Blueteam Python Packages

theharvester

E-mails, subdomains and names Harvester - OSINT

google-secops-mcp

Google SecOps MCP server

gti-mcp

Google Threat Intelligence MCP server

pyloobins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

defaultcreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

slack-watchman

Slack enumeration and exposed secrets detection tool

secops-soar-mcp

Google SecOps SOAR MCP server

scc-mcp

Security Command Center MCP server

secops-mcp

Google SecOps MCP server (official alias for google-secops-mcp)

vulnparse-pin

A Vulnerability Intelligence and Decision Support Engine — Making Vulnerability Triage Faster and Remediation Decisions Explainable

asp-cli

Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)

ransomwatch

ransomwatch is a Python based tool designed for ransomware threat intelligence and security research.

certpatrol-orchestrator

Process orchestration platform for managing multiple CertPatrol instances with a modern web interface.

gitlab-watchman

Finding exposed secrets and personal data in GitLab

plumhound

Bloodhound Reporting for Blue and Purple Teams

goodhound

Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.

crack-o-matic

Find and notify users in your Active Directory with weak passwords

favicorn-osint

All-sources tool to search websites by favicons

gtfobins-cli

Search for Unix binaries that can be exploited to bypass system security restrictions.

slack-watchman-eg

Monitoring your Slack Enterprise Grid for sensitive information

certpatrol

A fast, lightweight Certificate Transparency (CT) log tailer for your terminal. Filter domains with regex, run locally for privacy, and monitor in real time — no third-party servers, no tracking. A modern, local, privacy-friendly CertStream alternative.

patchrank

Rank Microsoft Patch Tuesday by evidence of real-world exploitation, not vendor severity. Joins MSRC + FIRST.org EPSS + CISA KEV. Zero dependencies.

harvester-windows

E-mails, subdomains and names Harvester - OSINT