Security Testing Python Packages

sqlmap

Automatic SQL injection and database takeover tool

oss-policy-kit

Policy-as-code starter kit for OSS repository governance and CI/CD hygiene across GitHub, Azure, and AWS.

crucible-security

pytest for AI agents - Autonomous red-teaming, behavioral monitoring & security testing for LLM agents

humanbound

Open-source AI agent red-team engine, SDK, and CLI. Run offline or against the Humanbound Platform.

agent-security-harness

470 security tests for AI agent systems — MCP, A2A, x402/L402, decision governance, benchmark integrity, skill supply chain. AIUC-1 pre-cert, NIST AI 800-2 aligned, CVE-2026-25253 reproduction. v4.4.2

rlsautotest

RLS Policy autotester

codeaudit

Codeaudit - Modern Python source code security analyzer based on distrust.

pkcs11-check

See how any PKCS#11 module really behaves. pkcs11-check is a broad, vendor-neutral test client for software tokens, HSMs, smart cards, and cloud KMS. It runs >100k checks - hand-written conformance and security tests plus public crypto vectors (Wycheproof, ACVP, CCTV) - evidence to compare, not a verdict. Covers PKCS#11 v2.40-v3.2 + PQC.

humanbound-cli

Open-source AI agent red-team engine, SDK, and CLI. Run offline or against the Humanbound Platform.

habu

Hacking Toolkit

forcefield

ForceField Python SDK -- AI security in 3 lines of code. Prompt injection detection, PII redaction, security evals, tool governance. GitHub Action, pre-commit hook, Homebrew, VS Code extension.

guardrailprobe

Stop testing your model. Test your guardrail layer. guardrailprobe fires 78 OWASP LLM Top 10 attack probes across 11 backends — Lakera, NeMo, Presidio, Azure Content Safety, Bedrock Guardrails, LLM Guard, and five more — and outputs signed PDF and JSON comparison reports.

firewallxpl

Perimeter security exploitation framework — 164 modules covering FW, NGFW, UTM, WAF, VPN, NAC, LB, and OT/ICS firewalls (Fortinet, Cisco, Palo Alto, F5, Citrix, Check Point, SonicWall, Ivanti, Siemens, Moxa, +13 vendors). GPU-accelerated, ML-driven, async concurrency, Rich TUI.

discoursemap

DiscourseMap is a comprehensive security testing framework for Discourse forum platforms. Written for security professionals and forum administrators.

numasec

The AI Agent for Cyber Security.

hermia

Vendor-agnostic security evals for LLM inference stacks. Detects behavioral divergence across models, backends, and hardware.

llama-index-forcefield

LlamaIndex integration for ForceField AI security -- scan prompts and moderate outputs in your LlamaIndex pipeline.

serpant

World Serpant Search is a command-line tool for vulnerability detection. It allows you to scan directories for various types of vulnerabilities, including XSS vulnerabilities, authentication bypass vulnerabilities, and package vulnerabilities using the National Vulnerability Database (NVD).

langchain-forcefield

LangChain integration for ForceField AI security -- scan prompts and moderate outputs in your LangChain pipeline.

mcp-stress-test

Red team toolkit for stress-testing MCP security scanners — find detection gaps before attackers do

chimera-api

Flask demo API application for resilience testing

owasp-agent-security-regression-harness

Executable security regression testing for agentic applications and MCP-integrated systems.

keelson-ai

Living Red Team for AI agents

searchpass

Tinyscript tool for searching for default passwords on various open source databases based on pybots