#devsecops

Real-time secret-leak guardrails for AI coding agents (Claude Code, Codex), Git hooks, and CI.

Eight security skills for Claude Code with no dependencies: standard library only, tested, and usable as a CI step. Secret scanning, Python SAST, prompt-injection testing, plus HTTP, JWT, Dockerfile, CORS and dependency auditing.

Open-source server that refuses vulnerable package installs. The backend the refuse CLI shim calls.

Dual-track AI reference architecture: RAG system design & AI Security Engineering (EN/ZH) | 双轨 AI 参考架构：RAG 系统设计与 AI 安全工程

Find where agent-controlled intent reaches consequential actions without an authority check. Python + TypeScript + Go. Zero-dependency SAST for AI agents.

Turn any public AI coding CLI (Claude Code, Codex, Gemini, Cursor, Cline, Aider, opencode) into your company's internal, audit-grade, white-labeled launcher — one structured interview, 15 cyber controls, 30+ audit rules, compliance .docx, universal cost tracking.

Offline, no-AI "safe to ship?" gate for vibe-coded apps — finds the security mistakes AI coding agents make (secrets, unprotected routes, eval-RCE, SQLi, CORS, JWT, leaked keys). CLI + MCP, agent-runnable.

Welcome to OMEN. The offline command-line interface that watches your code—scanning secrets, testing APIs, and decoding tokens.

Claude Code scaffold for building AI platforms securely — agent/LLM security, Kubernetes, SRE, observability, identity, and supply chain, grounded in published framework canon (OWASP, NIST, CIS, SLSA). Data-science lanes included.

The complete security auditor for Claude Code — web, API, mobile, cloud, wireless, code, secrets, dependencies, IaC, containers and LLM apps. Token-optimised, exploitation-ranked, self-updating.

Autonomous AI-powered defensive auditor for web infrastructure, TLS posture, and application hardening using Google Gemini & Anthropic Claude.

Make agents prove their work. Independent verification, deterministic quality gates, and signed evidence for AI-generated code.

Cross-agent security & quality hardening engine for Claude Code, Codex, and Gemini CLI. Enforces user-authored playbooks, verifiable evidence gates, and auditable readiness reports.

Evidence-first source security scanner for human-written and AI-generated code. Rust CLI with AST review, bounded taint, explicit coverage, JSON/SARIF, and agent workflows.

Policy-as-code admission controller for AI agent skills and MCP tools. SkillBOM, lockfiles, and supply-chain baselines.

Claude Code plugin for Signetry: a PreToolUse guard that blocks out-of-scope/forbidden agent actions before they happen, plus the Signetry MCP server and /signetry:admit skill. Split from signetry-plugins.

Read-only local security gate & scanner for AI coding workflows, MCP, and package hallucination risks.

Open-source Claude Code plugin marketplace packaging a full AI software-development team — architecture, implementation, testing, database migrations, security/DevSecOps, code review, deployment planning and release preparation — as versioned, installable skills and agents.

OpenAI Codex integration for Signetry: MCP server + lifecycle-hook guard to govern coding-agent changes. Split from signetry-plugins.

Diff AGENTS.md, CLAUDE.md, Cursor rules and MCP server configs between git refs; flag new MCP servers, widened permissions, removed guardrails and hidden Unicode. TypeScript CLI + GitHub Action.

Local-first security release checker for authorized code, AI apps, freelancers, and small teams

Evidence-based multi-pass repository audits for Codex, Claude Code, and Agent Skills-compatible coding agents.

Put risky Claude Code and Codex actions back in front of a human — local-first approval gates, secret redaction, and replayable audit trails.

A purple-team of AI agents that audits code security and proves findings by execution — not by opinion.

Stops the insecure prompt before your AI agent runs it - and audits what it already shipped. Deterministic Claude Code guardrail (no LLM) catching "disable RLS" or "service_role in the frontend" in en/es/pt, plus a read-only scanner for exposed secrets, open Supabase RLS and Firebase leaks.

Fail-closed control plane for agentic SDLC. Portable skills, evidence ladder, SPIFFE/WIMSE identity. Intent is not a grant.

Runtime firewall for AI agents: blocks secret exfiltration and destructive commands at the tool-call level. Works with Claude Code hooks and any MCP server.

A database guardrail proxy: blocks destructive SQL by real blast-radius, not just keyword shape. Freeze mode, tamper-evident audit, MCP-native for AI agents.

Security review skill for Claude Code, Codex and Opencode that reports only exploitable findings: every candidate goes through a separate refutation pass. Code, branch diffs, Kubernetes, Terraform, CI/CD, AI agents.

Zero-dependency CLI & AI Agent Security Auditor for Domain HTTP Headers, SSL Certificate Transparency (crt.sh) & Base EVM Smart Contracts.

Agent skills for running security scans — secret scanning (gitleaks), dependency CVE audit (npm/cargo/osv), SAST (semgrep), and a composed pre-release gate. Grounded SKILL.md runbooks for Vanta / Claude Code / any skill-aware agent. MIT.

Security scanner for AI-generated code — GitHub Action + CLI wrapping Semgrep, Gitleaks, and an AI-agent-specific rule pack.

GitHub Action + CLI for replayable CI/PR/release gate decisions - zero-config Self-Test turning checks, scanners, and AI-agent signals into deterministic, tamper-evident PASS/WARN/BLOCK records. Read-only, zero dependencies, Apache-2.0.

ServiceNow -> Jira -> GitHub PR automation: AVIT vulnerability findings become Jira issues, then LLM-generated fixes become PRs.

Fails your CI when an AI coding agent disables Supabase Row Level Security, widens a Postgres grant, exposes a service_role key, or skips Stripe webhook verification. Zero-dependency Node CLI and GitHub Action, 22 rules.

Universal Pre-Launch Security (Low-to-Critical) & UI/UX Design Bug Finder + 6-Stage Adversarial Audit Loop for Vibe-Coded Apps (Claude Code, VS Code Copilot, OpenAI Codex, Cursor, Windsurf, Gemini CLI)

VS Code extension: inline MCP config security diagnostics (mcp.json / claude_desktop_config.json), free, powered by sentinel-scan-cli's OWASP-mapped heuristics