Documentation checked means the source was read. It does not mean the software was installed, tested or security audited.
Reading an entry does not authorise installation, credential access or spending. Tech Horizon Labs projects are labelled, and there are no affiliate links or paid placement.
People running coding agents against Slack, GitHub, email, files or databases.
Access and use
Install with brew tap node9-ai/node9 && brew install node9, or npm install -g node9-ai. Needs Node.js 22 or later. Local protection needs no account. Optional dashboard login. Apache-2.0.
A local, read-only security audit for an OpenClaw agent. It looks for config, prompt-injection and supply-chain risks and can vet a skill before install.
People running OpenClaw who want a local A to F grade without sending config off the machine.
Access and use
Python 3.10 or later. Install with pipx from the GitHub repo. The scanner reports and does not change OpenClaw config. Official docs say the scanner makes no network calls. MIT.
People who want coding agents to work inside a local virtual machine.
Access and use
pip install 'quick-sandbox[qemu,alpine]', or pip install quick-sandbox then quicksand install qemu alpine. Desktop images: quicksand install ubuntu-desktop or alpine-desktop. Sandboxes are network-isolated by default; NetworkMode.FULL gives internet. Host directories can be mounted into the guest. Bidirectional port forwards map host and guest TCP ports. MIT.
A command line scanner that finds the agents, MCP servers and skills installed on a machine and checks them for prompt injection, tool poisoning, malware hidden in text and other risks.
Developers and security teams who want to check the MCP servers and skills used by Claude Code, Cursor, Gemini CLI, Windsurf or VS Code before trusting them.
Access and use
uvx snyk-agent-scan@latest scans the whole machine; pass a path such as ~/.claude/skills or an mcp.json file to scan one target. Standalone binaries with an SBOM and signed checksums are on GitHub Releases. Needs a Snyk account and a SNYK_TOKEN. To read tool descriptions it starts the stdio MCP servers in your configs and connects to remote ones, so the README advises scanning untrusted configs inside a sandbox; interactive runs ask before contacting each server. It sends component details, tool descriptions and skill content to Snyk's analysis API, with secrets redacted, under Snyk's Agent Scan terms. The README says CLI output is experimental and may change. The repository moved from invariantlabs-ai/mcp-scan. Apache-2.0.
Developers who want to run MCP servers locally with fewer permissions, and platform teams who run approved MCP servers for an organisation on Kubernetes.
Access and use
brew tap stacklok/tap then brew install thv, winget install stacklok.thv, a binary from GitHub Releases, or the ToolHive desktop app. Needs Docker, Podman, Colima or Rancher Desktop. Each server gets a container with a minimal permission file and no local credentials. Secrets are stored encrypted, with the encryption password kept in your OS keyring. Per-request access policy needs an identity provider to be configured. The CLI checks for updates and sends anonymous usage metrics (tool call counts) until you run thv config usage-metrics disable. Apache-2.0.
NVIDIA's Python library for adding programmable guardrails to LLM apps, with rails that check user input, model output, retrieved chunks and tool calls, including jailbreak and injection detection.
Developers building chat assistants, RAG apps or agents in Python who want configurable checks between their code and the model.
Access and use
pip install nemoguardrails. Needs Python 3.11 to 3.13. Rails are set in a config.yml file and Colang flows, and call the LLM provider set there, such as OpenAI, with your own key. nemoguardrails server runs it as an HTTP API. The library sends anonymous telemetry to NVIDIA (versions, OS, provider names and rail counts; the README says no prompts, completions or keys) until you set NEMO_GUARDRAILS_NO_USAGE_STATS=1 before it starts. The README says NVIDIA Build endpoints are for evaluation only. The LICENSE file is Apache-2.0; GitHub shows NOASSERTION.
The OWASP GenAI Security Project's list of the ten most critical security risks for AI agents, from agent goal hijack and tool misuse to memory poisoning and rogue agents, with attack scenarios and mitigations for each.
Teams that build, deploy or review AI agents and want a shared list of risks to check designs and controls against.
Access and use
A free PDF from the OWASP GenAI Security Project page, downloadable without signing in. The 2026 edition was published on 9 December 2025. Risks are numbered ASI01 to ASI10 and mapped to OWASP's Agentic AI Threats and Mitigations guide. CC BY-SA 4.0.
Cloudflare's coding-agent skill for a six-phase security audit of a codebase, in which separate agents find each issue, try to disprove it and check the final record.
Developers and security teams who want a coding agent to review code they own for vulnerabilities.
Access and use
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. Needs a model with tool use and parallel sub-agents, and Node.js for its two validators. It reads the code and writes its reports, by default under ~/security-audit-skill/. Before it runs any of the target's own code it asks for an OS-enforced sandbox with outside networking turned off; without one, those leads stay marked needs_validation. Cloudflare says one run found about half of what repeated runs found. Audit only code you are allowed to test. MIT.
A scanner from NVIDIA that checks AI agent skills and MCP servers for prompt injection, data exfiltration, supply-chain and other risks before you install them, and gives each a risk score from 0 to 100.
Developers and security teams who install third-party skills into Claude Code, Codex, Gemini CLI or similar agents and want to know whether a skill is safe first.
Access and use
Install with uv tool install git+https://github.com/NVIDIA/skillspector.git, or with uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git' to also run it as an MCP server (claude mcp add skillspector -- skillspector mcp). A Dockerfile is included if you would rather not install Python. Needs Python 3.12 to 3.15. LLM analysis is on by default and sends the scanned files' contents to the configured provider, which defaults to NVIDIA's build.nvidia.com with an NVIDIA_INFERENCE_KEY; OpenAI, Anthropic, Bedrock, Gemini, Azure OpenAI, local Ollama and the Claude, Gemini and OpenCode CLIs also work, and --no-llm keeps file contents local. The dependency check sends package names and versions to OSV.dev even with --no-llm. The MCP HTTP transport has no authentication and only binds to loopback addresses, and the README notes a known initialise hang on the stdio transport (issue #199). It never runs the scanned skill and does not sandbox a skill you install anyway. Apache-2.0.
A Node.js CLI, MCP server and agent skill that alters the software you ship so AI reverse-engineering agents hit resource limits and follow decoys, while runtime behaviour is meant to stay the same.
Developers who ship binaries, Electron apps, JavaScript bundles, Python or WebAssembly and want automated AI reverse engineering of their own releases to cost more.
Access and use
Run npx bla-agents setup to register the bla MCP server and blind-llm-agents skill with your coding agents, then npx bla-agents harden . to audit, protect and verify build outputs; it needs Node.js ^22.23.4 or >=24.0.0. Setup auto-discovers installed coding agents and writes to their global config files, such as ~/.claude.json and ~/.cursor/mcp.json; use --client to limit it and npx bla-agents uninstall to remove it. Protection adds decoy metadata, honey tables and canary credentials to your artifacts and can make them much larger (the README lists an Electron ASAR going from 607 B to 16.9 MiB), and it adds inspector and Frida detection that returns synthetic telemetry, so run bla verify against the original in staging before shipping. Risky LLM-facing bait, including fake COPPA or medical notices, is off unless you pass --llm-directives. The MCP tools refuse to overwrite an existing output file unless confirm_overwrite: true is set. The README's token and cost multipliers are the project's own internal estimates. Only run it on software you own or are authorised to modify. The npm package is published from this repo with npm provenance. MIT.