First reported github.com
Tools · latest
First reported · updated · 2 reports github.com
GitHub - delphisecurity/xaidr · GitHub
xaidr, published by delphisecurity, is an open-source (Apache-2.0) runtime security sensor for AI agents that detects and classifies threats such as part-level role forgery, forged tool-result injection, credential/secret-manager access, and data egress. The repo includes detection rules, enforcement modes (classify vs block), regression tests, and CI, positioning it as a defensive guardrail for agentic tool-calling systems. Details →First reported github.com
GitHub - snyk/agent-scan: Security scanner for AI agents, MCP servers and agent skills.
Snyk's agent-scan is an open-source security scanner (also distributed as the PyPI package snyk-agent-scan) that inspects AI agents, MCP servers, and agent skills for security issues. The GitHub repository shows active development, MCP-focused capabilities including a guard install for discovered servers, and references to MCP threats such as tool-poisoning and prompt injection. Details →First reported github.com
GitHub - Ventrova/sentinel-scan-cli: Free CLI: OWASP LLM Top 10 mapped prompt-injection & jailbreak scanner for LLM apps, plus MCP config (mcp.json) security scanning.
Sentinel Scan CLI (by Ventrova) is a free command-line scanner and GitHub Action that tests LLM applications for prompt-injection and jailbreak weaknesses mapped to the OWASP LLM Top 10, and also performs security scanning of MCP configuration files (mcp.json). Details →First reported github.com
GitHub - NVIDIA/SkillSpector: Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
NVIDIA's SkillSpector is an open-source security scanner that inspects AI agent skills for vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before installation, supporting Claude Code, Codex, and MCP skills. The GitHub repository is publicly available with ongoing commits and releases. Details →First reported · updated · 2 reports medium.com
Don’t Let Your Agent Mess Up Your Database | by MCP Toolbox for Databases | Google Cloud - Community
MCP Toolbox for Databases (github.com/googleapis/genai-toolbox), a Google-published MCP server, introduces URL Parameter Binding, a feature that lets developers hardcode sensitive connection parameters into the URL so they remain outside the LLM's reach, mitigating confused-deputy attacks where an agent could be manipulated into unauthorized database actions. Details →First reported github.com
customhouse/docs/false-positives.md at main · vineetpant/customhouse
customhouse is an MCP proxy that blocks prompt-injection exfiltration by tracking data provenance rather than inspecting content: once a session receives a result from an untrusted upstream MCP server, calls that move money or send data out are refused for the rest of the session. The write-up reports it blocked 11 of 11 injection scenarios but also flagged 4 of 10 benign workflows that used a sink, and analyzes each false positive. Details →First reported github.com
GitHub - fu351/Doberman-Core: Your AI's guard dog. Doberman sits at runtime, gating every input, output and tool call to stop unsafe or unintended actions before they execute.
Doberman-Core is an open-source runtime guardrail for AI agents that sits between the model and its actions, gating every input, output, and tool call to block unsafe or unintended actions before they execute. The GitHub repository is actively developed with adapters including Codex hooks and CLI JSON-output contracts. Details →First reported · updated · 3 reports github.com
GitHub - sattyamjjain/agent-audit-kit: Static scanner for MCP-connected AI agent pipelines. 296 rules across 12 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.
agent-audit-kit is a static scanner for MCP-connected AI agent pipelines, shipping 296 rules across 12 categories, mappings to 12 compliance frameworks, OWASP Agentic 10/10 and MCP 10/10 coverage, a GitHub Action, SARIF output, and a public CVE-to-rule ledger. The tool is aimed at helping defenders detect security weaknesses in AI agent and MCP integrations before deployment. Details →First reported github.com
GitHub - barvhaim/HoneyMCP: A Deception Security Layer for MCP Servers. It injects "ghost tools" (fake security-sensitive tools) that act as honeypots.
