AAikido Security
Aikido Security is an all-in-one developer security platform covering SAST, SCA, secrets, IaC, containers, cloud posture, DAST and runtime protection, with a free Developer plan.
Release & CI gates
Checks that gate merges and releases: test management, reporting, quality gates, feature flags and PR verification.
107 tools
- A
AAllure Report
Allure Report turns test results from many frameworks into one HTML report. The report tool is free and open source.
AApplause
Applause is a managed software testing services provider enabling enterprises to deliver high-quality apps, websites and AI experiences worldwide.
AAqua
Transform QA with aqua cloud's AI-driven test management platform.
AArize Phoenix
Arize Phoenix is an open-source (Elastic License 2.0) AI observability and evaluation tool for tracing, evaluating and improving LLM apps and agents, with a hosted Arize AX tier.
BBandit
Bandit is the PyCQA's Apache-2.0 tool for finding common security issues in Python code by building an AST for each file and running security plugins against it.
BBearer CLI
Bearer CLI is a SAST tool that scans source code and analyses data flows to find, filter and prioritise security and privacy risks, with a commercial Bearer Pro from Cycode.
BBraintrust
Braintrust is a hosted platform for AI evals and agent observability: trace production, turn patterns into evals, score releases, and query it from your IDE via MCP.
B Brakeman
Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications, run from the command line without needing the app to be running.
BBrowserStack MCP Server
BrowserStack's official AGPL-3.0 MCP server lets AI assistants manage test cases, run manual and automated tests on BrowserStack, and debug and fix code in plain English.
BBug0
Bug0 is a managed AI QA service: a forward-deployed engineer builds self-healing Playwright tests on Bug0's open-source engine and verifies every failure, for a flat monthly fee.
BBugzilla Testopia
Extension for Bugzilla to provide basic test case management features.
CCekura
Cekura is automated QA for voice and chat AI agents: simulations, evaluations, red-teaming and production call monitoring, with a loop that turns failures into evals and fixes.
CCheckly
Checkly is a monitoring-as-code platform for API checks, Playwright browser checks, uptime monitors, alerts and status pages, run from 20+ locations; Hobby $0, Starter $24/month, Team $64/month.
CCheckov
Checkov is an Apache-2.0 static analysis tool for infrastructure as code (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile and more) that also does SCA for images and open-source packages.
CChecksum
Checksum is an AI QA engineer that writes Playwright tests as pull requests in your repo, runs them, and opens healing PRs when the product changes.
CChromatic
Chromatic publishes Storybook and snapshots UI for visual review. The capture service is paid after a free monthly snapshot allowance.
CClair
Clair is an Apache-2.0 open-source project from Quay for static vulnerability analysis of application containers (OCI and Docker images), exposed through an API.
CCodeQL
CodeQL is GitHub's semantic code analysis engine: it builds a queryable database from source code and runs security queries (MIT-licensed standard library) to find vulnerabilities, powering GitHub code scanning.
CCodeScan
AutoRabit CodeScan™ secures and optimizes your Salesforce DevOps pipeline by providing real-time static code analysis and continuous compliance.
CCoval
Coval is a voice AI testing and evaluation platform that simulates conversations, observes production calls and adds human review to make voice agents deployment-ready.
CCucumberStudio
CucumberStudio gives your team the platform to succeed with BDD.
CCurrents
Currents is a paid CI dashboard for Playwright and a few other runners: traces, flake detection, and test orchestration.
DDeepEval
DeepEval is an open-source LLM evaluation library with pytest-style asserts. Confident AI is the optional paid cloud from the same team.
DDependabot
Dependabot is GitHub's automated dependency update service; its MIT-licensed core logic opens pull requests to update vulnerable and outdated dependencies across many ecosystems.
Ddetect-secrets
detect-secrets is Yelp's Apache-2.0, enterprise-friendly module for preventing new secrets entering a codebase, detecting committed secrets and tracking them with a baseline file.
DDocker Scout
Docker Scout is Docker's software supply-chain tool that analyses container images, builds SBOMs and gives near real-time, actionable insights and policy checks before images reach production.
DDockle
Dockle is an Apache-2.0 container image linter for security that checks built images against best practices and CIS Docker Benchmark items.
EEasyQA
Cloud-based test management tool for organizing test cases, running tests, and tracking bugs.
EEndor Labs
Endor Labs is an agentic application security platform for AI-generated and human-written code, covering SCA with reachability, SAST, secrets and container scanning to prioritise real risk.
FFind Security Bugs
Find Security Bugs is the LGPL-3.0 SpotBugs plugin for security audits of Java web and Android applications, also working with Kotlin, Groovy and Scala projects.
FFOSSA
FOSSA is a software supply-chain platform for SBOM generation, software composition analysis, open-source licence compliance and vulnerability management, with a free plan.
GGalileo
Galileo is an AI observability and eval engineering platform that builds datasets, tunes evaluation metrics and turns offline evals into production guardrails for AI apps and agents.
Ggarak
garak is NVIDIA's Apache-2.0 LLM vulnerability scanner that probes models and dialog systems for hallucination, data leakage, prompt injection, toxicity, jailbreaks and more.
GGiskard
Giskard offers an Apache-2.0 open-source library for evals, red teaming and test generation for AI agents, plus a commercial Hub for agent red-teaming, evaluation and guardrails.
GGitGuardian
GitGuardian is a credential-layer security platform for secrets detection and remediation across code, CI and collaboration tools, available as SaaS or self-hosted, with a free plan.
GGitHub Advanced Security
GitHub Advanced Security is GitHub's built-in, AI-powered application security suite: code scanning with CodeQL, secret scanning and push protection, dependency review and Copilot Autofix.
GGitleaks
Gitleaks is an MIT-licensed tool for detecting secrets such as passwords, API keys and tokens in Git repositories, files and stdin; it is now feature complete with security-patch-only releases.
Ggosec
gosec is an Apache-2.0 Go security checker that inspects source code for security problems by scanning the Go AST and SSA representation.
Ggovulncheck
govulncheck is the Go team's BSD-licensed vulnerability scanner that reports known vulnerabilities from the Go vulnerability database only when your code actually calls the affected functions.
GGrype
Grype is Anchore's Apache-2.0 vulnerability scanner for container images, filesystems and SBOMs, covering major OS package ecosystems and language packages.
HHadolint
Hadolint is a GPL-3.0 Dockerfile linter written in Haskell that checks best practices and validates inline bash in RUN instructions using ShellCheck.
HHamming
Hamming tests, red-teams and monitors voice and chat AI agents: simulated calls before launch, failed calls rerun as regression tests, and production monitoring.
HHelix TCM
Allows creating and organizing test cases, linking them to requirements for traceability.
IIBM Rational Quality Manager
Test case management solution with collaborative features for Agile teams.
IInspect
Inspect is the UK AI Security Institute's MIT-licensed framework for LLM evaluations, with datasets, solvers, scorers, agents, sandboxed tools and 200+ pre-built evals.
JJama Connect
Accelerate complex product development with an AI-powered engineering and requirements management platform that improves collaboration, traceability, quality, and compliance.
KKICS
KICS (Keeping Infrastructure as Code Secure) is Checkmarx's Apache-2.0 open-source scanner for security vulnerabilities, compliance issues and misconfigurations in infrastructure-as-code.
KKingfisher
Kingfisher is MongoDB's Apache-2.0 secret scanner and credential response tool in Rust: it detects leaked secrets with hundreds of rules, validates live credentials and maps blast radius.
K Klaros-Testmanagement
Test case management tool supporting Agile methods with reporting and CI/CD integration.
K Kualitee
Test case management tool from $12/user with AI test generation, defect tracking, and Jira integration built in.
