Vulnerability Scanner Python Packages

fray

Open-source WAF Security Testing Platform — 7,200+ attack payloads, 98 WAF/CDN fingerprints, AI-powered bypass engine, recon pipeline, beautiful CLI output

wordfence

Wordfence malware and vulnerability scanner command line utility.

industrialxpl-forge

The World's Largest OT/ICS/SCADA Security Assessment Framework. Python-First. 976+ modules, 150+ vendors, 50 protocols, MITRE ATT&CK for ICS 82%, SAST/LLM, 26 ICS malware TTPs.

medusa-security

AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scanner and native Rust & PHP rules. Also: medusa scan --git to vet any repo, medusa secrets scan for leaked API keys. 40,000+ patterns, zero setup.

agent-audit

Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen.

mcp-audit-scanner

Security scanner for MCP (Model Context Protocol) server configurations. Detects prompt injection, credential exposure, supply chain risks, and more.

ansible-security-scanner

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

docksec

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

phantom-agent

Autonomous Offensive Security Intelligence AI-powered multi-agent penetration testing

ptai

Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.

pipeline-check

CI/CD Security Posture Scanner

embedxpl

Embedded Device Security Assessment Framework — 700 modules, 350 CVEs, 55 vendors, APT Group Engine. Covers routers, IP cameras, GPON ONTs, ISP CPEs, IoT/embedded edge.

trivy-py-ecc

pre-commit hook that mirrors the trivy for usage as pre-commit language

agentseal

Security toolkit for AI agents. Scan your machine for dangerous skills and MCP configs, monitor for supply chain attacks, test prompt injection resistance, and audit live MCP servers for tool poisoning.

quodeq

AI-powered code quality and security scanner. Open source, MIT, runs locally. <🧭>

cloud-audit

Fast, opinionated AWS security scanner. Curated checks. Zero noise. Copy-paste fixes.

vulnfeed-mcp

Dependency vulnerability monitoring MCP server — knows your lockfile, prioritizes by EPSS, recommends fix versions.

bawbel-scanner

Open-source CLI scanner for agentic AI components such as skills, MCP servers, system prompts

wpsecscan

Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only.

cve-sentinel

CVE auto-detection and remediation proposal system for Claude Code

brasscoders

The bug scanner for AI coders. Local-first, deterministic CLI that catches the bugs your AI coding assistant misses. 12 scanners in one tool. Apache 2.0.

ragsec

Static security scanner for RAG pipelines. Detects injection, secret logging, auth gaps, SSRF, and more in Python codebases.

keyleak-detector

Runtime leak detector for modern web apps — finds exposed API keys, validates BaaS misconfigurations (Supabase/Firebase RLS), and catches secrets in JS bundles. Chrome extension + CLI.

reconninja

38-phase automated reconnaissance framework for security researchers