HoneyMCP is an open-source deception security layer for MCP (Model Context Protocol) servers that injects fake security-sensitive "ghost tools" acting as honeypots. When an agent or attacker invokes one of these decoy tools, the activity is flagged as suspicious and surfaced in a SOC-style dashboard, helping defenders detect malicious or compromised AI agents interacting with MCP servers. Details →First reported github.com
GitHub - ytkoka/mcp-tester: A web-based tool for inspecting MCP servers. Connect to any MCP server, browse its Tools, Resources, and Prompts, measure fetch latency, estimate token usage, score the quality of tool definitions, and compare two servers side by side, and scan for tool poisoning and rug pulls.
mcp-tester is an open-source web-based tool by ytkoka for inspecting MCP (Model Context Protocol) servers: it connects to any MCP server, browses Tools, Resources, and Prompts, measures fetch latency, estimates token usage, scores tool-definition quality, compares two servers, and scans for tool poisoning and rug pulls. The repository is published on GitHub under an MIT license with a live demo. Details →First reported · updated · 2 reports howtoharden.com
Cursor Hardening Guide | How to Harden
The How to Harden Cursor guide provides a set of runnable hardening scripts (published in the grcengineering/how-to-harden GitHub repo) to secure the Cursor agentic coding IDE, covering privacy mode, .cursorignore templates, API key rotation, MCP server auditing, agent settings, rules-file auditing, workspace trust, extension auditing, telemetry, and network allowlisting. The guidance references known Cursor risks such as prompt injection, over-permissioned agent actions, and MCP-related CVEs (e.g., CVE-2025-54135/CurXecute and CVE-2025-54136/MCPoison). Details →First reported github.com
GitHub - butterclaw-tech/butterclaw: A local-first agentic SOC & security watchdog for autonomous AI agents. Dual‑hemisphere Gemma 4 reasoning, behavioral drift tracking, event ledger, and kinetic response via the ButterVault. Protects OpenClaw, Hermes-Agent, and other MCP-based agents from prompt injection and rogue behavior.
ButterClaw is a local-first agentic SOC and security watchdog for autonomous AI agents, using dual-hemisphere Gemma reasoning, behavioral drift tracking, an event ledger, and signature-based detection to protect MCP-based agents (such as OpenClaw and Hermes-Agent) from prompt injection and rogue behavior. Recent commits add sanitizer-aware detection signatures including a cloud metadata service probe and persistence-mechanism injection detector. Details →First reported github.com
GitHub - adithyan-ak/AgentHound: Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.
AgentHound is an open-source offensive security framework for AI agent infrastructure, described as "BloodHound for the agentic stack." The tool performs reconnaissance, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. Details →First reported github.com
GitHub - api7/aisix: Open-source AI gateway for LLMs & AI agents, built in Rust. One OpenAI-compatible API for OpenAI, Anthropic, Gemini, Bedrock & more — routing, guardrails, caching, rate limits, observability.
aisix (api7/aisix) is an open-source AI gateway written in Rust that provides a single OpenAI-compatible API across providers such as OpenAI, Anthropic, Gemini, and Bedrock, adding routing, guardrails, caching, rate limits, observability, and MCP policy controls. Commit history references MCP policy features (e.g. mcp_policies) intended to govern agent/tool access. Details →First reported github.com
GitHub - MauricioPerera/mcpwasm: Static MCP: your tools are files, not servers. Hash-verified static skills executed sandboxed on demand (QuickJS-wasm on Cloudflare Workers) + llms.txt gateway
mcpwasm is a project that reimagines MCP tools as static, hash-verified files rather than running servers, executing each "skill" sandboxed on demand via QuickJS-wasm on Cloudflare Workers, with an llms.txt gateway. Skills declare sha256 hashes and the gateway re-verifies content on every read, rejecting tampered or drifted tool code (including a deliberate corrupt_skill fixture that tests hash-based rejection). Details →First reported github.com
GitHub - StackOneHQ/defender: Open source prompt injection protection for Agents calling tools (via MCP, CLI or direct function calling). Detect and defend against prompt injection attacks. 22MB, CPU-only, < 10ms latency.
Defender by StackOneHQ is an open-source tool that detects and defends against prompt injection attacks targeting AI agents that call tools via MCP, CLI, or direct function calling. It is described as a 22MB, CPU-only classifier with sub-10ms latency and covers both direct and indirect prompt injection. Details →First reported github.com
GitHub - dbreunig/drskill: Making sure your context is clean.
drskill is a GitHub tool by dbreunig for inspecting AI agent context and skill suites, listing configured MCP servers and their tools and generating injection review sheets to help ensure an agent's context is clean. The repo includes packaging, scripts, and MCP snapshot connection features. Details →First reported arxiv.org
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
Tencent's Zhuque Lab released AI-Infra-Guard, an open-source multi-layer AI agent red-teaming framework, on June 30, 2026, described in an arXiv paper and published to GitHub. The framework matches a detection paradigm to each layer of an agent's attack surface: deterministic rule matching over 75+ components and 1,400+ vulnerability rules, LLM-driven agentic auditing of MCP servers and agent-skill packages (supply-chain auditing), multi-turn black-box agent red teaming, and a jailbreak harness with 26+ attack operators across sixteen datasets. Details →First reported github.com
GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.
Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target. Details →First reported github.com
GitHub - AlwaysReadyAllies/warden: Drop-in security proxy for MCP — policy, tamper-evident audit, human approval, prompt-injection & secret-exfil defense. One line of config, zero code.
Warden is an open-source drop-in security proxy for the Model Context Protocol (MCP) that adds policy enforcement, tamper-evident audit logging, human approval gates, and defenses against prompt injection and secret exfiltration. The GitHub repository includes policies, examples, a SECURITY.md threat model, and a CI test matrix, and is configured via one line of config with no code changes. Details →First reported github.com
GitHub - gaur-avvv/wormxgpt: No limits. No filters. No restrictions. WormXGPT is a unified AI tooling suite containing both a premium Hacker-themed React Web Dashboard and an advanced Unfiltered CLI agent. It features 150+ tools, multi-server MCP integration, auto-fallback across 30+ providers, and local workspace integration.
WormXGPT is a GitHub-published "unfiltered" AI tooling suite (repo gaur-avvv/wormxgpt) marketed with the tagline "No limits. No filters. No restrictions," combining a hacker-themed web dashboard and a CLI agent with 150+ tools, multi-server MCP integration, and auto-fallback across 30+ AI providers. The project is presented as an unrestricted, jailbroken AI agent framework echoing WormGPT-style malicious LLM tooling. Details →First reported github.com
GitHub - pydantic/monty: A minimal, secure Python interpreter written in Rust for use by AI
Monty, from Pydantic, is a minimal, secure Python interpreter written in Rust intended for use by AI agents to execute generated code safely. It targets the emerging 'code mode' pattern where LLM agents write and run code to call MCP tools rather than invoking them directly, aiming to sandbox that execution. Details →First reported github.com
GitHub - rakshasa-1729/agentic-paved-roads: Generic security MCP server — brokers policies, risk, paved roads, and tools to coding agents. Talk demo for fwd:cloudsec 2026.
The agentic-paved-roads project is a generic security MCP (Model Context Protocol) server that brokers policies, risk assessments, paved roads, and tools to coding agents, published as a demo for a fwd:cloudsec 2026 talk. The repository ships runnable TypeScript code with tests, CI hardening, and release automation intended to enforce security controls on agent tool access. Details →First reported github.com
GitHub - beebeeVB/trajeckt: A causal firewall for AI agents: blocks multi-step tool-call chains that leak data, even when every call is individually allowed.
trajeckt is an open-source GitHub project described as a causal firewall for AI agents that blocks multi-step tool-call chains capable of leaking data even when each individual call is permitted. The repository includes SDKs, source, tests, benchmarks, and deployment configs. Details →First reported jackdavis.net
Maintaining Privacy With Agents: What Actually Works When Sensitive Data Is Part of the Workflow
A write-up releasing `agent-privacy`, an open-source privacy-control layer for CLI-style agent harnesses that intercept sensitive data (PII, identifiers) before it becomes model-visible context. It uses prompt/pre-tool/post-tool hooks with four actions — allow, redact, handoff, block — and integrates a local filter service, OpenAI Privacy Filter, and local Qwen models, with an operational pii-guard report covering ~6,343 screening decisions. Details →First reported freyzo.github.io
deep-xpia - multi-hop cross-prompt injection benchmark
deep-xpia is a benchmark of multi-hop cross-prompt injection (DXPIA) across delegated agent boundaries, with 300 live-measured cases and 8 attack patterns showing 69% land undefended and 12% even with all defenses. It highlights registry injection at tool-discovery (DXPIA-008) entering upstream of all 5 stacked defenses and maps patterns to documented Copilot incidents like EchoLeak. Details →First reported github.com
GitHub - denoland/clawpatrol: Security firewall for agents
Clawpatrol is an open-source security firewall for AI agents from denoland, designed to sandbox external plugins (treated as an untrusted supply-chain attack surface) using OS-level namespaces, Landlock, and macOS sandbox profiles, with permission lockfiles and brokered network dialing. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector