Application Security Python Packages

arcjet

Runtime security for AI apps and agents: prompt injection detection, tool-call authorization, sensitive-data redaction, bot protection, and rate limiting. Drop it into your Python code.

arcjet-sensitive-info-rampart

Runtime security for AI apps and agents: prompt injection detection, tool-call authorization, sensitive-data redaction, bot protection, and rate limiting. Drop it into your Python code.

appsec-rules-pack

Engine-agnostic AppSec baseline rules pack: a JSON-Schema rule contract, a Python CLI validator, and per-rule OWASP ASVS 5.0 / API Top 10 / CWE / NIST SSDF mappings for security review and CI evidence. Validates and exports rules; it does not execute them.

codepathfinder

Static Code Analysis for security teams with Inter file taint analysis. Built for finding vulnerabilities, advanced structural search, derive insights and supports MCP

pyrasp

PyRASP is a Runtime Application Self Protection package for Python-based Web Servers (Flask, FastAPI and Django), Serverless Functions (AWS Lambda, Azure and Google Cloud Functions) and MCP Servers (FastMCP)

stride-gpt

An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.

devsecops-radar

🛡️ Unify Trivy, Semgrep, Poutine & Zizmor scans into one AI-enhanced, offline-ready dashboard. Track CI/CD security trends, get LLM-powered analysis, and enforce policies — the open-source DevSecOps command center.

spamscope

Fast Advanced Spam Analysis Tool

sechelix

Most AI security tools try to find more. SecHelix tries to prove itself wrong: every candidate finding goes to an independent verifier whose only job is to disprove it. Open-source AppSec agent for Claude Code, Codex and Copilot.

metlo

Metlo is an open-source API security platform.

spoofy

Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records.

hunterxsec

AI-Assisted Vulnerability Discovery, Validation & Proof Engine

loomscan

Next-generation SAST combining Interval Type-2 Fuzzy Logic, AI verification, knowledge graphs, metamorphic testing, and counterfactual analysis for accurate security scanning.

secret-scan

A lightweight secret-scanning CLI tool to detect API keys, tokens, passwords, and credentials in code repositories.

quicdraw

QuicDraw(H3) is A security research tool designed for fuzzing and racing HTTP/3 servers. QuicDraw implements the `Quic-Fin-Sync` on HTTP/3 (over QUIC) for race-condition testing.

ai-protect

AI-application security assurance pipeline: tier-aware SAST · DAST · AI red-team scanning with a findings dashboard, CVE intel feeds & auto-remediation. For AppSec & platform teams shipping LLM apps and agents — pip install ai-protect

preflight-gate

Fail-closed admission for Python plugins: inspect inert manifests and refuse unapproved code before import. Artifact trust and Windows isolation are active alpha work.

burpr

👾 Burp Suite request parser, used for aid in assessing application security functionality.

polysecrets

A completely randomized order of secrets; built with security in mind.

vulnerability-explorer

A searchable catalog of software vulnerabilities with detailed technical documentation and a CLI explorer.

velonus

AI-native application security scanner for developers — finds real issues, explains why they matter, and generates fixes. Fully self-contained: velonus scan never sends your code anywhere.

trappsec

deception as a developer tool

burpr3

👾 Burp Suite request parser, used for aid in assessing application security functionality.