skyvanguard/awesome-ai-pentesting

A curated list of AI-powered pentesting tools, frameworks, MCP servers, and resources for autonomous cybersecurity operations

Python

48 commits

updated Oct 9, 2026

www.skyvanguard.com.py

See the code

README

Awesome AI Pentesting

A curated list of AI-powered tools, frameworks, and resources for penetration testing, bug bounty hunting, red teaming, and cybersecurity operations.

The intersection of Artificial Intelligence and offensive/defensive security is evolving rapidly. This list tracks the most impactful open-source projects that leverage LLMs, machine learning, and autonomous agents for cybersecurity.

Maintained by SkyVanguard — Autonomous AI cybersecurity. Curated by @skyvanguard, TryHackMe Top 1% Global.

📚 Free, hands-on courses on AI pentesting, cybersecurity, AI and vibe coding — in English & Spanish → skyvanguard.com.py/courses

Stars updated: October 2026

Autonomous AI Pentesting Agents
MCP Servers for Security
Bug Bounty & Recon AI
CTF Solvers & Challenge Tools
Vulnerability Analysis & Scanning
Red Team & Offensive AI
Blue Team & Defensive AI
AI Security (Securing AI Systems)
Fuzzing with AI/ML
Pentest Report Generation
OSINT with AI
Research Papers & Resources
Unmaintained
Contributing

Autonomous AI Pentesting Agents

Fully autonomous agents that perform end-to-end penetration testing tasks with minimal human intervention.

