Cybersecurity Python Packages

pycti

Open Cyber Threat Intelligence Platform

mitreattack-python

A python module for working with ATT&CK

shuffle-sdk

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

navi-sanitize

Deterministic input sanitization for untrusted text — invisible characters, homoglyphs, and encoding tricks, handled before your code sees them. Zero dependencies, no ML. Python 3.12+.

sherlock-project

Hunt down social media accounts by username across social networks

maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

filegrail

Trace file provenance, metadata, telemetry, investigative pivots and relationships across files, browser history, OS traces and archives. Local, read-only, no network requests.

mockssh

Mock an SSH server and define all commands it supports (Python, Twisted)

bee-sdk

Open community repository for Bee by Heossi — public code, developer tooling, documentation, examples, and community-facing components for building with and contributing to Bee.

user-scanner

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.

vulncheck-sdk

A generated Python SDK from VulnCheck's OpenAPI specification

karton-core

Distributed malware processing framework based on Python, Redis and S3.

immunity-agent

Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

nfstream

NFStream: a Flexible Network Data Analysis Framework.

chepy

Chepy is a python lib/cli equivalent of the awesome CyberChef tool.

prismor

Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)

secator

secator - the pentester's swiss knife

stix-shifter

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-utils

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

openosint

AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.

sunglasses

Open source input firewall for AI agents, beta. A local scanner checks text, code, PDFs, images, QR codes, audio and video with 1,569 patterns across 117 categories and reports findings and incomplete scans. A Claude Code hook blocks secret material in tool calls and the paths and hosts your policy lists before tools run.

decepticon

Autonomous Hacking Agent for Red Team

csle-collector

A research platform to develop automated security policies using quantitative methods, e.g., optimal control, computational game theory, reinforcement learning, optimization, evolutionary methods, and causal inference.