardized JSON format, each defining a namespace with predicates and values for tagging events, attributes, and indicators. The taxonomies cover a wide range of domains including cyber incident classification, malware analysis, information handling policies (TLP, PAP, IEP), regulatory compliance (GDPR, NIS2, EU AI Act), attack modeling (kill chain, Diamond Model), and specialized areas like disinformation, AI safety, and drone classification. While the core content is data, the repository also includes a set of reusable Python tools for validation, generation, and conversion of taxonomies, as well as CI/CD pipelines and a JSON schema. The hybrid nature is evident: it is primarily a data library but with significant application-like tooling for maintaining and extending the taxonomy collection.
Berty is a full-stack, privacy-focused, peer-to-peer messaging application. The system consists of a Go backend implementing the Wesh protocol (based on IPFS, libp2p, and OrbitDB) that provides core messaging, push notifications, authentication, replication, and directory services. The backend is exposed via gRPC and consumed by multiple clients: a React Native mobile app (with both a legacy JS variant and a newer Expo-based variant), a Go CLI with a terminal UI (mini) and a desktop GUI (Fyne), and native bridges for iOS and Android. The architecture is modular, with separate packages for error handling, authentication, push relay, and bot framework. Key entry points include the `berty daemon` CLI command, the mobile app entry points (`App.tsx` in both `js/packages` and `berty-bridge-expo/mobile`), and the bridge framework (`go/framework/bertybridge`). Data flows involve gRPC streams from the Go backend to the mobile clients, with event-driven state management and local encrypted storage via SQLCipher. External dependencies include libp2p, OrbitDB, gRPC, protobuf, and various platform-specific native modules for BLE, mDNS, and push notifications. The repository also contains auxiliary tools for infrastructure testing, rendezvous servers, and debugging (Tyber).
This repository provides a collection of 52 specialized AI agent definitions for penetration testing and red team operations, designed to be used with Claude Code. It is distributed as a Claude Code plugin, with an interactive installer (install.sh), a SQLite findings database (db/findings.sh) for persisting engagement data, and a versioned migration system. The agents are defined as Markdown files with YAML frontmatter, each containing structured system prompts that enforce scope validation, OPSEC tagging, evidence handling, and MITRE ATT&CK mapping. The system includes a swarm orchestrator for multi-agent coordination, a scope guard for safety, and a two-tier safety model (advisory vs. Bash-capable agents). While primarily a configuration/instruction set rather than a traditional software application, it demonstrates strong engineering practices in prompt architecture, database schema design, and distribution automation. The repository is actively maintained with CI validation, shellcheck, and unit tests for the database scripts.
This repository is a curated, bilingual (English/Chinese) OPML feed collection focused on cybersecurity and AI, containing approximately 1000+ RSS/Atom feed URLs organized into 12 categories (e.g., Crypto, Pwn, WebSecurity, MobileSecurity, AI). It serves as the data backbone for a personal intelligence pipeline, designed to feed into AI-curated daily security digests. The repo includes automation scripts for feed health monitoring (opml_sync.py with HTTP retries, gzip/deflate decoding, and stateful failure tracking), interactive feed addition (add_feed_to_tiny.py), and optional LLM-assisted pruning (prune_opml.py). A GitHub Actions workflow runs sync operations on push and validates PRs. The actual value lies in the carefully vetted list of high-quality security sources, including many from the Chinese security community, with automated dead-link detection and deduplication. The scripts are well-structured and testable, but the repository's primary deliverable is the curated data, not the application logic.
SpyGuard is a network traffic analysis tool designed for detecting signs of compromise, particularly stalkerware and spyware, by monitoring WiFi traffic from connected devices. It consists of a frontend Vue.js 3 application for user interaction and capture initiation, and a backend Flask API for managing configuration, threat intelligence, and analysis. The core analysis engine processes PCAP files using Suricata, checks traffic against IOC databases and whitelists, performs heuristic and active checks (passive DNS, WHOIS, SSL validation), and generates JSON/PDF reports. External watchers periodically update threat intelligence feeds from sources like Cisco Umbrella and IP-to-ASN mappings. The architecture separates concerns: frontend handles capture UI and device management, backend provides authenticated APIs for system administration, and the analysis engine performs the detection logic. Key entry points include server/frontend/main.py (frontend service), server/backend/main.py (backend API), server/backend/watchers.py (threat intelligence updater), and analysis/analysis.py (analysis trigger).