Tool	Description	AI Tool
Strix	Open-source AI hackers that run code dynamically, find vulnerabilities, and validate them through actual proof-of-concepts.	Claude API
Shannon	Fully autonomous AI hacker using Claude Agent SDK. 96.15% success rate on XBOW Benchmark. Finds and exploits real vulnerabilities in web apps.	Claude API (Agent SDK)
PentAGI	Fully autonomous AI agents system. Docker sandboxed, 20+ built-in tools (nmap, metasploit, sqlmap), Neo4j knowledge graph.	Multi-LLM (OpenAI, Claude, DeepSeek)
PentestGPT	Automated penetration testing agentic framework powered by LLMs. Published at USENIX Security 2024.	OpenAI API (GPT-4)
CyberStrikeAI	AI-native security platform in Go combining Eino-powered agents, MCP-native tools, RAG knowledge, and human oversight in one auditable workspace.	Multi-LLM (OpenAI-compatible: OpenAI, DeepSeek, Qwen)
Decepticon	Autonomous hacking agent for red teaming. Modular multi-agent architecture built on LangGraph with MCP tool integration.	Multi-LLM (via LiteLLM)
Cairn	General-purpose state-space search engine validated on autonomous penetration testing: given an origin and a goal, it searches for the attack path.	Claude Code, Codex (worker backends)
PentestAgent	AI agent framework for black-box security testing with prebuilt attack playbooks for bug bounty, red-team, and pentest.	OpenAI API (GPT-4)
CyberStrike	Terminal-based offensive security harness with 13+ specialized agents, 7,600+ security skills, and 120+ OWASP test cases.	Multi-LLM (Claude, OpenAI, Gemini, Ollama, Bedrock)
RedAmon	Self-hosted framework that maps the attack surface into a graph, exploits it from a Kali sandbox behind human approval gates, and opens pull requests that fix what it finds.	Multi-LLM (OpenAI, Anthropic, Bedrock, OpenRouter, Ollama)
Pentest-Swarm-AI	Autonomous pentesting with a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning. Bug bounty, monitoring, and CTF modes.	Claude API
Pentest-AI	AI pentester usable via MCP, CLI, or CI that re-runs each exploit with machine oracles before marking a finding as verified.	Claude Code, Codex, Ollama/local models
Pentest Copilot	AI-powered browser-based ethical hacking assistant with agentic architecture that runs commands in the pentest environment.	OpenAI API
NeuroSploit	AI-powered pentest framework with 100 vulnerability types, isolated Kali containers, 9 specialized agent personas.	Multi-LLM (OpenAI, Claude, Ollama/local)
LuaN1aoAgent	Cognitive-driven autonomous AI hacker using dual-graph reasoning (causal and attack graphs) for plan-execute-reflect penetration testing.	Multi-LLM (OpenAI, DeepSeek, Claude)
hackingBuddyGPT	Academic framework for building LLM-driven ethical hacking agents in ~50 lines of code. Research platform with reproducible privilege-escalation benchmarks.	OpenAI API (GPT-4)
Xalgorix	Self-hosted autonomous pentesting agents for real-time recon, vulnerability detection, and exploit-verified findings with a local web dashboard.	Multi-LLM (OpenAI, Anthropic, DeepSeek, Gemini, Ollama, LiteLLM)
Nebula	AI-powered pentesting assistant for automating recon, note-taking, and vulnerability analysis with human decision checkpoints.	OpenAI API (GPT-4)
Darkmoon	Open source autonomous AI penetration testing platform that orchestrates 80+ offensive tools through Markdown playbooks and MCP controlled execution, covering web, cloud, Active Directory, Kubernetes and API with an evidence trail per finding.	Multi-LLM (OpenAI, Anthropic, Ollama/local)
Cybermes	Offensive security and bug bounty agent framework with 200+ playbooks, a native Go MCP server, and a standalone CLI driven by Hermes Agent.	Hermes Agent, MCP clients (Claude, Gemini)
PentestCode	Multi-agent terminal pentesting agent that runs tools, keeps persistent engagement state, and chains attacks toward a stated goal.	Multi-LLM (20+ providers incl. Claude, OpenAI, Ollama)
numasec	Terminal AI security agent that drives your local tools with runbooks, keeps operation context, and tracks findings, evidence, and reports.	Multi-LLM (OpenAI, Anthropic, Google, OpenRouter, Ollama)
ARTEMIS	ARTEMIS is an autonomous agent created by the Stanford Trinity project to automate vulnerability discovery.	OpenAI API (GPT-4)
AIDA	AI-Driven Security Assessment that connects AI to 400+ pentesting tools via MCP (Exegol container), enabling natural language-driven security workflows.	Multi-LLM (OpenAI, Claude, Ollama via MCP)
Zen-AI-Pentest	Autonomous multi-agent pentest framework integrating 72+ security tools with a React dashboard, REST API, and CLI.	Multi-LLM (DeepSeek, GPT-4o, Claude, Llama)
BugTraceAI	Open-source multi-agent platform for authorized web application security testing with validation, evidence capture, and reporting.	Multi-LLM
cyber-harness	Single-binary agent runtime for pentest, red team, and bug bounty that bundles scanners, proxy routing, skills, and a source-code audit distribution.	Multi-LLM (OpenAI/Anthropic-compatible, DeepSeek)

MCP Servers for Security

Model Context Protocol servers that bridge AI assistants with cybersecurity tools.

