Dast Python Packages

argus-security

Argus brings “a hundred eyes” to your project, combining leading open source security tools into a scalable, automated, continuous security pipeline.

deluluscan

AI-augmented, evidence-first security auditor for authorized testing — web, API, LLM/AI, container, cloud & source code. Pluggable AI (Claude/OpenAI/DeepSeek/Ollama), agentic exploitation, deep verification, multi-format reports. AGPL-3.0.

argus-panoptes

AI-powered security audit tool — point it at a repo, it reads the code, spins up the app, and actually attacks it. Static scan + live exploit swarm + LLM-explained fixes.

webvigil

🔎 In-band web application vulnerability scanner for developers: a reusable engine, a CLI, and an optional dashboard. Passive and production-safe by default; opt-in Active Mode for XSS, SQLi, SSRF, RCE, XXE, upload and more — every finding confirmed against a baseline.

ruoyi-scan

RuoYi (若依) dedicated vulnerability scanner: plugin architecture, three-state verdict, WAF bypass, exploit chains, AI POC generation, nuclei compatible. 若依专项漏洞扫描器

sloptic

Web app slop checker

vamp-graphql-audit

GraphQL DAST auditor — introspection, BOLA/IDOR, alias rate-limit bypass, deep nesting DoS, injection (SQLi/SSTI/XSS), subscription security

vamp-oauth-audit

OAuth 2.0 and OIDC security flow auditor — PKCE, state, implicit flow, open redirect, token analysis.

overstep

Authorization regression testing for REST APIs and MCP servers in CI/CD. Define access policies as a matrix, generate positive and negative tests, and detect BOLA, BFLA, BOPLA and privilege escalation — with drift baselines, confidence grading and CWE/OWASP-tagged SARIF reports.

yubel

Cloud-native, multi-target DAST orchestrator — one config runs ZAP, Nuclei, Nikto, testssl.sh, dalfox, schemathesis, kube-hunter and more against web, APIs, cloud, containers and Kubernetes. Cross-engine correlation, attack-chain synthesis, deterministic evidence trail and air-gapped mode.

gateshield

Policy-driven security orchestration for hardened CI/CD pipelines

reasonhound

AI-assisted security scanner that reasons like a senior researcher: it reads your web/API code, forms and tests vulnerability hypotheses, and writes a Markdown report. Bring your own model (Claude/OpenAI/Gemini/Ollama). Cross-platform, terminal-only, no deploy.

surface-audit

Deterministic security smoke tests for preview, staging, and pre-deploy web URLs.

mcpsnare

Active security scanner that pentests MCP (Model Context Protocol) servers. Triggers and out-of-band-confirms real vulns (RCE, SSRF, path traversal, auth bypass) with graded confidence. Like Burp's Active Scan, but the target is an MCP server. stdio + HTTP.

ai-protect

AI-application security assurance pipeline: tier-aware SAST · DAST · AI red-team scanning with a findings dashboard, CVE intel feeds & auto-remediation. For AppSec & platform teams shipping LLM apps and agents — pip install ai-protect

autosecscan

LLM-assisted security scanner: network + code, AI triage, continuous pen-testing (free & OSS)

gloomproxy-sdk

Browse a target normally and watch the attack surface graph build itselfc — all correlated in real time. Then hit it with distributed scanner plugins, replay and fuzz interesting requests, and manage auth across the whole engagement from a single UI.

zyron-agentshield

Professional DAST & Pentest Framework by Zyron Security — AI-powered, active fuzzing, IDOR detection, pipeline breaker