Vulnerability Scanner Python Packages

vulners

Official Python SDK for the Vulners vulnerability-intelligence API — search CVEs, exploits and advisories (CVSS/EPSS/KEV), audit software, Linux/Windows hosts and SBOMs, and stream the whole graph. Typed sync + async clients, 100% v3-compatible, with a built-in MCP server for AI agents.

repo-security-scanner

Pre-clone security scanner for Git repos. Detects crypto miners, backdoors, obfuscation, and vulnerable dependencies before git clone touches your machine. Python CLI with JSON/CSV/SARIF output.

check-opencloud-security

Scanner for OpenCloud Security status

airom

Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.

wordfence

Wordfence malware and vulnerability scanner command line utility.

maunprekshak

The Silent Observer — Fast, local-first security scanner for dependencies (SCA), exposed secrets & git history, SAST, Dockerfiles, and GitHub Actions with multi-provider AI remediation.

medusa-security

AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scanner and native Rust & PHP rules. Also: medusa scan --git to vet any repo, medusa secrets scan for leaked API keys. 40,000+ patterns, zero setup.

valvur

Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command. It finds secrets, vulnerable, hallucinated and malicious dependencies, poisoned agent configuration, and infrastructure and code flaws. An MCP server for Claude Code and Kiro, and a CLI. Your source never leaves your machine.

agent-audit

Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen.

docksec

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

craevidence

CLI for EU Cyber Resilience Act compliance evidence: SBOM validation, vulnerability checks, and signing

pixi-sbom

pixi-sbom is a Pixi extension that generates Software Bills of Materials (SBOMs) from Pixi manifests and lock files, supporting dependency visibility, reproducibility, and supply-chain security workflows.

phantom-agent

Autonomous Offensive Security Intelligence AI-powered multi-agent penetration testing

vdb-mcp

MCP server for VDB — check packages, MCP servers and AI models for CVEs and slopsquatting before your agent installs them

quodeq

AI-powered code quality and security scanner. Open source, MIT, runs locally. <🧭>

mcpwatchman

Independent security and quality audit for Model Context Protocol servers — static analysis, dependency CVE scanning, and evidence-linked scores for every server in the official MCP registry.

trivy-py-ecc

pre-commit hook that mirrors the trivy for usage as pre-commit language

pentool

A modern, console-based web penetration testing toolkit with a TUI. Features an HTTP/HTTPS proxy, active/passive vulnerability scanner, Repeater, Intruder, Spider, and more. Free & open-source.

deluluscan

AI-augmented, evidence-first security auditor for authorized testing — web, API, LLM/AI, container, cloud & source code. Pluggable AI (Claude/OpenAI/DeepSeek/Ollama), agentic exploitation, deep verification, multi-format reports. AGPL-3.0.

ptai

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.

autofte

Local-first crash triage for fuzzing output: stack-hash dedup, binary mitigation analysis, and offline LLM-assisted write-ups. No exploitation, nothing leaves your machine.

mcp-audit-scanner

Security scanner for MCP (Model Context Protocol) server configurations. Detects prompt injection, credential exposure, supply chain risks, and more.

mcp-authscan

Static detector for self-rolled-auth failure classes in MCP servers. Part of VATA — receipts over promises.

spaf

🎯 AI-orchestrated offensive security framework. Automated recon, CVE mapping, exploit POC generation & remediation across a discovery → validation → report pipeline. CLI · API · MCP · dashboard. Powered by Gemini, Claude, Ollama & LM Studio. Authorized testing only.