Security Testing Python Packages

sqlmap

Automatic SQL injection and database takeover tool

wallbreaker-hermes

Authorized LLM red-teaming fork with an opt-in native Hermes Agent laboratory.

oss-policy-kit

Policy-as-code starter kit for OSS repository governance and CI/CD hygiene across GitHub, GitLab, Azure, and AWS.

agent-security-harness

AI agent security harness, adversarial testing: 640 executable tests in the v4.26.1 release, across MCP, A2A, x402/L402, decision governance, benchmark integrity, human-in-the-loop, skill supply chain. Four target shapes: a verdict must be able to be wrong AND to be right. OWASP Agentic v1.1 T1-T17, AIUC-1 19/20 (2026-Q1/Q2 set), NIST AI 800-2.

mylonite

Open-source AI-layer security testing — probes your AI agent for weaknesses and writes a validated regression test for each one it finds, gating CI.

botgate

Test what Web Bot Auth signatures actually protect and whether servers enforce the intended policy.

pkcs11-check

See how any PKCS#11 module really behaves. pkcs11-check is a broad, vendor-neutral test client for software tokens, HSMs, smart cards, and cloud KMS. It runs >100k checks - hand-written conformance and security tests plus public crypto vectors (Wycheproof, ACVP, CCTV) - evidence to compare, not a verdict. Covers PKCS#11 v2.40-v3.2 + PQC.

humanbound

Open-source adversarial testing engine, SDK, and CLI for AI agents. Runs locally or against the Humanbound Platform.

hermia

Vendor-agnostic security evals for LLM inference stacks. Detects behavioral divergence across models, backends, and hardware.

rlsautotest

Automatically generates a pgTAP test suite and the seed data that proves your Postgres/Supabase RLS policies actually hold. No manual test-writing. CI gate included.

codeaudit

Codeaudit - Modern Python source code security analyzer based on distrust.

mcp-kitchen-sink

Open-source AI-layer security testing — probes your AI agent for weaknesses and writes a validated regression test for each one it finds, gating CI.

permitprobe

Defensive security CLI for testing API authorization, response-data boundaries, and AI handoff exposure.

network-sandbox-engine

A deterministic network sandbox for testing nftables rules. It uses ephemeral Linux network namespaces (netns) and Scapy to validate firewall logic safely.

frida-server

Zero-config frida-server deployment for Android. Auto-detects device & architecture, version-matches PC's Frida, verifies checksums, and handles root.

habu

Hacking Toolkit

vardrrunner

Local automation runner for the VardrSec toolchain. Claims queued scan jobs, executes them on your own machine, and streams results back — credentials and scan traffic never leave your infrastructure.

overstep

Authorization regression testing for REST APIs and MCP servers in CI/CD. Define access policies as a matrix, generate positive and negative tests, and detect BOLA, BFLA, BOPLA and privilege escalation — with drift baselines, confidence grading and CWE/OWASP-tagged SARIF reports.

agentcrash

Crash-test your AI agent in a synthetic workplace: an open-source agent security test harness with synthetic tools, visual evidence, and regression tests.

llmsectest

Attacks your running LLM app and tells you what got out. The OWASP LLM Top 10 as a pytest plugin, with SARIF for CI.

mcp-stress-test

Stress testing framework for MCP security tools - simulating attacks, temporal degradation, and edge cases

crucible-security

pytest for AI agents - Autonomous red-teaming, behavioral monitoring & security testing for LLM agents

wazuhtestgen

A tool to help detection engineers generate Wazuh rule tests either derived from INI test files from Wazuh repository, Windows Event Log (EVTX) files, or Wazuh rule files. The test format uses Python's unittest. It is designed to accompany wazuh-devenv project.

invaris-agentsec

Adversarial security testing for AI agents — prompt injection, tool misuse, memory poisoning, and MCP scanning, with CI-ready regression testing and reports.