First reported github.com
Tools · latest
First reported · updated · 2 reports github.com
GitHub - delphisecurity/xaidr · GitHub
xaidr, published by delphisecurity, is an open-source (Apache-2.0) runtime security sensor for AI agents that detects and classifies threats such as part-level role forgery, forged tool-result injection, credential/secret-manager access, and data egress. The repo includes detection rules, enforcement modes (classify vs block), regression tests, and CI, positioning it as a defensive guardrail for agentic tool-calling systems. Details →First reported github.com
GitHub - Vedantgitbot/booth: BOOTH A lightweight checkpoint layer for LLM outputs. BOOTH sits between your application and an LLM call and decides whether an answer should pass through, be reconsidered, be flagged as resting on more than one valid interpretation, or be marked uncertain.
BOOTH is a lightweight Python checkpoint library that sits between an application and an LLM call, deciding whether an answer should pass through, be reconsidered, be flagged as resting on more than one valid interpretation, or be marked uncertain. The repository is an early-stage project (v0.4.3, 3 stars) providing structured checkpoints for LLM outputs. Details →First reported github.com
GitHub - snyk/agent-scan: Security scanner for AI agents, MCP servers and agent skills.
Snyk's agent-scan is an open-source security scanner (also distributed as the PyPI package snyk-agent-scan) that inspects AI agents, MCP servers, and agent skills for security issues. The GitHub repository shows active development, MCP-focused capabilities including a guard install for discovered servers, and references to MCP threats such as tool-poisoning and prompt injection. Details →First reported github.com
GitHub - kontext-security/sandy: Secure agents in seconds by running them in a sandbox.
Sandy, published by kontext-security on GitHub, is an open-source tool (written in Rust) that aims to secure AI agents by running them inside a sandbox. The repository provides installable crates and scripts intended to isolate agent execution to contain risky or untrusted agent behavior. Details →First reported huggingface.co
patronus-studio/wolf-defender-prompt-injection
Wolf Defender is a multilingual ModernBERT-based (mmBERT-base) binary classifier published on Hugging Face by Patronus that detects prompt injections and jailbreak-style instructions before untrusted content reaches an LLM. The v2 release provides a 2,048-token context window, ONNX deployment variants, and benchmark results showing improved specificity on hard-benign inputs, and is intended as a local guardrail layer for AI agents, chatbots, and retrieval pipelines. Details →First reported github.com
GitHub - Ventrova/sentinel-scan-cli: Free CLI: OWASP LLM Top 10 mapped prompt-injection & jailbreak scanner for LLM apps, plus MCP config (mcp.json) security scanning.
Sentinel Scan CLI (by Ventrova) is a free command-line scanner and GitHub Action that tests LLM applications for prompt-injection and jailbreak weaknesses mapped to the OWASP LLM Top 10, and also performs security scanning of MCP configuration files (mcp.json). Details →First reported github.com
GitHub - NVIDIA/SkillSpector: Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
NVIDIA's SkillSpector is an open-source security scanner that inspects AI agent skills for vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before installation, supporting Claude Code, Codex, and MCP skills. The GitHub repository is publicly available with ongoing commits and releases. Details →First reported medium.com
Block AI from installing malicious npm packages
Prasanna Mestha describes a defensive tool built to sit between AI coding agents and the npm registry to block installation of malicious or hallucinated packages, framed around the slopsquatting threat. The write-up cites real cases including the phantom 'react-codeshift' package requested hundreds of times a day and an August campaign in which a single threat actor pushed over 700 AI-named malicious npm packages that deliver a cross-platform RAT via README instructions. Details →First reported · updated · 2 reports medium.com
Don’t Let Your Agent Mess Up Your Database | by MCP Toolbox for Databases | Google Cloud - Community
MCP Toolbox for Databases (github.com/googleapis/genai-toolbox), a Google-published MCP server, introduces URL Parameter Binding, a feature that lets developers hardcode sensitive connection parameters into the URL so they remain outside the LLM's reach, mitigating confused-deputy attacks where an agent could be manipulated into unauthorized database actions. Details →First reported github.com
GitHub - occludra/gateway: Self-hosted AI security proxy. Redact PII, block prompt injection, route to any LLM provider. OpenAI-compatible.