Tool	Description	Stars
REA	Local CLI and MCP tools for agent-assisted reverse engineering of native binaries, JavaScript/Electron apps, and .NET assemblies, with evidence provenance; native deep analysis uses separately installed Hopper, Ghidra, or IDA.
IDA Pro MCP	AI-powered reverse engineering assistant that bridges IDA Pro with LLMs through MCP.
HexStrike AI	Advanced MCP server with 150+ cybersecurity tools. Lets AI agents autonomously run pentesting, vuln discovery, and bug bounty tools.
Ghidra MCP	Ghidra MCP server with 200+ tools for AI-assisted reverse engineering, available as GUI plugin or headless server.
Burp Suite MCP Server	Official PortSwigger extension that integrates Burp Suite with AI clients through MCP.
MCP Scanner	Cisco AI Defense scanner that inspects MCP servers for threats and security findings.
mcp-security-hub	36 MCP servers with 175+ tools: Nmap, Ghidra, Nuclei, SQLMap, Hashcat. Recon, web sec, binary analysis, blockchain, AD.
JADX MCP Server	MCP server for the JADX-AI plugin enabling LLM-assisted Android APK reverse engineering.
awesome-mcp-security	Curated collection of MCP security resources: tools, papers, videos, articles, and vulnerability information.
Google Security MCP	MCP servers that give AI clients access to Google Security Operations (Chronicle), Threat Intelligence, and other Google security products.
pentestMCP	AI-powered penetration testing via MCP. 20+ security assessment tools (Nmap, Nuclei, ZAP, SQLMap) through MCP protocol.
awesome-cyber-security-mcp	Curated list of MCP servers focused on cybersecurity operations.
mcp-server-security-standard	Open, testable security control standard (MSSS) for certifying MCP servers with levels and evidence requirements.
Bolt	Docker-based MCP server exposing 100+ Kali Linux security tools as plugins. Successor of mcp-for-security.
mcp-vanguard	Security pentesting MCP Server with 22 tools. Windows/WSL bridge for Kali tools integration with Claude.
DomScan	Hosted domain intelligence MCP for DNS, WHOIS/RDAP, TLS, subdomains, reputation, email security, and typosquatting.

Bug Bounty & Recon AI

AI-enhanced tools for reconnaissance and bug bounty automation.

Tool	Description	Stars
Nuclei	Fast vulnerability scanner with YAML-based DSL. AI-powered template generation via `-ai` flag. 10k+ community templates.
Sn1per	Attack surface management platform combining automated scanning with intelligent analysis.
awesome-bugbounty-tools	Curated list of bug bounty tools including AI-enhanced scanners and recon automation frameworks.
Agentic Bug Hunter	AI bug bounty toolkit that runs recon, finding, validation, and reporting from a CLI or inside Claude Code, with free or subscription AI providers.
Claude-BugHunter	Claude Code skill bundle for bug hunting and external red teaming: 80+ skills, 15 slash commands, and 681 disclosed-report patterns.
Mantis	Security framework automating discovery, reconnaissance, and vulnerability scanning. Chains multiple tools from domain input.
HackBot	AI-powered cybersecurity chatbot using LLaMA for code analysis, scan analysis, and cybersecurity Q&A.
Julius	Praetorian's LLM service fingerprinting tool that identifies Ollama, vLLM, LiteLLM, and 60+ AI servers on network endpoints.

CTF Solvers & Challenge Tools

AI tools for solving Capture The Flag competitions and security challenges.

Tool	Description	Stars
Project Muteki	Multi-agent CTF-solving swarm where a coordinator schedules several CLI agent engines toward a single goal.
BoxPwnr	Framework for benchmarking LLMs and agentic strategies on HackTheBox, PortSwigger, picoCTF, TryHackMe, and other CTF platforms.
EnIGMA	Enhanced Interactive Generative Model Agent. State-of-the-art on NYU CTF and CyBench. 3x more challenges than prior agents. (ICML 2025)	Paper
CTFAgent	LLM-powered CTF solver with plan-and-execute paradigm. Outperforms 88% of human CTF participants.	Paper
CSAW LLM CTF Attack Competition	CSAW competition using generative autonomous AI to solve CTF challenges. Major academic AI security benchmark.	Competition
Cybench	Framework for evaluating LLM agents on 40 professional-level CTF tasks from 4 competitions.
ChatGPT on CTF	Research testing whether AI-LLMs can solve CTF challenges by running commands in test environments.

Vulnerability Analysis & Scanning

AI-powered vulnerability discovery and code analysis tools.

