Security Scanner Python Packages

bandit

Bandit is a tool designed to find common security issues in Python code.

hol-guard

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

plugin-scanner

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

pysentry-rs

🐍 Scan your Python dependencies for known security vulnerabilities with Rust-powered scanner

kingfisher-bin

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

repo-security-scanner

Pre-clone security scanner for Git repos. Detects crypto miners, backdoors, obfuscation, and vulnerable dependencies before git clone touches your machine. Python CLI with JSON/CSV/SARIF output.

ostorlab

OXO is a security scanning orchestrator for the modern age.

agent-audit-kit

Static scanner for MCP-connected AI agent pipelines. 388 rules across 14 categories, 14 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.

redact-secret

Detect and redact secrets before they reach logs, storage, or LLM context. Deterministic Rust core for JavaScript, Python, Rust, and WebAssembly.

check-opencloud-security

Scanner for OpenCloud Security status

skilltotal

Claude Code plugin that scans a package before the agent runs npx, npm install, pip install, uvx or claude mcp add. Malicious indicators block the install. High-risk packages need your approval. The scan runs on your machine and never executes the code or calls an LLM. Every finding cites a file and line. Also a CLI, GitHub Action and MCP server.

agent-bom

Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.

compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

kcwarden

Automatically audit your Keycloak configuration for security issues

sunglasses

Open source input firewall for AI agents, beta. A local scanner checks text, code, PDFs, images, QR codes, audio and video with 1,569 patterns across 117 categories and reports findings and incomplete scans. A Claude Code hook blocks secret material in tool calls and the paths and hosts your policy lists before tools run.

tartufo

Searches through git repositories for high entropy strings and secrets, digging deep into commit history

mcpsafetywarden

MCP servers expose tools with no information about what they actually do at runtime. mcpsafetywarden sits between your agent and any MCP server, profiling tool behavior, blocking destructive calls, and running active security audits before you trust them in a workflow.

zenzic

Deterministic Document Integrity Engine for Markdown/MDX graphs.

valvur

Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command. It finds secrets, vulnerable, hallucinated and malicious dependencies, poisoned agent configuration, and infrastructure and code flaws. An MCP server for Claude Code and Kiro, and a CLI. Your source never leaves your machine.

plexavo

AWS Cloud Security Posture & Misconfiguration Assessment Engine

pythx

A Python library for the MythX smart contract security analysis platform

kingfisher-secret-scanner

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

cloudg

Map, graph and audit AWS, Azure and GCP from one CLI. Builds a topology graph, runs Prowler/Checkov/Trivy, tags findings against 28 compliance frameworks, and exports HTML reports, RDF ontologies, RAG chunks and Terraform recreation files.

safeai-static-analyzer

Static analysis and attack-surface scanner for AI agents — SAST for prompts, tools, MCP servers, and agent workflows. Detects capabilities, prompt risks, tool permissions, and governance gaps before deployment.