occludra/gateway is a self-hosted, open-source AI security proxy that sits between applications and LLM providers to redact PII (via Microsoft Presidio), block prompt injection, and route requests to any OpenAI-compatible provider. The Apache-2.0 repository ships a proxy-api service, Presidio integration, configuration, and a Python SDK for deployment. Details →First reported github.com
customhouse/docs/false-positives.md at main · vineetpant/customhouse
customhouse is an MCP proxy that blocks prompt-injection exfiltration by tracking data provenance rather than inspecting content: once a session receives a result from an untrusted upstream MCP server, calls that move money or send data out are refused for the rest of the session. The write-up reports it blocked 11 of 11 injection scenarios but also flagged 4 of 10 benign workflows that used a sink, and analyzes each false positive. Details →First reported github.com
GitHub - fu351/Doberman-Core: Your AI's guard dog. Doberman sits at runtime, gating every input, output and tool call to stop unsafe or unintended actions before they execute.
Doberman-Core is an open-source runtime guardrail for AI agents that sits between the model and its actions, gating every input, output, and tool call to block unsafe or unintended actions before they execute. The GitHub repository is actively developed with adapters including Codex hooks and CLI JSON-output contracts. Details →First reported · updated · 3 reports github.com
GitHub - sattyamjjain/agent-audit-kit: Static scanner for MCP-connected AI agent pipelines. 296 rules across 12 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.
agent-audit-kit is a static scanner for MCP-connected AI agent pipelines, shipping 296 rules across 12 categories, mappings to 12 compliance frameworks, OWASP Agentic 10/10 and MCP 10/10 coverage, a GitHub Action, SARIF output, and a public CVE-to-rule ledger. The tool is aimed at helping defenders detect security weaknesses in AI agent and MCP integrations before deployment. Details →First reported github.com
GitHub - barvhaim/HoneyMCP: A Deception Security Layer for MCP Servers. It injects "ghost tools" (fake security-sensitive tools) that act as honeypots.
HoneyMCP is an open-source deception security layer for MCP (Model Context Protocol) servers that injects fake security-sensitive "ghost tools" acting as honeypots. When an agent or attacker invokes one of these decoy tools, the activity is flagged as suspicious and surfaced in a SOC-style dashboard, helping defenders detect malicious or compromised AI agents interacting with MCP servers. Details →First reported github.com
GitHub - OWASP/www-project-agent-memory-guard: OWASP Foundation web repository
OWASP Agent Memory Guard is an open-source project repository providing tooling to detect and block memory-injection and memory-poisoning attacks against AI agents, shipping a CLI scanner, API server, ML-based detection, additional detectors, a GitHub Action, and an attack-then-block demo runnable via Codespaces. Details →First reported github.com
GitHub - ytkoka/mcp-tester: A web-based tool for inspecting MCP servers. Connect to any MCP server, browse its Tools, Resources, and Prompts, measure fetch latency, estimate token usage, score the quality of tool definitions, and compare two servers side by side, and scan for tool poisoning and rug pulls.