Tool	Description	Stars
SkillSpector	NVIDIA's security scanner for AI agent skills. Detects vulnerabilities, malicious patterns, and prompt injection before a skill is installed.
Semgrep	Lightweight static analysis for finding bugs and enforcing code standards with AI pattern matching.
Codex Security	OpenAI's CLI and TypeScript SDK for defining security policy and finding, validating, and fixing vulnerabilities in code.
Garak	NVIDIA's LLM vulnerability scanner. Probes for hallucination, data leakage, prompt injection, toxicity, and jailbreaks.
agent-scan	Snyk's security scanner for AI agents, MCP servers and agent skills. Detects prompt injections and tool poisoning.
open-kritt	Self-hosted platform that orchestrates AI agents to find, de-duplicate, rank, and validate vulnerabilities in code.
Agentic Security	LLM vulnerability scanner / AI red teaming kit. Protects AI systems from jailbreaks, fuzzing, and multimodal attacks.
AutoCVE	Agent-driven CVE discovery pipeline that selects projects, audits source code, verifies vulnerabilities, and writes reports.
LLM SAST Skills	Agent skills that turn Claude Code, Codex, and other coding assistants into a SAST scanner for web and mobile codebases.
AgentShield	Security auditor for AI agent configurations: hardcoded secrets, permission misconfigs, hook injection, and MCP server risks.
Agentic Radar	Security scanner for agentic systems. Workflow visualization, tool identification, MCP server detection, vulnerability mapping.
MEDUSA	AI-first security scanner with 40,000+ detection patterns for AI/ML apps, agents, and LLM integrations.
ModelScan	Scans ML models for unsafe code. Supports H5, Pickle, SavedModel, and more formats.
DockSec	OWASP AI-powered Docker security scanner that explains vulnerabilities in plain English.
agentgg	Agentic white-box SAST scanner whose agents follow imports and call graphs to confirm findings before reporting. CI ready.
OpenHack	Agentic security scanner and verifier for codebases that exclusively uses open-source models.
NVIDIA Vulnerability Analysis	NVIDIA blueprint for identifying and mitigating container security vulnerabilities with generative AI.
rust-in-peace	Agent-assisted vulnerability discovery for Rust with adversarial triage, dynamic verification, and an experimental Android APK analysis profile.

Red Team & Offensive AI

Offensive AI tools, adversarial ML, and AI red teaming frameworks.

Tool	Description	Stars
Promptfoo	LLM red teaming, pentesting, and vuln scanning with 100+ attack types. Tests complete AI systems including RAG and agents.
Social-Engineer-Toolkit	Open-source penetration testing framework designed for social engineering.
Caldera	Automated adversary emulation platform with AI-driven attack planning. Originally by MITRE, now an Apache project.
Adversarial Robustness Toolbox	IBM's Python library for ML Security: evasion, poisoning, extraction, inference attacks and defenses.
PyRIT	Microsoft's Python Risk Identification Tool for red teaming generative AI systems.
DeepTeam	Framework for red teaming LLMs. 10+ adversarial attacks, supports OWASP Top 10 for LLMs and NIST AI RMF.
pentest-ai-agents	50 Claude Code subagents for authorized penetration testing and offensive security research.
offensive-ai-compilation	Curated list of Offensive AI resources: tools, techniques, research papers, and attack methodologies.
Anamorpher	Trail of Bits tool for crafting image-scaling attacks that deliver multimodal prompt injection.
EasyJailbreak	Python framework to generate adversarial jailbreak prompts against LLMs.
OPFOR	Adversary emulation for AI agents and MCP servers, usable from the CLI, the IDE, or a browser extension.
AgentHound	Offensive framework for agentic infrastructure: recon, credential looting, model exfiltration, and poisoning across MCP, A2A, gateways, and vector stores.
Augustus	Praetorian's Go-based LLM vulnerability scanner with 210+ adversarial attacks: prompt injection, jailbreaks, encoding exploits, and data extraction.
Spikee	Reversec's modular kit for testing LLMs, guardrails, and applications against prompt injection and jailbreaks.

Blue Team & Defensive AI

AI tools for defense, detection, and incident response.

