Top 23 llm-security Open-Source Projects

1. strix

   1 11 66,027 9.8 Python

   Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

   

   Project mention: OpenAI just open-sourced Codex Security | news.ycombinator.com | 2026-07-28

   would love it to see it h2h against https://github.com/usestrix/strix (45k stars)

2. AppSignal

   www.appsignal.com sponsored

   AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

   

3. llm-app

   2 15 58,852 5.3 Jupyter Notebook

   Ready-to-run cloud templates for RAG, AI pipelines, and enterprise search with live data. 🐳Docker-friendly.⚡Always in sync with Sharepoint, Google Drive, S3, Kafka, PostgreSQL, real-time data APIs, and more.

   

4. iFixAi

   3 3 20,084 8.8 Python

   Independent Auditing of AI Agents. Run by human or the agent itself, to answer the most crucial question in the AI Agent Economy. Is the agent doing what is supposed to do? With iFixAi you can have this answer in less than 120 seconds.

   

   Project mention: iFixAi: Independent Agent Auditing in 120 Seconds | dev.to | 2026-10-04

   iFixAi GitHub Repository

5. garak

   4 10 9,396 9.9 Python

   the LLM vulnerability scanner

   

   Project mention: Adding AI to a Security Toolkit: Start With Your Own Scripts | dev.to | 2026-09-30

   If you run web application tests, you already have a pipeline: scope, enumerate, test, report. Your organization's support chatbot or internal RAG assistant belongs in it. NVIDIA's garak is the scanner-style entry point:

6. Guardrails

   5 15 7,234 9.6 Python

   NeMo Guardrails is an open-source toolkit for easily adding programmable guardrails to LLM-based conversational systems. (by NVIDIA-NeMo)

   

   Project mention: NeMo Guardrails vs Guardrails AI: The Production Latency Benchmark We Could Not Honestly Complete | dev.to | 2026-09-29

   For NeMo, we anchored the reproducibility audit to the pinned official benchmark README. That benchmark runs the Guardrails service with separate mock application and content-safety endpoints. It is CPU-only, does not require a GPU or hosted-model access, and exposes controllable latency distributions.

7. AI-Infra-Guard

   6 3 6,660 9.8 Python

   A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

   

   Project mention: Black Hat Europe 2025 Arsenal: 8 AI Security Tools Transforming Cybersecurity | dev.to | 2025-11-09

   https://github.com/Tencent/AI-Infra-Guard https://github.com/mandiant/harbinger https://github.com/stratosphereips/MIPSEval https://github.com/ErdemOzgen/RedAiRange https://github.com/ReversecLabs/spikee https://github.com/ThalesGroup/sql-data-guard

8. giskard-oss

   7 9 5,861 9.8 Python

   🐢 Open-Source Evaluation & Testing library for LLM Agents

   

9. SaaSHub

   www.saashub.com sponsored

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. jailbreak_llms

    8 4 3,818 5.6 Jupyter Notebook

    [CCS'24] A dataset consists of 15,140 ChatGPT prompts from Reddit, Discord, websites, and open-source datasets (including 1,405 jailbreak prompts).

    

11. beelzebub

    9 42 2,189 8.7 Go

    A secure low code deception runtime framework, leveraging AI for System Virtualization.

    

12. agentic_security

    10 3 2,017 8.7 Python

    Agentic LLM Vulnerability Scanner / AI red teaming kit 🧪

    

13. ADR

    11 1 1,616 8.7 Python

    ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber. (by uber)

    

    Project mention: Uber open-sourced its security monitoring for Claude Code, Cursor and Codex | news.ycombinator.com | 2026-08-06

14. www-project-top-10-for-large-language-model-applications

    12 3 1,432 7.3 Python

    OWASP Top 10 for Large Language Model Apps (Part of the GenAI Security Project)

    

    Project mention: How to manage multi-user AI agent authentication and authorization in 2026 (OAuth 2.1, OIDC, and delegated access) | dev.to | 2026-05-14

    The Open Web Application Security Project highlights these vulnerabilities in its updated guidelines, citing prompt injection and excessive agency as primary risks that lead directly to the confused deputy problem.

15. agentic-radar

    13 3 1,058 8.4 Python

    A security scanner for your LLM agentic workflows

    

16. pipelock

    14 16 917 9.9 Go

    Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.

