442Crunch
42Crunch is an API security platform known for OpenAPI audit, conformance scanning and API protection, now positioned as an AI security platform for MCP servers used by AI agents.
Security testing
SAST, DAST, SCA, secrets, IaC and container scanning, API security and fuzzing.
107 tools
- 4
AAcunetix
Invicti Web + API is an end-to-end web security scanner that offers a 360 view of an organization’s security.
AAFL++
AFL++ is the community-maintained successor to Google's AFL: a coverage-guided fuzzer with faster execution, better mutations and instrumentation, custom mutators and modes for binaries, licensed AGPL-3.0-or-later.
AAikido Security
Aikido Security is an all-in-one developer security platform covering SAST, SCA, secrets, IaC, containers, cloud posture, DAST and runtime protection, with a free Developer plan.
A Aircrack-ng
WiFi security auditing tools suite.
AAkto
Akto is an MIT-licensed security platform that began in API security testing and now positions itself as security for AI agents, MCP servers and LLMs.
A AppSpider
A dynamic application security testing tool with API security features.
AArachni
Web Application Security Scanner Framework.
AAstra
Astra Security is a one of a kind AI powered automated Pentest Platform that makes chaotic pentests a breeze & continuous with its hacker-style vulnerability scanner.
AAtheris
Atheris is Google's Apache-2.0 coverage-guided Python fuzzing engine, based on libFuzzer, for Python code and CPython native extensions.
BBandit
Bandit is the PyCQA's Apache-2.0 tool for finding common security issues in Python code by building an AST for each file and running security plugins against it.
BBeagle Security
The AI-powered AppSec platform that identifies vulnerabilities with comprehensive penetration tests and provides actionable remediation insights.
BBearer CLI
Bearer CLI is a SAST tool that scans source code and analyses data flows to find, filter and prioritise security and privacy risks, with a commercial Bearer Pro from Cycode.
BBlack Duck
Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams detect vulnerabilities, manage open…
Bboofuzz
boofuzz is a GPL-2.0 network protocol fuzzing framework in Python, a fork and successor of the Sulley fuzzing framework.
B Brakeman
Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications, run from the command line without needing the app to be running.
BBurp Collaborator
Burp Collaborator is a network service that enables you to detect invisible vulnerabilities.
BBurp Suite
PortSwigger offers tools for web application security, testing, & scanning.
CCATS
CATS is Endava's Apache-2.0 REST API fuzzer and negative-testing tool that generates, runs and reports tests for OpenAPI endpoints with no coding.
CCheckmarx
Checkmarx agentic application security software platform Combines Hybrid scanning, AI-powered agents, and unified risk intelligence across every attack surface.
CCheckov
Checkov is an Apache-2.0 static analysis tool for infrastructure as code (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile and more) that also does SCA for images and open-source packages.
CClair
Clair is an Apache-2.0 open-source project from Quay for static vulnerability analysis of application containers (OCI and Docker images), exposed through an API.
CCobalt Strike
Adversary simulation tool for red team operations and security assessments.
CCodeQL
CodeQL is GitHub's semantic code analysis engine: it builds a queryable database from source code and runs security queries (MIT-licensed standard library) to find vulnerabilities, powering GitHub code scanning.
CCodeScan
AutoRabit CodeScan™ secures and optimizes your Salesforce DevOps pipeline by providing real-time static code analysis and continuous compliance.
CCodified Security
Security testing for mobile applications with continuous integration support.
DDependabot
Dependabot is GitHub's automated dependency update service; its MIT-licensed core logic opens pull requests to update vulnerable and outdated dependencies across many ecosystems.
DDependency-Check
OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
Ddetect-secrets
detect-secrets is Yelp's Apache-2.0, enterprise-friendly module for preventing new secrets entering a codebase, detecting committed secrets and tracking them with a baseline file.
DDetectify
Find what's exposed and fix what matters, before attackers do.
DDocker Scout
Docker Scout is Docker's software supply-chain tool that analyses container images, builds SBOMs and gives near real-time, actionable insights and policy checks before images reach production.
DDockle
Dockle is an Apache-2.0 container image linter for security that checks built images against best practices and CIS Docker Benchmark items.
EEndor Labs
Endor Labs is an agentic application security platform for AI-generated and human-written code, covering SCA with reachability, SAST, secrets and container scanning to prioritise real risk.
EEvoMaster
EvoMaster is an LGPL-3.0 open-source tool that uses AI search techniques to generate system-level tests for REST, GraphQL and RPC APIs, in white-box and black-box modes.
FFalco
Falco is the CNCF's Apache-2.0 cloud-native runtime security tool that detects abnormal behaviour in hosts, containers and Kubernetes using system calls and rules.
Fffuf
ffuf is a fast, MIT-licensed web fuzzer written in Go for content discovery, virtual host discovery and parameter fuzzing during authorised security testing.
FFind Security Bugs
Find Security Bugs is the LGPL-3.0 SpotBugs plugin for security audits of Java web and Android applications, also working with Kotlin, Groovy and Scala projects.
FFOSSA
FOSSA is a software supply-chain platform for SBOM generation, software composition analysis, open-source licence compliance and vulnerability management, with a free plan.