Tool	Description	Stars
Wazuh	Open-source security monitoring with AI-enhanced threat detection, SIEM, and XDR.
Sigma	Generic signature format for SIEM systems with AI-powered rule creation.
Falco	Cloud Native Runtime Security by CNCF. Detects threats across containers, hosts, K8s, and cloud.
Guardrails AI	Adding guardrails to LLMs. Input/output validation, content moderation, and PII detection.
NeMo Guardrails	NVIDIA's toolkit for programmable guardrails on LLM systems. Content moderation, jailbreak detection.
Redcells	Automated adversarial testing platform for LLMs you own or control. Runs structured red-team jobs (prompt injection, jailbreak, data leakage, etc.) with iterative attack→refine layers and per-layer judge scoring via web dashboard or API.	Repo
Shuffle	Open-source SOAR platform for security automation and orchestration.
AiSOC	Self-hostable AI Security Operations Center with alert fusion, LLM-agent triage, and MITRE ATT&CK investigation.
Beelzebub	Deception framework for realistic decoys, with LLM-powered responses that sustain attacker interaction.
GhostWriter	Report management platform for red/blue team operations with AI-assisted analysis.
AttackGen	Incident response testing tool that uses LLMs with MITRE ATT&CK and ATLAS to generate tailored attack scenarios.
STRIDE GPT	AI-powered threat modeling tool that generates STRIDE threat models and attack trees for an application.
numbat	Perplexity's endpoint visibility into AI agent activity, with local detection, optional pre-action blocking, and forensic reconstruction.
Agent Threat Rules	Open, executable detection rule format for AI agent threats, like Sigma for agents.

AI Security (Securing AI Systems)

Tools for defending AI/LLM systems against prompt injection, jailbreaks, and emerging threats.

Tool	Description	Stars
AI-Infra-Guard	Tencent's full-stack AI red teaming platform that scans agents, skills, MCP servers, and AI infrastructure.
Superagent	SDK for AI agent safety: blocks prompt injection, redacts PII and secrets, and runs red team scenarios against agents.
PurpleLlama	Meta's tools to assess and improve LLM security: CyberSecEval benchmarks, Llama Guard, Prompt Guard, and Code Shield.
nono	Zero-setup sandbox that isolates AI coding agents (Claude Code, Codex, and more) with fine-grained, policy-controlled permissions.
ADR	Uber's Agentic AI Detection and Response system for securing employee-facing agents like Cursor, Claude Code, and Codex. MLSys 2026.
Pipelock	AI agent firewall that inspects HTTP, WebSocket, MCP, and A2A traffic for secret exfiltration and prompt injection.
API Relay Audit	Local CLI auditing third-party AI relays and LLM proxies for prompt-injection signals, package-command text changes, error-response leakage, and Anthropic SSE anomalies, with Markdown reports.
Arcanum PI Taxonomy	Interactive classification of prompt injection and LLM attacks for pentesters moving into AI red teaming.
ZeroLeaks	CLI that red-teams LLM system prompts and agent instructions for prompt injection and extraction.
Open-Prompt-Injection	Toolkit and benchmark for implementing and evaluating prompt injection attacks and defenses.
mcp-context-protector	Trail of Bits security wrapper for untrusted MCP servers: config pinning, line-jumping and tool-poisoning protection.
Awesome-LLMSecOps	LLM Security Operations in one repo. Curated links covering the full LLMSecOps lifecycle.
parry-guard	Prompt injection scanner for AI coding tools (Claude Code, Codex). Runs DeBERTa/Llama transformers locally in Rust via Candle or ONNX.

Fuzzing with AI/ML

Machine learning-guided fuzzing and automated test generation tools.