This repository is a manually curated awesome-list/registry of open-source security scanners and offensive/defensive tools. It spans traditional security testing categories (web, mobile, binary, smart-contract, IoT, APT) and an actively expanded section for AI/LLM-agent security. The actual content is a set of near-identical English, Chinese, and Spanish README files containing hundreds of one-line tool entries with shields.io badges for language, last commit, stars, and license. There is no application runtime, no build pipeline, and no test suite; the product is a navigable knowledge base rather than software. The repo is therefore classified as data_research only in the sense that it is a structured, human-maintained metadata registry, not a data pipeline. The primary data lineage is manual: maintainers sample external GitHub projects, annotate each with a one-sentence description and category, and publish the result as markdown. The taxonomy serves as an analytical schema, answering questions such as which open-source scanners exist for a given domain, which are active, and what maturity signals (stars, license, last commit) they carry. It does not provide quantitative benchmarks or automated validation, and the data is not exposed in machine-readable form beyond the markdown itself. Reuse is straightforward for human readers, but automation requires parsing the markdown and accepting that some badges or links may be stale or inconsistent. The repository is actively curated, with recent emphasis on AI security, a documented commit convention, and multilingual READMEs. Its main risks are extrinsic: link rot, renamed or abandoned upstream tools, and the CC BY-NC-ND license, which restricts derivative redistribution. Technical drift is moderate because some older categories and tools are outdated even though the overall list is kept current.
Haaukins is a cybersecurity training and Capture The Flag (CTF) platform developed at Aalborg University. It orchestrates isolated lab environments for teams, combining Docker containers and VirtualBox VMs to deliver challenges. The system is built as a set of gRPC microservices: a central daemon manages event lifecycle, team assignments, and challenge verification; a store service provides persistence; and an exercise service defines challenge configurations. Participants access labs via a web frontend (Amigo) using browser-based RDP (Guacamole) or WireGuard VPN. The daemon also handles DNS/DHCP per lab subnet, real-time scoreboards via WebSocket, and keylogging for monitoring. The CLI client (hkn) allows administrators to manage events, teams, and exercises. The architecture is modular with clean interfaces for virtualization (Docker/VirtualBox) and storage (in-memory with hooks or gRPC backend), though some components show tight coupling and aging dependencies.
This repository is a comprehensive cybersecurity knowledge base focused on offensive security techniques, particularly binary exploitation, cryptography, reverse engineering, and CTF challenge writeups. It serves as an educational resource containing detailed tutorials, exploit development guides, and solution writeups for various platforms (HackTheBox, picoCTF, etc.). The content is organized by topic with markdown files explaining concepts ranging from basic stack overflows to advanced heap exploitation techniques like tcache poisoning and kernel attacks. While not containing runnable applications, it provides reusable exploit methodologies and code snippets that security practitioners can adapt for learning and CTF preparation.
This repository is a curated list of tools and resources for security incident response and digital forensics (DFIR). It is organized into categories such as adversary emulation, evidence collection, log analysis tools, memory analysis tools, and more. Each entry includes a link and a brief description. The project includes GitHub Actions workflows to automatically check for broken URLs in the documentation and to lint the README for spelling errors, ensuring the list remains accurate and well-maintained. The primary value of this repository lies in its comprehensive collection of DFIR resources, which serves as a reference for security analysts and teams. The maintenance workflows demonstrate a commitment to data quality by proactively validating links and checking for spelling errors, which is essential for a resource list that relies on external URLs. While the repository does not contain complex data pipelines or analytical code, it effectively fulfills its purpose as a reference list through structured markdown and automated upkeep.
