Devsecops Python Packages

safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.

crowdstrike-falconpy

The CrowdStrike Falcon SDK for Python

xonsh

🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.

pygitguardian

Python API client library for the GitGuardian API

ggshield

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

hol-guard

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

plugin-scanner

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

lib4sbom

Library to ingest and generate SBOMs

njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

kingfisher-bin

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

trufflehog

Find, verify, and analyze leaked credentials

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

lib4vex

Library to ingest and generate VEX documents

csaf-tool

CSAF generator and validator

repo-security-scanner

Pre-clone security scanner for Git repos. Detects crypto miners, backdoors, obfuscation, and vulnerable dependencies before git clone touches your machine. Python CLI with JSON/CSV/SARIF output.

cve-bin-tool

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

owasp-depscan

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

mockssh

Mock an SSH server and define all commands it supports (Python, Twisted)

devsecops-engine-tools

Toolchain for the evaluation of different devsecops practices

mcpgawk

One gateway in front of every MCP server your agents can reach. A server that changes after you approved it is caught, the call is blocked before it runs, and nothing leaves your machine.

dsoxlab

Turn declarative exercises into reproducible, runnable and verifiable lab environments

skilltotal

Claude Code plugin that scans a package before the agent runs npx, npm install, pip install, uvx or claude mcp add. Malicious indicators block the install. High-risk packages need your approval. The scan runs on your machine and never executes the code or calls an LLM. Every finding cites a file and line. Also a CLI, GitHub Action and MCP server.