Tool	Description	Stars
AFL++	Superior fork of AFL with ML-guided mutation strategies. Industry standard for fuzzing.
Buttercup	Trail of Bits' Cyber Reasoning System for DARPA AIxCC. Finds vulnerabilities with fuzzing and patches them with LLMs.
FuzzyAI	CyberArk's automated LLM fuzzing tool for finding jailbreaks and security vulnerabilities in LLM APIs.
OSS-Fuzz-Gen	Google's LLM-powered fuzzing via OSS-Fuzz. Generates fuzz targets for C/C++. 29% max line coverage increase.
EvoMaster	First open-source AI-driven tool for system-level test generation. Evolutionary algorithms for REST, GraphQL, RPC.
Atlantis	Team Atlanta's Cyber Reasoning System from the DARPA AIxCC Final Competition for automated vulnerability discovery.
OSS-CRS	OpenSSF framework for building and running LLM-based autonomous bug-finding and bug-fixing systems.

Pentest Report Generation

AI tools for automated penetration testing report creation.

Tool	Description	Stars
PwnDoc	Pentest report generator for findings and customizable Docx reports with templates.
SysReptor	Customizable pentest reporting platform with AI-assisted writing and finding descriptions.
APTRS	Automated Pentest Reporting System. Python/Django-based. PDF/Excel generation, project tracking.
Faction	Pen test report generation and assessment collaboration platform.

OSINT with AI

AI-powered Open Source Intelligence tools.

Tool	Description	Stars
Sherlock	Hunt down social media accounts by username across 400+ social networks.
GHunt	Offensive Google framework for OSINT.
theHarvester	E-mails, subdomains and names harvester for OSINT.
Recon-ng	Full-featured web reconnaissance framework with modular design.
OpenOSINT	AI-powered OSINT agent with 20 tools, usable as an interactive REPL, MCP server, CLI, or web interface.
Taranis AI	Advanced OSINT tool using NLP-powered news collection and AI for situational analysis.
OSINTGPT	OSINT analysis tool leveraging GPT embeddings and vector search for document similarity.

Research Papers & Resources

Papers

PentestGPT: An LLM-empowered Automatic Penetration Testing Tool — USENIX Security 2024
LLM Agents can Autonomously Hack Websites — GPT-4 hacks 73% of test websites
Getting pwn'd by AI: Penetration Testing with LLMs — Systematic study
AutoAttacker: LLM Guided Automatic Cyber-attacks — Autonomous attack systems
EnIGMA: Enhanced Interactive Generative Model Agent for CTF — ICML 2025
LLM Agents can Autonomously Exploit One-day Vulnerabilities — GPT-4 exploits 87% of 15 real-world one-day CVEs given the description
Teams of LLM Agents can Exploit Zero-Day Vulnerabilities — HPTSA: hierarchical planning with task-specific agents
Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models — 40 professional-level CTF tasks
Comparing AI Agents to Cybersecurity Professionals in Real-World Penetration Testing — ARTEMIS vs. 10 professionals on a ~8,000-host network

Awesome Lists

List	Description	Stars
awesome-pentest	General pentesting resources.
Awesome-LLM4Cybersecurity	LLMs for cybersecurity: pentesting reasoning, exploit generation, vulnerability detection.
awesome-ai-security-tools	Public-source, research, and commercial tools for AI security and AI-assisted cybersecurity.
AI-Red-Teaming-Guide	Guide to adversarial testing and security evaluation of AI systems.
Awesome-AI-Hacking-Agents	List of AI hacking agents.
awesome-cybersecurity-agentic-ai	Autonomous security agents, frameworks, and research.
awesome-skills-security	Curated skill set of security-focused Claude Code skills.
Awesome-Offensive-AI-Agentic-Landscape	Open-source projects, papers, benchmarks, and commercial solutions in offensive agentic AI.
awesome-ai-cybersecurity	Resources for AI in cybersecurity. Collection for professionals and researchers.

Standards & Frameworks

OWASP AI Exchange — OWASP flagship AI security guidance (successor of the AI Security and Privacy Guide)
MITRE ATLAS — Adversarial Threat Landscape for AI Systems
OWASP Top 10 for LLM Applications
OWASP Top 10 for Agentic Applications
NIST AI Risk Management Framework

Unmaintained

Projects with no commits in the last 12 months. Still useful as reference, but expect bugs, outdated dependencies, or broken integrations.