mcp-tester is an open-source web-based tool by ytkoka for inspecting MCP (Model Context Protocol) servers: it connects to any MCP server, browses Tools, Resources, and Prompts, measures fetch latency, estimates token usage, scores tool-definition quality, compares two servers, and scans for tool poisoning and rug pulls. The repository is published on GitHub under an MIT license with a live demo. Details →First reported github.com
Strip hidden unicode tags from python strings in order to avoid malicious prompt injection attacks
A GitHub gist titled "strip-unicode-tags.py" by user r-leyshon provides a Python script to strip hidden Unicode tag characters from strings in order to defend against malicious prompt injection attacks that abuse invisible/hidden Unicode characters. Details →First reported perplexity.ai
Securing Agents Across Perplexity’s Client Endpoints with Numbat
Perplexity has open-sourced Numbat, an agent security suite for client endpoints (macOS, Linux, Windows) that detects, prevents, and investigates risky AI agent behavior. Numbat integrates with widely used client-side agent harnesses (e.g. CLI and desktop coding agents), enforces security rules, and provides agent-agnostic forensics to address incidents such as agents autonomously running with permissions bypassed via flags like --dangerously-skip-permissions and --yolo. Details →First reported · updated · 2 reports howtoharden.com
Cursor Hardening Guide | How to Harden
The How to Harden Cursor guide provides a set of runnable hardening scripts (published in the grcengineering/how-to-harden GitHub repo) to secure the Cursor agentic coding IDE, covering privacy mode, .cursorignore templates, API key rotation, MCP server auditing, agent settings, rules-file auditing, workspace trust, extension auditing, telemetry, and network allowlisting. The guidance references known Cursor risks such as prompt injection, over-permissioned agent actions, and MCP-related CVEs (e.g., CVE-2025-54135/CurXecute and CVE-2025-54136/MCPoison). Details →First reported darkreading.com
New Tool Traces AI Videos Back to Their Source
UC Riverside researchers built SAGA (Source Attribution of Generative AI videos), a framework that not only detects whether a video is AI-generated but also identifies the specific generative model, its version, and the development team for forensic attribution. The tool aims to counter deepfake-driven disinformation, impersonation, and social-engineering threats such as fraudulent deepfake job applicants. Details →First reported towardsdev.com
I Built a Prompt Injection Detector Using Go’s Standard Library
Cheikh seck describes building a prompt injection detector in Go using only the standard library — 29 regex rules and no ML models — tested against a product page seeded with 12 attack techniques drawn from a 2026 CrowdStrike prompt-injection taxonomy report. The accompanying code is published on GitHub (github.com/cheikh2shift/go-snippets/tree/main/prompt-injection). Details →First reported github.com
GitHub - butterclaw-tech/butterclaw: A local-first agentic SOC & security watchdog for autonomous AI agents. Dual‑hemisphere Gemma 4 reasoning, behavioral drift tracking, event ledger, and kinetic response via the ButterVault. Protects OpenClaw, Hermes-Agent, and other MCP-based agents from prompt injection and rogue behavior.
ButterClaw is a local-first agentic SOC and security watchdog for autonomous AI agents, using dual-hemisphere Gemma reasoning, behavioral drift tracking, an event ledger, and signature-based detection to protect MCP-based agents (such as OpenClaw and Hermes-Agent) from prompt injection and rogue behavior. Recent commits add sanitizer-aware detection signatures including a cloud metadata service probe and persistence-mechanism injection detector. Details →First reported darkreading.com
Ghost Credentials Expose Cloud Systems to Hidden Identity Risks
Security researcher Aleksandr Krasnov released NHI Hound, an open source tool to discover dormant non-human identities and map trust paths in cloud environments, after investigating an incident where an idle AI-enabled workflow agent suddenly began firing API calls and was found to have moved laterally and escalated privileges via 'ghost credentials.' The tool helps surface tokens, agents, and service accounts that live outside traditional trust boundaries in heavily automated, AI-based environments. Details →First reported github.com
GitHub - api7/aisix: Open-source AI gateway for LLMs & AI agents, built in Rust. One OpenAI-compatible API for OpenAI, Anthropic, Gemini, Bedrock & more — routing, guardrails, caching, rate limits, observability.