Ggarak
garak is NVIDIA's Apache-2.0 LLM vulnerability scanner that probes models and dialog systems for hallucination, data leakage, prompt injection, toxicity, jailbreaks and more.
GGiskard
Giskard offers an Apache-2.0 open-source library for evals, red teaming and test generation for AI agents, plus a commercial Hub for agent red-teaming, evaluation and guardrails.
GGitGuardian
GitGuardian is a credential-layer security platform for secrets detection and remediation across code, CI and collaboration tools, available as SaaS or self-hosted, with a free plan.
GGitHub Advanced Security
GitHub Advanced Security is GitHub's built-in, AI-powered application security suite: code scanning with CodeQL, secret scanning and push protection, dependency review and Copilot Autofix.
GGitleaks
Gitleaks is an MIT-licensed tool for detecting secrets such as passwords, API keys and tokens in Git repositories, files and stdin; it is now feature complete with security-patch-only releases.
GGobuster
Gobuster is an Apache-2.0 Go tool for brute-forcing directories and files, DNS subdomains, virtual hosts and cloud buckets during authorised testing.
GGoogle Nogotofail
Security testing tool for networks, focusing on detecting traffic interception vulnerabilities.
Ggosec
gosec is an Apache-2.0 Go security checker that inspects source code for security problems by scanning the Go AST and SSA representation.
Ggovulncheck
govulncheck is the Go team's BSD-licensed vulnerability scanner that reports known vulnerabilities from the Go vulnerability database only when your code actually calls the affected functions.
GGrype
Grype is Anchore's Apache-2.0 vulnerability scanner for container images, filesystems and SBOMs, covering major OS package ecosystems and language packages.
HHadolint
Hadolint is a GPL-3.0 Dockerfile linter written in Haskell that checks best practices and validates inline bash in RUN instructions using ShellCheck.
HHamming
Hamming tests, red-teams and monitors voice and chat AI agents: simulated calls before launch, failed calls rerun as regression tests, and production monitoring.
Hhonggfuzz
honggfuzz is Google's Apache-2.0 security-oriented fuzzer with evolutionary, feedback-driven fuzzing based on software and hardware code coverage.
IImmuniWeb
AI-driven platform for application security testing and monitoring.
IIntruder
Intruder is an exposure-management platform for lean security teams, combining vulnerability management, attack surface monitoring and cloud security, with a free trial.
IInvicti (formerly Netsparker)
Web vulnerability scanner for automated detection of security issues in web applications.
JJazzer
Jazzer is Code Intelligence's Apache-2.0 coverage-guided, in-process fuzzer for the JVM, based on libFuzzer, with JUnit integration and bug detectors.
JJoern
Joern is an Apache-2.0 code analysis platform that builds code property graphs for C/C++, Java, JavaScript, Python, Kotlin, binaries and more, queried with a Scala-based DSL.
KKali Linux
Home of Kali Linux, an Advanced Penetration Testing Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments.
KKICS
KICS (Keeping Infrastructure as Code Secure) is Checkmarx's Apache-2.0 open-source scanner for security vulnerabilities, compliance issues and misconfigurations in infrastructure-as-code.
KKingfisher
Kingfisher is MongoDB's Apache-2.0 secret scanner and credential response tool in Rust: it detects leaked secrets with hundreds of rules, validates live credentials and maps blast radius.
Kkube-bench
kube-bench is Aqua Security's Apache-2.0 tool that checks whether Kubernetes is deployed according to the CIS Kubernetes Benchmark.
KKubeLinter
KubeLinter is StackRox's Apache-2.0 static analysis tool that checks Kubernetes YAML files and Helm charts against best practices for security and production readiness.
KKubescape
Kubescape is an Apache-2.0 Kubernetes security platform for IDEs, CI/CD and clusters, with risk analysis, compliance frameworks, misconfiguration and vulnerability scanning.
KKushoAI
KushoAI generates API test suites from OpenAPI specs or Postman collections, checks every change against the contract, and adds continuous API security scanning and UI testing.
MMayhem Security
Mayhem is an automated code and API security testing platform that uses fuzzing and AI to generate thousands of tests and report actionable, reproducible findings.
MMend.io
Mend.io is an application security platform covering SCA, SAST, container and AI security, positioned as unifying AppSec and AI security.
MMetasploit
Find security issues, verify vulnerability mitigations & manage security assessments with Metasploit.
MMicro Focus Fortify
A suite of tools for application security, including API security testing.
Mmitmproxy
mitmproxy is an MIT-licensed, interactive, TLS-capable intercepting proxy for HTTP/1, HTTP/2 and WebSockets, with console, command-line (mitmdump) and web (mitmweb) interfaces and Python addons.
NNessus
Find out more about Nessus - the trusted gold standard for vulnerability assessment, designed for modern attack surfaces - used by thousands of organizations.
NNetsparker Cloud (Invicti)
Cloud-based security testing tool for automated web vulnerability scanning.
NNikto
Nikto web server scanner.
N Nmap
Nmap - the Network Mapper.
NNuclei
Nuclei is ProjectDiscovery's MIT-licensed, template-based vulnerability scanner: simple YAML templates, community-contributed checks, multi-protocol support and CI/CD use for regression testing.
OOpengrep
Opengrep is an LGPL-2.1 open-source SAST engine, a fork of Semgrep backed by a consortium of AppSec companies including Aikido, Endor Labs and others.
O OpenVAS
Framework for vulnerability scanning and management.
OOSS-Fuzz
OSS-Fuzz is Google's free continuous fuzzing service for critical open-source projects, running libFuzzer, AFL++ and other engines at scale on ClusterFuzz.
OOSV-Scanner
OSV-Scanner is Google's Apache-2.0 dependency vulnerability scanner and official frontend to the OSV database, covering many languages, package managers, OS packages and containers, with guided remediation and licence checks.
OOWASP Amass
OWASP Amass is an Apache-2.0 tool for in-depth attack surface mapping and external asset discovery using open-source intelligence and active techniques.
OOWASP Dependency-Track
OWASP Dependency-Track is an Apache-2.0 SBOM-driven component analysis platform that tracks components across your portfolio and flags vulnerable, outdated or policy-violating dependencies.
O OWASP ZAP
The ZAP by Checkmarx Core project.
PParasoft SOAtest
Optimize API and web service testing with AI-enhanced SOAtest.
P Paros Proxy
Reviews, ratings, and information about Paros proxy: web proxies, web vulnerability scanners,.
Ppip-audit
pip-audit is an Apache-2.0 PyPA tool that audits Python environments, requirements files and dependency trees for known vulnerabilities using the Python Packaging Advisory Database, and can fix them.
PPolaris
Polaris is Fairwinds' Apache-2.0 tool that validates Kubernetes workloads against best practices as a dashboard, admission controller or CLI.
P Probely
Web vulnerability scanner designed for continuous security testing.
PProwler
Prowler is an Apache-2.0 open-source cloud security platform that automates security and compliance checks across AWS, Azure, GCP, Kubernetes and more, with a CLI and local server.
PPyRIT
PyRIT is Microsoft's MIT-licensed Python Risk Identification Tool for generative AI: automated scans, adaptive multi-turn attacks and human-led red teaming in one toolkit.
QQualys
Discover how Qualys helps your business measure & eliminate cyber threats through a host of cybersecurity detection & remediation tools.
RRESTler
RESTler is Microsoft Research's MIT-licensed stateful REST API fuzzer that infers dependencies from an OpenAPI spec and exercises cloud services to find security and reliability bugs.
RRetina CS (BeuyondTrust)
Network security assessment tool with centralized vulnerability management features.
RRetire.js
Retire.js is an Apache-2.0 scanner that detects JavaScript libraries with known vulnerabilities in web apps and Node.js projects, and can generate an SBOM of the libraries it finds.
SSchemathesis
Schemathesis is an MIT-licensed property-based API testing tool that generates inputs from OpenAPI, GraphQL and gRPC schemas, chains stateful workflows and finds 500s, schema violations and validation gaps.
SSemgrep
Semgrep is a fast static-analysis engine with a free open-source CLI and a paid platform for cross-file rules, supply chain, and secrets.
SSnyk
Snyk CLI scans and monitors your projects for security vulnerabilities.
SSocket
Socket is a software supply-chain security platform that blocks zero-day supply chain attacks in JavaScript, Python and Go dependencies by analysing package behaviour, with a free plan.
SSonarQube
Modernize your AI workflows with code verification for the agentic era.
SSQLMap
Automatic SQL injection and database takeover tool.
SStackHawk
StackHawk is a developer-focused application security testing platform, now positioned as an AI coding agent security platform that finds, fixes and verifies exploitable vulnerabilities; plans from $10 per user per month.
SSyft
Syft is Anchore's Apache-2.0 CLI and Go library for generating Software Bills of Materials (SBOMs) from container images, filesystems and archives, in CycloneDX, SPDX and other formats.
TTalisman
Talisman is ThoughtWorks' MIT-licensed pre-commit and pre-push hook that inspects outgoing changesets for suspicious content such as tokens, passwords and private keys.
TTrivy
Trivy is Aqua Security's Apache-2.0 all-in-one scanner for container images, filesystems, Git repos, VM images and Kubernetes, finding CVEs, IaC misconfigurations, secrets, licences and SBOM data.
TTruffleHog
TruffleHog is Truffle Security's AGPL-3.0 secrets scanner that discovers, classifies (800+ types), verifies and analyses leaked credentials in Git, chats, wikis, logs, object stores and filesystems.
VVeracode
Manage application security risks effectively with Veracode's Application Risk Management platform, built for today's AI-driven world.
W Wapiti
Wapiti is a free and open-source web application vulnerability scanner (DAST).
WWebInspect
Dynamic application security testing tool for identifying vulnerabilities in web applications.
WWfuzz
Wfuzz has been created to facilitate the task in web applications assessments and it is based on a simple concept: it replaces any reference to the FUZZ keyword by the value…
WWiz
Wiz is a cloud security platform that connects code, cloud and runtime into one agentic cybersecurity platform covering posture, vulnerabilities, identities, data and AI security.