Network Security Python Packages

scapy

Scapy: the Python-based interactive packet manipulation program & library.

pydivert

A Python binding for WinDivert driver

pypcapkit

Python-based Comprehensive Network Packet Analysis Library

opnsense-mcp-server

A secure MCP server for managing OPNsense firewalls through AI assistants. 62 tools across 10 domains with read-only default, savepoint rollback, and security auditing.

ftagent

Flowtriq DDoS Detection Agent. Real-time traffic monitoring, incident detection, PCAP capture, and auto-mitigation

nfstream

NFStream: a Flexible Network Data Analysis Framework.

tethered

tethered — Runtime network egress control for Python. One function call to restrict which hosts your code can connect to.

cageforge

Rust sandbox for AI agents and untrusted code, inspired by OpenAI Codex. OS-enforced isolation on Linux, Windows, and macOS.

mercury-python

Mercury: network metadata capture and analysis

communityid

A Python implementation of the Community ID flow hashing standard

pan-scm-sdk

Please use the official SDK from Palo Alto instead. Python SDK for Palo Alto Networks Strata Cloud Manager.

firewallfabrik

Modern fwbuilder successor: Qt GUI for managing iptables/nftables policies. Centralized policy DB with reusable objects, scales to hundreds of firewalls, generates deployment-ready shell scripts.

wireshark-mcp

Wireshark-MCP，Give your AI assistant a packet analyzer. Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.

safecadence-netrisk

SafeCadence Network Risk — local-first infrastructure + identity policy platform. 45 adapters (40 infra + 5 identity), 22 controls, 16 multi-vendor translators, capability-based RBAC, AI policy intelligence, attack-path graph, KEV+EPSS-prioritized CVEs, cross-system drift detection. MIT, BYO-AI.

ezmonitormode

Simple yet robust GUI featuring simple ON/Off switch for monitor mode and handy buttons for wireshark, wifite, and kismet

sam-mesh

Agent Mesh

mcp-server-malcolm

Ask an AI agent about your Malcolm network traffic. MCP server for Zeek, Suricata, Arkime and NetBox data, read-only until you opt in to writes.

honeypot-auditor

Does This Look Like An Honeypot? (DTLLAH) Multi-protocol CLI that fingerprints whether a target IP behaves like an honeypot — using Honeyscore, active auth/state probes, and a weighted score.

suricata-check

suricata-check is a command line utility to provide feedback on Suricata rules. The tool can detect various issues including those covering syntax validity, interpretability, rule specificity, rule coverage, and efficiency.

nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

domainclassifier

DomainClassifier is a Python (2/3) library to extract and classify Internet domains/hostnames/IP addresses from raw unstructured text files following their DNS existence, localization or attributes.

anubis-netsec

Subdomain enumeration tool

gyntoolkit

All-in-one Python security toolkit for reconnaissance, network scanning, vulnerability analysis and authorized penetration testing

vamp-forticheck

VampSecure Labs: FortiOS CVE scanner (CVE-2018-13379, CVE-2022-40684, CVE-2023-27997, CVE-2024-21762)