Appsec Python Packages

csp-toolkit

Content Security Policy analysis, bypass detection, and CI gating. 21 weakness checks with A+ to F grading, 79 known bypass domains, SARIF output, and a GitHub Action.

libsast

Generic SAST Library

njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

devicecheck

Reduce fraudulent use of your services by managing device state and asserting app integrity via Apple DeviceCheck API with this Python wrapper.

sqlmap

Automatic SQL injection and database takeover tool

dirsearch

Web path scanner

badsecrets

A library for detecting known secrets across many web frameworks

websec-validator

Local-first security recon for AI coding agents: map attack surfaces, stage tailored probes, and produce a fact-grounded brief. Part of the Guard family with DocGuard and TestGuard.

secobserve-mcp

MCP server for SecObserve: triage vulnerability findings, manage products and rules, import scan reports and SBOMs, generate VEX documents

openziti

Ziti SDK for Python

oss-policy-kit

Policy-as-code starter kit for OSS repository governance and CI/CD hygiene across GitHub, GitLab, Azure, and AWS.

gitgalaxy

Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.

pyaim

@CyberArk Application Access Manager Client Library for Python 3

faradaysec

Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.

deluluscan

AI-augmented, evidence-first security auditor for authorized testing — web, API, LLM/AI, container, cloud & source code. Pluggable AI (Claude/OpenAI/DeepSeek/Ollama), agentic exploitation, deep verification, multi-format reports. AGPL-3.0.

ptai

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.

appsec-rules-pack

Engine-agnostic AppSec baseline rules pack: a JSON-Schema rule contract, a Python CLI validator, and per-rule OWASP ASVS 5.0 / API Top 10 / CWE / NIST SSDF mappings for security review and CI evidence. Validates and exports rules; it does not execute them.

mcp-authscan

Static detector for self-rolled-auth failure classes in MCP servers. Part of VATA — receipts over promises.

zerodom

Terminal-native DOM perception layer for AppSec and AI. Hook into live Chrome sessions, compress HTML tokens by 98.9%, and map attack surfaces deterministically.

x190

Fail your CI when an MCP endpoint serves its tool list without a token. Runtime probe and GitHub Action that also checks RFC 9728 OAuth posture and emits an HMAC-signed receipt of what was observed. Single file, stdlib only.

argus-panoptes

AI-powered security audit tool — point it at a repo, it reads the code, spins up the app, and actually attacks it. Static scan + live exploit swarm + LLM-explained fixes.

codeaudit

Codeaudit - Modern Python source code security analyzer based on distrust.