aisix (api7/aisix) is an open-source AI gateway written in Rust that provides a single OpenAI-compatible API across providers such as OpenAI, Anthropic, Gemini, and Bedrock, adding routing, guardrails, caching, rate limits, observability, and MCP policy controls. Commit history references MCP policy features (e.g. mcp_policies) intended to govern agent/tool access. Details →First reported github.com
GitHub - MauricioPerera/mcpwasm: Static MCP: your tools are files, not servers. Hash-verified static skills executed sandboxed on demand (QuickJS-wasm on Cloudflare Workers) + llms.txt gateway
mcpwasm is a project that reimagines MCP tools as static, hash-verified files rather than running servers, executing each "skill" sandboxed on demand via QuickJS-wasm on Cloudflare Workers, with an llms.txt gateway. Skills declare sha256 hashes and the gateway re-verifies content on every read, rejecting tampered or drifted tool code (including a deliberate corrupt_skill fixture that tests hash-based rejection). Details →First reported github.com
GitHub - DataDog/rshell: rshell - A Restricted Shell for AI Agents
rshell, published by DataDog, is a restricted shell designed to constrain what commands AI agents can execute, using allow-lists (allowedpaths), builtins, and hooks to sandbox agent shell access. The Go-based tool aims to limit the blast radius of autonomous AI agents that are granted shell capabilities. Details →First reported github.com
GitHub - StackOneHQ/defender: Open source prompt injection protection for Agents calling tools (via MCP, CLI or direct function calling). Detect and defend against prompt injection attacks. 22MB, CPU-only, < 10ms latency.
Defender by StackOneHQ is an open-source tool that detects and defends against prompt injection attacks targeting AI agents that call tools via MCP, CLI, or direct function calling. It is described as a 22MB, CPU-only classifier with sub-10ms latency and covers both direct and indirect prompt injection. Details →First reported github.com
GitHub - onecli/onecli: Open-source credential gateway with a built-in vault. give your AI agents access to services without exposing keys.
onecli is an open-source credential gateway with a built-in vault designed to let AI agents access external services without exposing raw API keys or secrets. The GitHub project brokers credentials so agents call services through the gateway rather than holding keys directly. Details →First reported github.com
GitHub - GiovanniGatti/cve-bench: A benchmark for evaluating AI agents on fixing real-world security vulnerabilities.
cve-bench is a benchmark by GiovanniGatti for evaluating AI agents on their ability to fix real-world security vulnerabilities, shipping a Docker-based harness, results, and a write-up comparing model performance across CVEs such as CVE-2026-33175, CVE-2026-42561, CVE-2026-40864, and CVE-2026-30930. Details →First reported github.com
GitHub - prompt-security/clawsec: A complete security skill suite for OpenClaw, Hermes, PicoClaw and NanoClaw agents (and variants). Protect your SOUL.md (etc') with drift detection, live security recommendations, automated audits, and skill integrity verification. All from one installable suite.
clawsec, published by prompt-security on GitHub, is an installable security skill suite for AI coding agents (referred to as OpenClaw, Hermes, PicoClaw and NanoClaw) that provides drift detection, live security recommendations, automated audits, and skill integrity verification for agent configuration files such as SOUL.md. The repository includes automated NVD/GHSA advisory syncing and packaged, npx-installable skills for hardening agent setups. Details →First reported github.com
GitHub - dbreunig/drskill: Making sure your context is clean.
drskill is a GitHub tool by dbreunig for inspecting AI agent context and skill suites, listing configured MCP servers and their tools and generating injection review sheets to help ensure an agent's context is clean. The repo includes packaging, scripts, and MCP snapshot connection features. Details →First reported knostic.ai
Building openclaw-shield: Lessons Learned Securing OpenClaw Agents
Knostic has open-sourced openclaw-shield, a security plugin for OpenClaw AI agents that enforces guardrails at the tool/execution layer rather than relying on prompts or transcript scanning. It uses a 5-layer defense-in-depth approach (prompt guard, output scanner, and an execution gate requiring explicit allow/deny decisions) to stop agents from leaking secrets, exposing PII, or running destructive commands like rm -rf. Details →First reported github.com
GitHub - cgrtml/reasongate: Explainable security gate for LLM apps — blocks prompt injection with an auditable reason for every decision.