    

    Project mention: A secret scanner that blocks git push gets turned off | dev.to | 2026-10-05

    So in Pipelock 3.6 the audience sets are compiled in, one per credential class, tied to provider docs in the provider key coverage table. The table flags the few bindings carried over without independent verification. A GitHub token earns the allow only on an Authorization header at the API hosts, or as Basic auth on a git transport path at github.com. Put the same token in a URL, a body field, a different header, or a non-git path on github.com, and it still blocks. A percent-encoded path or one with .. segments doesn't qualify. The connection has to be encrypted, and Pipelock has to be able to see inside it, which means TLS interception for HTTPS going through the forward proxy. A plain CONNECT tunnel is opaque bytes. Every allow is recorded in the audit log. With receipt signing set up and the recorder writing successfully, it also gets a signed receipt.

17. EasyJailbreak

    15 1 913 3.2 Python

    An easy-to-use Python framework to generate adversarial jailbreak prompts.

    

18. Open-Prompt-Injection

    16 1 503 2.8 Python

    This repository provides a benchmark for prompt injection attacks and defenses in LLMs

    

19. AgentHound

    17 2 442 9.6 Go

    Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.

    

    Project mention: BloodHound for AI Agents Means We've Officially Given Up Pretending This Is Simple | dev.to | 2026-07-28

    Agenthound – Offensive security framework for AI agent infrastructure

20. agent-threat-rules

    18 1 406 9.9 TypeScript

    Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.

    

    Project mention: I Scanned 2,386 MCP Packages on npm. 402 Were Critical. Here's What I Found. | dev.to | 2026-03-22

    Everything is open source (MIT): ATR rules + PanGuard scanner

21. agentseal

    19 2 376 9.2 Python

    Security toolkit for AI agents. Scan your machine for dangerous skills and MCP configs, monitor for supply chain attacks, test prompt injection resistance, and audit live MCP servers for tool poisoning.

    

    Project mention: AgentSeal – Security scanner for AI agents (150 attack probes) | news.ycombinator.com | 2026-03-06

    GitHub: https://github.com/AgentSeal/agentseal

22. secureclaw

    20 2 348 7.5 TypeScript

    SecureClaw - Security Plugin and Skill for OpenClaw OWASP-Aligned

    

    Project mention: Every AI Agent Skills Platform You Need to Know in 2026 | dev.to | 2026-02-19

    ClawHub + SecureClaw. Install SecureClaw first, then use it to audit everything else.

23. Doberman-Core

    21 9 277 9.8 Python

    Your AI's guard dog. Doberman sits at runtime, gating every input, output and tool call to stop unsafe or unintended actions before they execute.

    

    Project mention: Read the approval split before trusting an agent-security benchmark | dev.to | 2026-10-01

24. julius

    22 1 242 8.7 Go

    Simple LLM service identification - translate IP:Port to Ollama, vLLM, LiteLLM, or 60+ other AI services in seconds (by praetorian-inc)

    

    Project mention: Most AI APIs hand you a label and ask you to believe it. | dev.to | 2026-07-21

    Julius-style service fingerprints: figure out the serving stack itself, Ollama, vLLM, LiteLLM, whatever's underneath. Julius and its repo.

25. agent-audit

    23 2 237 9.1 Python

    Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen.

    

    Project mention: Show HN: Agent Audit – Open-source security scanner for AI agents | news.ycombinator.com | 2026-02-06

    - Static analysis limitations apply — can't catch runtime-only issues

    *Some numbers from scanning open-source projects:*

    I scanned 6 popular agent repos (OpenHands, SWE-agent, Gorilla, etc.). Found 617 findings total, 269 critical. Most common issue: tool functions that pass LLM-provided strings directly to dangerous sinks without validation.

    Full report: https://github.com/HeadyZhang/agent-audit/blob/master/docs/r...

    *Install:*

    ```

26. SaaSHub

    www.saashub.com sponsored

    SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

    

llm-security related posts

• The Agent Did It' Won't Fly. Can You Prove What You Authorized?

  1 project | dev.to | 1 Oct 2026

• HN: Humanbound|Open-source red teaming for AI agents, free hosted tier

  1 project | news.ycombinator.com | 30 Sep 2026

• Meta's prompt-injection detector caught 1% of real agent attacks. One config change made it 99%. That's the problem.

  1 project | dev.to | 29 Sep 2026

• Your AI Agent Will Follow a Stranger's Instructions. Here's How I Actually Test For It.

  2 projects | dev.to | 26 Sep 2026

• Benchmarking My MCP Security Scanner: 14 of 14 Findings, Zero False Positives

  1 project | dev.to | 11 Sep 2026

• sunglasses VS Doberman-Core - a user suggested alternative

  2 projects | 3 Sep 2026

• How to prevent AI agents from overspending

  1 project | dev.to | 2 Sep 2026
• A note from our sponsor - SaaSHub
  www.saashub.com | 6 Oct 2026

  SaaSHub helps you find the best software and product alternatives Learn more →

Index

Sponsored

AppSignal knows why the f*#k it crashed.

Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

www.appsignal.com