This repository is a curated 'awesome list' of threat detection and hunting resources. It does not contain any executable code, application logic, or data pipelines. The content is purely a markdown document (README.md) and its HTML equivalent, along with a small number of PDF guides. The repository functions as an index of links to external tools (e.g., osquery, Sigma, HELK), datasets (e.g., Mordor, BOTS), frameworks (MITRE ATT&CK), blogs, videos, and training resources. It is a static, non-functional reference directory. While it serves as a valuable starting point for security professionals, it has no software architecture, no entry points, no data flows, and no reusable code components. Its value lies in curation and organization rather than engineering.
This repository, branded as "The Malware Bible," is a curated educational knowledge base for cybersecurity, malware analysis, reverse engineering, and exploit development. It is not a conventional software application or an operational data pipeline; under the available classifications it is closest to data/research because its core assets are reference documentation, course-style Markdown modules, and research-oriented binaries rather than runnable application code. The content is organized into four learning paths: The Beginning (C, Python, x86 assembly, shellcode, reverse engineering basics), The Journey (PE/ELF structures, Android/iOS package formats), The Rituals (obfuscation, evasion, and writing malware), and The Scriptures (tool cheatsheets for radare2, IDA Pro, WinDbg, YARA, WinAPI, and evasion tactics). In practice, the repository serves as a self-study curriculum and analyst reference, not as a deployable system. It includes a large Windows DLL export catalog in Markdown, example ELF binaries demonstrating heap overflow, use-after-free, ROP chains and format string bugs, and numerous screenshots/diagrams. There is no CI/CD, dependency management, or automated testing; several files are marked "Coming soon" or "WORK IN PROGRESS," and external links or sponsor images may rot over time. The Windows API and DLL reference content is broad but may drift as Windows evolves. The last commit is recent, indicating active maintenance, and the repository benefits from a structured table of contents and consistent formatting across chapters.
This is an educational repository of Python scripts, mini-projects, and markdown guides for building LLM-based AI agents applied to cybersecurity. The code is organized into five progressive parts: foundational LLM/embeddings usage, prompt templates, prompt chaining, RAG over security data, and agentic workflows. It demonstrates multiple agent frameworks (LangChain, LangGraph, CrewAI, DeepAgents) and MCP server integrations for tools like nmap and Shodan. The dominant character is application/tutorial code rather than data research, although it bundles small datasets (CVE embeddings, sample RAG corpora) and commits Chroma vector stores for offline exercises. The repo is not a single deployable service; it is a collection of entry-point scripts and small frameworks. Architecture is a set of standalone examples with shared patterns: state graphs for orchestration, YAML-configured crews, MCP adapters, and RAG ingestion/query pipelines. Most scripts require OpenAI-compatible API keys and/or local tools such as nmap/Ollama. Simulated data and placeholder responses in some examples make it a learning environment rather than production security tooling. Maintenance is current but drift is moderate: some examples use deprecated langchain vectorstore imports, documentation is duplicated across subdirectories, several referenced files are missing, and hardcoded model strings like gpt-5.4-mini appear dated or fictional. There is no root-level automated test suite; only the Shodan MCP subproject contains tests. The strongest reusable patterns are the MCP server wrapping, LangGraph conditional-state orchestration, CrewAI declarative crew configuration, and the hierarchical SOC agent supervisor.
This repository is a curated list of over 150 red teaming tools and resources, organized by MITRE ATT&CK categories (Reconnaissance, Resource Development, Initial Access, etc.). It contains no original source code; instead, it provides descriptions, installation instructions, usage examples, and links to external tools. The README is the sole deliverable, serving as a comprehensive reference for red team operators. While not a software application itself, it functions as a catalog of applications. The backlog file contains a few additional URLs and notes for future additions. The repository is well-maintained with active issue triage and recent commits, but its value lies in curation rather than code craftsmanship.