ReasonGate is an open-source explainable security gate for LLM applications that aims to block prompt injection while emitting an auditable reason for every allow/deny decision. Beyond text detection, it adds a capability-based 'agent action gate' (framed around the lethal-trifecta) that blocks tool calls by argument taint even when detection misses reworded attacks, with a live playground and a documented threat model describing its guarantees and non-guarantees. Details →First reported github.com
GitHub - AlwaysReadyAllies/warden: Drop-in security proxy for MCP — policy, tamper-evident audit, human approval, prompt-injection & secret-exfil defense. One line of config, zero code.
Warden is an open-source drop-in security proxy for the Model Context Protocol (MCP) that adds policy enforcement, tamper-evident audit logging, human approval gates, and defenses against prompt injection and secret exfiltration. The GitHub repository includes policies, examples, a SECURITY.md threat model, and a CI test matrix, and is configured via one line of config with no code changes. Details →First reported github.com
GitHub - davidmatousek/tachi: Threat modeling and AI-reasoning vulnerability detection harness for Claude Code — STRIDE + AI + MAESTRO
Tachi is an open-source GitHub project by davidmatousek providing a threat-modeling and AI-reasoning vulnerability detection harness for Claude Code, combining STRIDE, AI-specific, and MAESTRO threat frameworks. The repo references OWASP Top 10 for LLM and Agentic Applications and is actively developed with numerous releases. Details →First reported github.com
GitHub - ClickHouse/code-interpreter: Sandboxed code execution API for AI agents: powers LibreChat's Code Interpreter
ClickHouse's code-interpreter is an open-source sandboxed code execution API for AI agents, which powers LibreChat's Code Interpreter feature. The repository includes AppArmor profiles and CI hardening to isolate untrusted, agent-generated code execution. Details →First reported github.com
GitHub - pydantic/monty: A minimal, secure Python interpreter written in Rust for use by AI
Monty, from Pydantic, is a minimal, secure Python interpreter written in Rust intended for use by AI agents to execute generated code safely. It targets the emerging 'code mode' pattern where LLM agents write and run code to call MCP tools rather than invoking them directly, aiming to sandbox that execution. Details →First reported github.com
GitHub - clayseal/clayseal-identity: Runtime identity for AI agents. Short-lived attested credentials with capability tokens that agents narrow as tasks change and verify offline.
clayseal-identity is an open-source project providing runtime identity for AI agents, issuing short-lived attested credentials with capability tokens that agents can narrow as tasks change and verify offline. The repository includes backend, conformance tests, deployment configs, integrations, and examples for adding scoped, verifiable identity to agentic systems. Details →First reported github.com
GitHub - rakshasa-1729/agentic-paved-roads: Generic security MCP server — brokers policies, risk, paved roads, and tools to coding agents. Talk demo for fwd:cloudsec 2026.
The agentic-paved-roads project is a generic security MCP (Model Context Protocol) server that brokers policies, risk assessments, paved roads, and tools to coding agents, published as a demo for a fwd:cloudsec 2026 talk. The repository ships runnable TypeScript code with tests, CI hardening, and release automation intended to enforce security controls on agent tool access. Details →First reported github.com
GitHub - manojmallick/gavio: The open standard AI gateway — PII protection, audit, reliability & cost control as composable interceptors. Same API in Python, Java & JavaScript.
