Blue Team Python Packages

adversarial-robustness-toolbox

Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams

kcwarden

Automatically audit your Keycloak configuration for security issues

agent-security-harness

470 security tests for AI agent systems — MCP, A2A, x402/L402, decision governance, benchmark integrity, skill supply chain. AIUC-1 pre-cert, NIST AI 800-2 aligned, CVE-2026-25253 reproduction. v4.4.2

1200km-aidebug

AI-assisted malware reverse-engineering debugger with ATT&CK, YARA, IOC, and report output.

cepheus-engine

Container escape scenario modeler — enumerate container security posture and model realistic escape paths

slack-watchman

Slack enumeration and exposed secrets detection tool

opensquat

The openSquat is an open-source tool for detecting domain look-alikes by searching for newly registered domains that might be impersonating legit domains and brands.

loghunter-cli

Local-first, transparent threat hunting for the logs you already have: Zeek, Pi-hole, syslog, CloudTrail. Names the technique behind every finding. No SIEM, no agent, no black box.

gitlab-watchman

Finding exposed secrets and personal data in GitLab

yara-gen

Generate YARA rules automatically from positive and negative examples. For PII detection, secret scanning, and prompt injection.

yaramint

Generate YARA rules automatically from positive and negative examples. For PII detection, secret scanning, and prompt injection.

breach-check

Python tool which checks for data breaches for provided emails

dotenv-secrets-scanner

Production-ready secrets scanner for Git repositories. Detects API keys, passwords, tokens, and credentials accidentally committed to source code.

dorothy

Dorothy is a tool to test security monitoring and detection for Okta environments

cloudsaga

AWS CloudSaga is a tool to test security controls and alerts within their Amazon Web Services (AWS) environment

githubaudit

Uses a Github PAT to assess the security configuration of repositories and provides a report

github-watchman

Monitoring GitHub for sensitive data shared publicly

voigt-kampff

Voigt-Kampff — a behavioral safety scoring engine for AI systems. Part of the SAPIEN Framework.

netwatch-scan

NETWATCH is a terminal-based security monitoring tool that gives you continuous, live visibility into every active network connection on your machine, with automatic risk scoring, GeoIP intelligence, VPN status, process path validation, and new-connection alerting.

slack-watchman-eg

Monitoring Slack Enterprise Grid for exposed secrets

stack-overflow-watchman

Detecting exposed secrets in Stack Overflow Enterprise for Teams

trello-watchman

Monitoring your Trello boards for sensitive information