Security Scanner Python Packages

bandit

Bandit is a tool designed to find common security issues in Python code.

pysentry-rs

🐍 Scan your Python dependencies for known security vulnerabilities with Rust-powered scanner

compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

ostorlab

OXO is a security scanning orchestrator for the modern age.

mcpsafetywarden

MCP servers expose tools with no information about what they actually do at runtime. mcpsafetywarden sits between your agent and any MCP server, profiling tool behavior, blocking destructive calls, and running active security audits before you trust them in a workflow.

agent-bom

AI supply-chain & cloud security scanner and self-hosted control plane — agents, MCP, packages, cloud estate, non-human identities, and LLM cost. SBOM/SARIF, graph attack-paths, runtime enforcement, and compliance evidence.

sunglasses

Sunglasses for AI agents. Protection layer + neighborhood watch.

kcwarden

Automatically audit your Keycloak configuration for security issues

ansible-security-scanner

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

dfx-agentguard

Autonomous security scanner for AI agents - detects prompt injection, tool abuse, data exfiltration, and all 10 OWASP ASI Top 10 vulnerabilities. MCP server mode included.

pythx

A Python library for the MythX smart contract security analysis platform

pipeline-check

CI/CD Security Posture Scanner

aina-scan

Enterprise SAST — Python/Java/C/C++/TypeScript/C#/Go/Rust — tree-sitter AST, 7-language support, interprocedural taint (3-hop BFS), AINA L3 causal chains, i18n (en/ko), 6-report output

sentineldeck

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, and certificate-transparency checks.

ansede-static

Offline SAST that detects IDOR, missing authentication, and ownership bypass. OWASP recall 62%, CVE recall 96.3% across 5 languages. Beats Semgrep OSS on recall.

tartufo

Searches through git repositories for high entropy strings and secrets, digging deep into commit history

gixy-next

Gixy-Next: NGINX Configuration Security Scanner & Performance Checker

apisec-ai-surface

Find and govern AI attack surfaces in application code at PR time. Free, OSS, runs offline.

agent-audit-kit

Static scanner for MCP-connected AI agent pipelines — 225 rules across 11 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.

agent-discover-scanner

The industry-standard Agentic Identity & Inventory Scanner. Automatically inventory autonomous agents (LangChain, AutoGen, CrewAI, PydanticAI) using static analysis, network heuristics, and eBPF. Foundational tool for AIBOM compliance and AgentOps governance.

cloud-audit

Fast, opinionated AWS security scanner. Curated checks. Zero noise. Copy-paste fixes.

redteam-mcp

Active red-teaming for MCP servers. Source analysis + live exploitation + auto-fix. Claude Code plugin.

armorer-guard

Fast local Rust scanner for AI-agent prompt injection, credential leaks, exfiltration, and risky tool calls

intentprobe

Activation-probe security scanner for AI agent tooling. Reads a model's internal activations to detect poisoned MCP servers, skills, and packages before install.