KKubeLinter
KubeLinter is StackRox's Apache-2.0 static analysis tool that checks Kubernetes YAML files and Helm charts against best practices for security and production readiness.
KKubescape
Kubescape is an Apache-2.0 Kubernetes security platform for IDEs, CI/CD and clusters, with risk analysis, compliance frameworks, misconfiguration and vulnerability scanning.
LLangfuse
Langfuse is an open-source platform for LLM traces, prompts, and evals. Self-hosting is free; Langfuse Cloud is paid after a hobby tier.
LLangSmith
LangSmith is LangChain's platform for observability and evaluation of LLM applications and agents, including offline and online evals.
LLangWatch
LangWatch is an Apache-2.0 open-source platform for agent observability, evals and agent simulation testing, with prompt management, red-teaming and voice-agent testing.
LLaunchDarkly
LaunchDarkly is a commercial feature-flag and experimentation platform. A developer plan is free; production use is metered, not sold per seat.
LLighthouse CI
Lighthouse CI is Google Chrome's Apache-2.0 toolkit for running Lighthouse on every commit, asserting budgets, storing results and blocking performance, accessibility and SEO regressions.
MMend.io
Mend.io is an application security platform covering SCA, SAST, container and AI security, positioned as unifying AppSec and AI security.
MMeticulous
Meticulous records real sessions of a web app and turns them into a self-maintaining suite of visual end-to-end tests that run on every pull request.
OOpenAI Evals
OpenAI Evals is an MIT-licensed framework and open registry for evaluating LLMs and LLM systems, now complemented by evals in the OpenAI Dashboard.
OOpengrep
Opengrep is an LGPL-2.1 open-source SAST engine, a fork of Semgrep backed by a consortium of AppSec companies including Aikido, Endor Labs and others.
OOpik
Opik by Comet is an Apache-2.0 open-source platform to trace, evaluate and monitor LLM apps, RAG systems and agents, with test suites, LLM-as-judge evals and a free cloud tier.
OOSV-Scanner
OSV-Scanner is Google's Apache-2.0 dependency vulnerability scanner and official frontend to the OSV database, covering many languages, package managers, OS packages and containers, with guided remediation and licence checks.
OOWASP Dependency-Track
OWASP Dependency-Track is an Apache-2.0 SBOM-driven component analysis platform that tracks components across your portfolio and flags vulnerable, outdated or policy-violating dependencies.
PPercy
Percy is BrowserStack's visual testing service. SDKs upload screenshots from your tests; reviewers accept or reject the diff.
Ppip-audit
pip-audit is an Apache-2.0 PyPA tool that audits Python environments, requirements files and dependency trees for known vulnerabilities using the Python Packaging Advisory Database, and can fix them.
PPolaris
Polaris is Fairwinds' Apache-2.0 tool that validates Kubernetes workloads against best practices as a dashboard, admission controller or CLI.
PPractiTest
PractiTest is an AI-powered Test Management and QA Intelligence Platform that turns QA data into business answers.
PPromptfoo
Promptfoo is an open-source CLI for LLM evals and red teaming. The community tool is free; enterprise features are quoted.
PPyRIT
PyRIT is Microsoft's MIT-licensed Python Risk Identification Tool for generative AI: automated scans, adaptive multi-turn attacks and human-led red teaming in one toolkit.
QQA.tech
QA.tech runs AI verification agents against a live web or mobile app on every pull request, mapping the app and checking the user journeys a change affects.
Q Qase
Cloud-based test case management with test planning, execution, and defect tracking.
QQMetry
Accelerate releases with AI-powered test management.
RRagas
Ragas is an open-source library for systematically evaluating LLM applications, including RAG systems and agents.
RRanger
Ranger gives coding agents a browser-based verifier: one command tests the feature an agent just built and returns a verdict with screenshots, recordings and traces.
