AI Agent Security

SkillSpector24.6k★

SkillSpector checks AI agent skills before you install them. Skills are instructions and scripts that Claude Code, Codex and friends run with your permissions, usually grabbed from strangers unread. Point it at a Git repo, URL, zip or folder and you get a 0-100 risk score with a SAFE, CAUTION or DO NOT INSTALL call. Free under Apache 2.0, from NVIDIA. Install with uv tool install from the repo or build the included Dockerfile. Checks span 17 categories, from prompt injection and data exfiltration to supply-chain tricks, YARA malware signatures and MCP tool poisoning. Output comes as terminal, JSON, Markdown or SARIF, and an MCP server mode lets your agent scan before it installs. No paid tier. Solo, small and large teams: free, and worth wiring into CI. Know this first: the LLM review stage is on by default and sends skill file contents to your provider, NVIDIA's build.nvidia.com unless you change it. Ollama or --no-llm keeps file contents local. The catch: a CAUTION score still exits 0, so a default CI gate passes anything scoring up to 50. Add --fail-on-findings. And it never runs the skill, so a clean scan means nothing known turned up, not that it's safe.

deepsec8.4k★

Deepsec is a security scanner that pays AI agents to find vulnerabilities the way a human auditor would. You point it at your repo, the agent reads the codebase, and it reports back with the kind of bugs that pattern-match scanners miss. The scan can cost thousands of dollars on a large codebase because it runs frontier models at maximum thinking depth. Apache 2.0, by Vercel Labs. Setup is npx deepsec init and a coding agent prompt to populate a project info file. From there, scans fan out across worker machines (or Vercel Sandbox microVMs for distributed runs). Jobs are idempotent, so an interrupted scan picks up where it left off. The model bill flows through Vercel AI Gateway or your own provider keys. Solo developers: probably overkill, and the model bill scares away curiosity scans. Use Snyk's free tier or Semgrep instead. Small teams shipping high-stakes code: a one-time scan of your auth layer or payment flow is in budget and finds real bugs. Large teams with security budgets: this is what you spend $30K on instead of a security consultant. The catch: the cost. A scan of a 100K-line monorepo with frontier models is real money. Read the FAQ before you launch one.

bumblebee5.1k★

Bumblebee answers one question fast: which of my machines have a known-compromised package installed? It's a read-only scanner from Perplexity that inventories what's on a developer's laptop or server, npm, PyPI, Go modules, RubyGems, Composer, browser and editor extensions, MCP configs, and flags anything matching a catalog of known-bad versions. Free, Apache-2.0, written in Go. The read-only part matters. It never runs a package manager, never reads your source, and deliberately won't print credential values out of MCP configs. It just reads lockfiles and metadata. That makes it safe to run across a fleet during an incident, which is exactly the job it's built for: supply-chain incident response, not continuous scanning. The catch: it's narrow on purpose. You supply the catalog of compromised packages, and Bumblebee matches against it. It won't find unknown vulnerabilities or do what a full SCA tool like Snyk does. For 'a bad package just hit the news, who's exposed,' it's perfect. For ongoing dependency security, it's not the whole answer.

nono4.9k★

nono puts AI coding agents like Claude Code and Codex in a locked room before they touch your machine. No container, no VM, no daemon: you grant the files, network hosts and credentials an agent gets, and the OS kernel enforces the rest. Apache 2.0 and free. It runs on macOS (Seatbelt, the mechanism behind App Store sandboxing), Linux (Landlock, kernel 5.13+) and Windows via WSL2. Run brew install nono, pull your agent's profile from the nono registry, and go. The sharp part is per-tool policy: gh can get a GitHub token through a proxy, limited to the API paths you list, while the agent never sees it. Docker or E2B is the heavier route. Solo, small teams, larger teams: all free today. nolabs, the Sigstore team behind it, is building a paid Enterprise layer (fleet-wide policy, audit trails, SSO, hosted agents) now in early access: GA in February 2027, no public price. The catch: it's pre-1.0 and releases every week or two, so APIs still move. Per-port network filtering on Linux needs kernel 6.7+, WSL2 blocks the credential proxy by default, and native Windows is only a draft. A sandbox is only as tight as the profile you pull.

zeroboot2.5k★

Zeroboot spins up virtual machine sandboxes in under a millisecond using copy-on-write forking. That speed matters because agents need to spin up and tear down environments constantly, and traditional VMs take seconds to minutes. Sub-millisecond means your agent can create a fresh isolated environment for every single command it runs. No leftover state, no risk of one task contaminating another. It's like giving your agent a brand new computer for every action. Apache 2.0 licensed, Rust. The catch: this is Linux-only (it relies on kernel-level VM features). No macOS, no Windows. The sub-millisecond claim is for the VM fork. Actual workload startup depends on what you're running inside. And the community is small. If you hit an edge case, you're likely on your own.

fence1.0k★

Fence sandboxes them without containers. It restricts network access and filesystem access at the OS level, so a rogue script can't phone home or delete your files. What's free: Everything. Apache 2.0 license. Single Go binary, no dependencies, no account. The value proposition is simplicity. Docker gives you isolation but requires the Docker daemon, images, and significant overhead. Fence is one binary. Run fence <command> and it executes with network and filesystem restrictions. That's it. For AI agent sandboxing, where you're running LLM-generated code and need guardrails, this is exactly the right weight class. The catch: it's brand new and early-stage. Linux only (uses kernel namespaces and seccomp). No macOS or Windows support. The security model is narrower than a full container. It restricts network and filesystem but doesn't provide complete process isolation. For high-security use cases, you still want containers or VMs. For 'don't let this script access the internet or my home directory,' it's perfect.

audit885★

audit is an automated vulnerability-discovery agent from evilsocket. Point it at a codebase and it runs an eight-stage pipeline, recon, hunt, validate, trace, report, using narrow AI agents that deliberately argue with each other: a second agent on a different model tries to disprove the first one's findings. MIT-licensed and free. The design borrows from Cloudflare's research that real bug-hunting needs many focused agents, not one giant model doing everything. It runs on your Claude Code subscription through the official Agent SDK, so there's no separate API key or metered bill if you already pay for Claude. Setup is more involved than a one-liner, and the agents run shell commands, so a disposable VM is the right call for untrusted code. The catch: this drives an LLM to find bugs, which means false positives and missed issues both happen. It's a force multiplier for a security reviewer, not a replacement for one. If you do code audits and already have Claude, it's worth a serious look. If you expect it to certify your code as safe on its own, that's not what this is.