We’re open-sourcing Trailmark, a library that parses source code into a queryable call graph of functions, classes, call relationships, and semantic metadata, then exposes that graph through a Python API that Claude skills can call directly. Install it now: uv pip install trailmark “Defenders think…

Interceptor AI agents use your real browser and macOS apps like a human would. No CDP. No separate automated browser. No starting from zero. · · · · · Architecture Interceptor gives agents human-style control of the tools you already use — computer-use for the native macOS apps on your desktop,…

🦆 goose has moved! This project has moved from block/goose to the Agentic AI Foundation (AAIF) at the Linux Foundation. Some links and references are still being updated — please bear with us during the transition. goose your native open source AI agent — desktop app, CLI, and API — for code,…

Build Your Software Factory A self-improving system for your SDLC. Ingest continuous signals and deploy production software. Contact Sales Read the docs Trusted by leading engineering teams Defining your Software Factory 01Model IndependenceModel AModel BModel 3Best of all 02Sovereign…

Defending Code Reference Harness A reference implementation for autonomous vulnerability discovery and remediation with Claude, based on our learnings from partnering with security teams at several organizations since launching Claude Mythos Preview. For a write up of these learnings along with best…

deepsec deepsec an agent-powered vulnerability scanner that you can run in your own infrastructure, optimized to perform on-demand review of all code in existing large-scale repos. deepsec is designed to surface hard-to-find issues that have been lurking in applications for a long time. It is…

honeyslop - code canaries to quickly triage hallucinated ("slop") vulnerability reports honeyslop is code canaries, decoys, for open-source projects drowning in AI-hallucinated ("slop") and unverified vulnerability reports. With such adversarial noise injection, a slop scanner ingests the canary,…

Structured Analysis Skill for Claude Code AI-augmented Structured Analytic Techniques (SATs) from US Intelligence Community doctrine — implemented as an interactive Claude Code skill. 18 techniques across 6 analytical phases, with automated evidence gathering, three-layer self-correction, and…

@citedy/game-sounds Game sound effects for Claude Code/Codex/Droid/any CLI/IDE — 552 iconic sounds from 63 classic games! "Work work!" when you submit a prompt. "Job's done!" when the task completes. "I'm Batman" on session start. Hedwig's Theme when task completes. Shame bell on error. Install…

Claude Code in a devcontainer A sandboxed development environment for running Claude Code with bypassPermissions safely enabled. Built at Trail of Bits for security audit workflows. Why Use This? Running Claude with bypassPermissions on your host machine is risky—it can execute any command without…

anubis Public Sponsor TecharoHQ/anubis Fork 542 Fork your own copy of TecharoHQ/anubis Forks could not be loaded Loading Uh oh! There was an error while loading. . Unstar this repository? This will remove {{ repoNameWithOwner }} from the {{ listsWithCount }} that it's been added to. Lists Loading Uh…

Blog/ Article Contents in this story Published: January 21, 2026 Security and Trust3 min read Share this post Keep up with us Summary Announces the release of BlackIce, an open-source, containerized toolkit for AI security testing, first introduced at CAMLIS Red 2025 Explains how BlackIce unifies 14…

markdown.new File to Markdown CrawlNEW Powered by Cloudflare Markdown for Agents The web was built for humans. AI agents need structured data. We convert any URL to clean Markdown using Cloudflare's native text/markdown content type — no parsing, no waste. 80% fewer tokens than raw HTML ⚡ 0.1–0.6s…

Offensive Security MCP Servers Production-ready, Dockerized MCP (Model Context Protocol) servers for offensive security tools. Enable AI assistants like Claude to perform security assessments, vulnerability scanning, and binary analysis. Features 38 MCP Servers covering reconnaissance, web security,…

Deadend CLI Autonomous pentesting agent using feedback-driven iteration Achieves ~78% on XBOW benchmarks with fully local execution and model-agnostic architecture. Like the project or want to know more? Feel free to ! Warning Active Development: This project is undergoing active development. Core…

Trail of Bits Claude Code Config Opinionated defaults, documentation, and workflows for Claude Code at Trail of Bits. Covers sandboxing, permissions, hooks, skills, MCP servers, and usage patterns we've found effective across security audits, development, and research. First-time setup: git clone…

View Live Site

description Create or edit Claude Code skills with expert guidance on structure and best practices allowed-tools Skill(create-agent-skills) argument-hint skill description or requirements Invoke the create-agent-skills skill for: $ARGUMENTS

gstack "I don't think I've typed like a line of code probably since December, basically, which is an extremely large change." — Andrej Karpathy, No Priors podcast, March 2026 When I heard Karpathy say this, I wanted to find out how. How does one person ship like a team of twenty? Peter Steinberger…

Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. Combines pattern-based detection (YAML + YARA), LLM-as-a-judge, and behavioral dataflow analysis to maximize detection coverage of probable threats while…

Scanner An open-source web application for AI model security assessments, built with Ruby on Rails and NVIDIA garak. Scanner helps organizations test their AI systems for vulnerabilities before deployment — similar to penetration testing for traditional software. Features 179 community probes across…

OpenShell OpenShell is the safe, private runtime for autonomous AI agents. It provides sandboxed execution environments that protect your data, credentials, and infrastructure — governed by declarative YAML policies that prevent unauthorized file access, data exfiltration, and uncontrolled network…

Authority Nanos Authority Kernel for secure AI agent execution, built on Nanos. What This Is Authority Nanos is a unikernel that enforces kernel-level security for autonomous AI agents. It provides: Cryptographic Capabilities - Unforgeable HMAC-signed tokens for resource access Audit Logging -…

Master Claude Code in a Weekend Go from typing claude to orchestrating agents, hooks, skills, and MCP servers — with visual tutorials, copy-paste templates, and a guided learning path. The Problem You installed Claude Code. You ran a few prompts. Now what? The official docs describe features — but…

ramimac-unprompted Public forked from ramimac/unprompted Fork 0 Fork your own copy of andMYhacks/ramimac-unprompted Forks could not be loaded Loading Uh oh! There was an error while loading. . Unstar this repository? This will remove {{ repoNameWithOwner }} from the {{ listsWithCount }} that it's…

Superpowers Superpowers is a complete software development workflow for your coding agents, built on top of a set of composable "skills" and some initial instructions that make sure your agent uses them. How it works It starts from the moment you fire up your coding agent. As soon as it sees that…

CLI-Anything: Making ALL Software Agent-Native Today's Software Serves Humans👨‍💻. Tomorrow's Users will be Agents🤖. CLI-Anything: Bridging the Gap Between AI Agents and the World's Software One Command Line: Make any software agent-ready for OpenClaw, nanobot, Cursor, Claude Code, etc. 中文文档 |…

AvaKill Open-source safety firewall for AI agents One YAML policy. Three independent enforcement paths. Every agent protected. pipx install avakill && avakill setup · · · · · Docs · Contributing The Problem AI agents are shipping to production with zero safety controls on their tool calls. The…

Railguard: Scan Skills Warning Skunkworks project. Use with eyes open. This is an active research effort, not production-grade tool(s). Expect rough edges: No long-term support. All things may change without notice. Unknown coverage gaps. Detection rules included are references, not production…

OAST-MCP Out-of-Band Application Security Testing via the Model Context Protocol. OAST-MCP exposes six OAST tools and six agent-management tools to any MCP-compatible AI assistant. It lets an AI drive DNS/HTTP/HTTPS callback detection, deploy agents on compromised targets, and run remote tasks. All…