RReportPortal
ReportPortal is an open-source test-results server with live reporting, failure analysis, and dashboards. Hosted support is paid.
RReQtest
Med Reqtest är det enkelt att lyckas med IT-projektet.
RRetire.js
Retire.js is an Apache-2.0 scanner that detects JavaScript libraries with known vulnerabilities in web apps and Node.js projects, and can generate an SBOM of the libraries it finds.
SSemgrep
Semgrep is a fast static-analysis engine with a free open-source CLI and a paid platform for cross-file rules, supply chain, and secrets.
SShiplight AI
Shiplight AI is an agent-native testing platform: it installs into your coding agent as an MCP server and skills, walks your app in a real browser and writes readable, self-healing tests.
SSmartBear Test Management
Tool that includes test planning, test case management, and reporting tools.
SSnyk
Snyk CLI scans and monitors your projects for security vulnerabilities.
SSocket
Socket is a software supply-chain security platform that blocks zero-day supply chain attacks in JavaScript, Python and Go dependencies by analysing package behaviour, with a free plan.
SSonarQube
Modernize your AI workflows with code verification for the agentic era.
SSpiraTest
Manage your project's requirements, test cases and bugs.
SStackHawk
StackHawk is a developer-focused application security testing platform, now positioned as an AI coding agent security platform that finds, fixes and verifies exploitable vulnerabilities; plans from $10 per user per month.
SSyft
Syft is Anchore's Apache-2.0 CLI and Go library for generating Software Bills of Materials (SBOMs) from container images, filesystems and archives, in CycloneDX, SPDX and other formats.
TTalisman
Talisman is ThoughtWorks' MIT-licensed pre-commit and pre-push hook that inspects outgoing changesets for suspicious content such as tokens, passwords and private keys.
TTest Collab
Web-based test management tool with real-time reporting, JIRA integration, and REST API support.
TTestDriver
TestDriver runs every pull request in a real desktop sandbox with a vision-based AI QA agent, finds bugs and builds regression tests, including for desktop apps and extensions.
TTestiny
AI-ready test management tool for teams who want manual and automated testing in one system, their preferred AI assistant, and EU cloud or self-hosting.
T TestLink
Open-source test case management with test execution tracking and reporting capabilities.
TTestLodge
Simple test case management tool for creating and running test cases with reporting.
TTestmo
Modern test management software tool that fully integrates your test cases, test automation and exploratory testing, regardless of the tools you use.
TTestMonitor
TestMonitor is a simple, intuitive test management software platform built for enterprise software, quality app development, and other important testing needs.
TTestpad
Checklists-inspired test management for manual and exploratory testing, Agile-friendly.
TTestRail
TestRail is AI-driven test management software for planning, executing, and reporting on testing.
TTestSprite
TestSprite is an AI testing agent that generates, runs and heals tests against a live app, from a CLI, an IDE MCP server, CI or a dashboard.
TTricentis qTest
Supports Agile and DevOps workflows, allowing centralized management of test cases.
TTrivy
Trivy is Aqua Security's Apache-2.0 all-in-one scanner for container images, filesystems, Git repos, VM images and Kubernetes, finding CVEs, IaC misconfigurations, secrets, licences and SBOM data.
TTruffleHog
TruffleHog is Truffle Security's AGPL-3.0 secrets scanner that discovers, classifies (800+ types), verifies and analyses leaked credentials in Git, chats, wikis, logs, object stores and filesystems.
TTruLens
TruLens is an MIT-licensed, OpenTelemetry-native library for tracing and evaluating LLM apps and agents with explainable LLM judges, maintained by Snowflake.
T Tuskr
Flexible test management with features for planning, executing, and analyzing test cases.
XXray
Bring QA and development together in Jira.
ZZebrunner
Synchronize manual and test automation teams in one place.
ZZephyr
Whether you’re Agile or Waterfall, or somewhere in-between, Zephyr test management solutions support development natively on Jira as well as securely on-premises.