Gavio is an open-source AI gateway that adds PII protection, audit logging, reliability and cost control as composable interceptors, with a consistent API across Python, Java and JavaScript. It sits in front of LLM providers to inspect and mediate requests/responses. Details →First reported github.com
GitHub - beebeeVB/trajeckt: A causal firewall for AI agents: blocks multi-step tool-call chains that leak data, even when every call is individually allowed.
trajeckt is an open-source GitHub project described as a causal firewall for AI agents that blocks multi-step tool-call chains capable of leaking data even when each individual call is permitted. The repository includes SDKs, source, tests, benchmarks, and deployment configs. Details →First reported github.com
GitHub - vinerya/driftGuard: Embedding-based response drift detection for LangChain agents.
driftGuard is a Python package providing embedding-based response drift detection for LangChain agents, intended to monitor and detect when agent responses deviate over time. Details →First reported github.com
GitHub - bastion-soft/pi-detector-bench: Open, model-agnostic benchmark for prompt-injection detectors — scored on both axes (attack catch-rate and false positives on real traffic), threshold-agnostic, and reproducible from raw scores.
pi-detector-bench is an open, model-agnostic benchmark from bastion-soft for evaluating prompt-injection detectors, scoring both attack catch-rate and false positives on real traffic, with threshold-agnostic, reproducible results. It is published as a runnable GitHub repo with notebooks, scripts, and results. Details →First reported pypi.org
prompt-injection-defense
prompt-injection-defense is a Python package (pip install prompt-injection-defense) providing lightweight detection of prompt injection, jailbreaks, indirect injection, obfuscation, and unsafe content aligned to the OWASP LLM Top 10. It is an installable, MIT-licensed library maintained by Rajat Ghosh. Details →First reported github.com
GitHub - Lelu-ai/lelu: Open source authorization engine for AI agents. Confidence-aware gating · Human-in-the-loop review · Policy-as-code · Full audit trail
Lelu is an open-source authorization engine for AI agents offering confidence-aware gating, human-in-the-loop review, policy-as-code, and a full audit trail. It adds decision types (allow/deny/human_review/compute), payload hashing, and policy digests to control and audit agent tool actions. Details →First reported github.com
GitHub - can995835646-byte/SentryGuard: Python CLI to detect Agentjacking injection attacks in Sentry error events
SentryGuard is a Python CLI that scans Sentry error events to detect 'Agentjacking' injection attacks — indirect prompt-injection payloads (e.g. system_prompt_injection, base64_shell_eval, 'ignore previous instructions', 'ADMIN OVERRIDE') that could trigger AI agents consuming error data. It also offers a sanitize command to strip system-prompt-style and prompt-override phrases from events. The repo is gated behind a Gumroad license check. Details →First reported ryandens.github.io
promptblock — block prompt injection in GitHub issues
promptblock is a GitHub tool that scans issue and comment bodies for prompt-injection payloads, specializing in instructions hidden inside HTML comments that GitHub's renderer drops but AI agents reading the raw API text still ingest. It splits bodies into visible and hidden segments, runs a bundled ML classifier, and flags risky content with a label and warning comment. Details →First reported jackdavis.net
Maintaining Privacy With Agents: What Actually Works When Sensitive Data Is Part of the Workflow
A write-up releasing `agent-privacy`, an open-source privacy-control layer for CLI-style agent harnesses that intercept sensitive data (PII, identifiers) before it becomes model-visible context. It uses prompt/pre-tool/post-tool hooks with four actions — allow, redact, handoff, block — and integrates a local filter service, OpenAI Privacy Filter, and local Qwen models, with an operational pii-guard report covering ~6,343 screening decisions. Details →First reported github.com
GitHub - rewired89/HSIP-1PHASE: A self-hosted identity server that gives AI agents a cryptographic identity, generates tamper-proof audit trails, and covers financial compliance requirements (MiFID II, FINRA 4511, SOX §404, DORA, SWIFT CSCF) all in a single Rust binary with no cloud dependency.
HSIP-1PHASE is a self-hosted Rust binary identity server that assigns AI agents a cryptographic identity, produces tamper-proof audit trails of agent actions, and maps to financial compliance regimes (MiFID II, FINRA 4511, SOX §404, DORA, SWIFT CSCF). It ships with a browser extension that surfaces an AI agent activity panel and recent audit entries. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector