Python Security Packages

skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

fastapi-payloadshield

Pluggable FastAPI decorators for encrypting/decrypting request and response payloads

pyobfus

AST-based Python obfuscator with reverse stack-trace mapping — obfuscate before shipping and keep production tracebacks AI-debuggable. MCP + VS Code.

codeaudit

Codeaudit - Modern Python source code security analyzer based on distrust.

ansede-static

Find authorization bugs before attackers do. Free SAST — IDOR detection, 100% CVE recall, 0% false positives. 5 languages. Fully offline.

pyobfus-runtime

AST-based Python obfuscator with reverse stack-trace mapping — obfuscate before shipping and keep production tracebacks AI-debuggable. MCP + VS Code.

pyobfus-mcp

AST-based Python obfuscator with reverse stack-trace mapping — obfuscate before shipping and keep production tracebacks AI-debuggable. MCP + VS Code.

extuno

Assess a Python package for supply-chain risk before pip installs it. Pre-install gate for pip with sandbox-backed verdicts, SARIF output and CI exit codes.

toolboundary

Local runtime security and policy enforcement for AI agents and LLM tool calls, with permissions, guardrails, rate limits, approvals, auditing, and an emergency kill switch.

pydepgate

A zero dependency lightweight static analyzer + CVE scanner designed for adversarial-shape code in python to detect supply chain attacks before they reach your interpreter.

simplesecurity

Combine multiple popular python security tools and generate reports or output into different formats

fileaudit

Simplify building secure Python applications by default. Validate files before you use them.

django-payloadshield

Pluggable Django decorators for encrypting/decrypting request and response payloads

mcp-api-pentest

MCP server for autonomous API logic penetration testing. AI-driven detection of OWASP API Top 10 vulnerabilities (BOLA/IDOR) via multi-session authorization comparison. Supports Bearer, Basic, API Key, Cookie auth. Generates Markdown security audit reports with evidence.

secret-vault

A secret file storage vault in python

guardmarly

Find authorization bugs before attackers do. Free SAST — IDOR detection, 100% CVE recall, 0% false positives. 5 languages. Fully offline.

veripypi

WIP: Verify the package installed from PyPi is the same as the code on Github