Tool	Description	Original Category
SpiderFoot	Automated OSINT platform. 200+ data sources, threat surface mapping, most modules need no API keys.	OSINT with AI
Awesome-GPT-Agents	GPT agents for cybersecurity: offensive, defensive, and analytical.	Awesome Lists
AutoSploit	Automated mass exploiter combining Shodan/Censys/Zoomeye for target discovery with Metasploit for exploitation.	Bug Bounty & Recon AI
llm-attacks	Universal and transferable attacks on aligned language models. Academic research on adversarial attacks against LLMs.	Red Team & Offensive AI
Vulnhuntr	Zero-shot vulnerability discovery using Claude AI. Analyzes Python call chains. Found 12+ zero-days in production code.	Vulnerability Analysis & Scanning
ai-exploits	Collection of real-world AI/ML exploits for responsibly disclosed vulnerabilities.	Red Team & Offensive AI
awesome-llm-security	Tools, documents, and projects about LLM Security.	Awesome Lists
BigBountyRecon	58 different techniques using Google dorks and open source tools for initial reconnaissance.	Bug Bounty & Recon AI
ReconAIzer	Burp Suite extension using OpenAI GPT to discover endpoints, params, URLs, and subdomains during bug bounty recon.	Bug Bounty & Recon AI
MCP-Security-Checklist	Comprehensive security checklist for MCP-based AI tools by SlowMist. Input validation, audit capability, and risk assessment.	MCP Servers for Security
prompt-injection-defenses	Every practical and proposed defense against prompt injection attacks. Comprehensive reference.	AI Security (Securing AI Systems)
AI-Goat	Learn AI security through vulnerable LLM CTF challenges. Run locally, no sign-ups or cloud fees needed.	CTF Solvers & Challenge Tools
ToolFuzz	First framework for testing LLM agent tools. Combines fuzzing with LLMs for correctness evaluation.	Fuzzing with AI/ML
PentestThinkingMCP	AI pentesting reasoning engine with Beam Search, MCTS, attack scoring for attack path planning and CTF solving.	MCP Servers for Security
LLM-Security-CTF	Learn LLM/AI security through CTF challenges: prompt injection, jailbreaks, guardrail bypass, tool abuse.	CTF Solvers & Challenge Tools

Contributing

Contributions welcome! Please read CONTRIBUTING.md before submitting a PR.

Criteria for Inclusion

Open-source with a GitHub repository
Uses AI/ML in a meaningful way for security
Actively maintained (commits within 12 months) — tools that go quiet move to Unmaintained
Has documentation

Disclaimer

Tools listed are for educational purposes and authorized security testing only. Always obtain proper authorization before testing systems you do not own. The maintainers are not responsible for misuse.

Created by @skyvanguard
_{If this list helped you, consider giving it a star!}

ai-pentesting

artificial-intelligence

awesome-list

bug-bounty

ctf

cybersecurity

llm

mcp-server

osint

pentesting

red-team

security-tools

Significant stargazers

six2dez

2,617 followers · starred Oct 2026

Similar repos

raphabot/awesome-cybersecurity-agentic-ai

602

Yeti-791/Awesome-Offensive-AI-Agentic-Landscape

This document curates open-source projects, academic papers, capability benchmarks, and commercial…

372

We5ter/Scanners-Box

The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI…

9,110

EvanThomasLuke/Awesome-AI-Hacking-Agents

List of AI Hacking Agents

710

0x4m4/hexstrike-ai

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.)…

12,855

scadastrangelove/awesome-ai-security-tools

A curated list of public-source, research, and commercial tools for AI security and AI-assisted…

1,661

ch3cke/awesome-auto-penetration-testing

CyberStrikeus/CyberStrike

Open-source AI-powered offensive security harness for automated penetration testing.

3,170