Attack Surface Python Packages

websec-validator

Local-first security recon for AI coding agents: map attack surfaces, stage tailored probes, and produce a fact-grounded brief. Part of the Guard family with DocGuard and TestGuard.

safeai-static-analyzer

Static analysis and attack-surface scanner for AI agents — SAST for prompts, tools, MCP servers, and agent workflows. Detects capabilities, prompt risks, tool permissions, and governance gaps before deployment.

vamp-easm

External Attack Surface Management — subdomain enum, port scan, TLS, diff tracking + Shodan Monitor alerts (CVEs & new ports)

apisec-ai-surface

Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS, runs offline.

chiasmodon

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.

opendoor

OWASP Web Recon & Directory Discovery Platform

vamp-passive-recon

VampSecure Labs: Passive recon engine — subdomain enumeration + HTTP headers analysis

burp2model

Turn a Burp Suite history into an evidence-backed model of a web app's attack surface. Query it with no AI; every claim cites a request.

kosty

Scan 30+ AWS services. Find cost waste. Detect security gaps. Map your attack surface. One command.

vamp-shodan-hunt

Shodan OSINT exposure hunter — CVE-exposed hosts, product enumeration, org attack surface, raw queries. No Shodan SDK required.

sentineldeck

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, and certificate-transparency checks.

cryptsmith

Crypto attack primitives and analysis toolkit for CTF players and security researchers. Zero dependencies.

flaghunter

CTF crypto autosolver and pcap hunter. Point it at a challenge file or packet capture and it runs a full attack battery for you.

evilspider

Async security crawler for recon, bug bounty & attack surface discovery. Finds hidden endpoints, parameterized URLs, upload forms & subdomains.

webanalyzer-security

Open-source attack-surface scanner: subdomains, DNS, tech stack and vulnerabilities in one command. SARIF for GitHub Code Scanning, a GitHub Action, a web dashboard, and plugins that are one file each.

webstor

WebStor efficiently enumerates all websites across your organization’s networks and those in your DNS records - including cloud-hosted servers via zone transfer data - stores their responses, and lets you query for known web technologies, including those with zero-day vulnerabilities.

bladerecon

Intelligence-driven reconnaissance framework for bug bounty hunters and security professionals.

perimeter-scan

Passive external attack-surface scanner — find exposed subdomains, expiring certs, missing security headers, and dangling DNS before attackers do.

matadore

AI-powered attack surface mapping for red teams.