This repository is a comprehensive, curated collection of cybersecurity study plans covering 20+ specialized domains such as application security, cloud security (AWS/Azure/GCP), DevSecOps, threat modeling, GRC, GenAI security, and more. It is not a software application or data research project; rather, it is a knowledge base of structured markdown roadmaps designed to guide learners and professionals through role-specific cybersecurity skill development. The plans reference up-to-date frameworks (OWASP Top 10:2025, NIST CSF 2.0, EU AI Act), include curated resources (books, videos, courses, certifications), and are consistently maintained. The repository has high community engagement (5k+ stars) and remains actively updated, though it contains no executable code, data pipelines, or notebooks.
This repository is a curated directory of cybersecurity tools and resources, organized into categories such as AI security, API pentesting, C2 frameworks, forensics, OSINT, and more. It is built as a static documentation site using Retype, with markdown pages listing external links and brief descriptions. The repository contains no executable application code, data pipelines, or analytical models. Its primary function is to serve as a reference index for security professionals, maintained through periodic updates to links and categories. The codebase is essentially a collection of markdown files and configuration for the static site generator, with a large set of default password text files included as a resource. There is no software architecture, entry points, or data flows beyond the static site generation. The repo is well-organized and regularly updated, but it offers no reusable software components or novel engineering patterns.
This repository is a comprehensive collection of red teaming tactics, techniques, and procedures (TTPs) presented as markdown cheatsheets and guides. It is not a software application or data pipeline; rather, it is a knowledge base containing hundreds of embedded code snippets (bash, PowerShell, Python, Go, Rust, C, etc.) organized by platform (Linux, Windows, macOS, Cloud, ICS, Web). The repo includes a few standalone tools such as an Azure subdomain enumeration Metasploit module, a Flask-based C2 redirector container, a PDF generation script, and a PAM module for credential harvesting. The primary value is as a reference for offensive security operators, not as a runnable application. Architecture is document-based with no API, CLI entry point, or library exports. External dependencies are minimal (mostly system tools).
DuplexSpyCS is a full-featured Remote Access Trojan (RAT) command-and-control (C2) framework written in C# (.NET WinForms). It consists of a server-side management console and multiple payload variants (winClient48, winClient48DLL, Tipoff, etc.) that provide comprehensive post-exploitation capabilities: file manager, remote desktop, keylogger, webcam/microphone streaming, registry editor, process/task manager, remote shell (including xterm via WebView2), SOCKS5 proxy, and a plugin system for credential theft (Chrome, Edge, Firefox, MobaXterm). Communication uses a custom binary protocol (clsDSP) over TCP, TLS, or HTTP with RSA-AES hybrid encryption. The payloads employ persistence via registry/startup, UAC bypass, process injection (APC, EarlyBird, CreateRemoteThread, etc.), and fileless execution. The codebase is extensive but exhibits significant code duplication across payload projects, many incomplete or stub features, and outdated dependencies (AForge, NAudio, SharpPcap). It is explicitly designed for offensive security research and learning, but carries high risk of misuse.
This repository is the archived reference implementation of the CAI (Cybersecurity AI) framework by Alias Robotics. It is a comprehensive, open-source platform for building and deploying AI-powered offensive and defensive security automation. The codebase provides a full-stack agent framework including a Python SDK (Agent, Runner, tools, handoffs, guardrails, tracing, voice, MCP), a CLI/REPL with rich interactive features, a Textual-based TUI, a FastAPI REST API server, and a benchmarking suite (CAIBench) with cyber ranges and CTF challenges. The framework supports multiple LLM providers (OpenAI, LiteLLM, custom) and includes specialized agents for red teaming, blue teaming, bug bounty, DFIR, network analysis, and more. It also features continuous operations (24/7 autonomous loops), session management, cost tracking, and extensive refusal testing (400+ scenarios). While the repository is now archived and will not receive further updates, the SDK components (function_tool decorator, Handoff abstraction, tracing processors, voice pipeline) are well-crafted and could be extracted for reuse in other agent-based projects. The codebase is large and monolithic, with some global mutable state and test duplication, but overall demonstrates strong engineering practices in the cybersecurity AI domain.