AI Security Matrix

Gives an agent a browser that controls its own network traffic, so the model can capture, edit, replay and compare the requests a web app sends without a proxy in between. Each session runs under a network policy and records every fetch it allowed or refused.

Reads a codebase and its commit history, builds a threat model from them, and sends agents to chase each hypothesis it raises. It then tries to reproduce each finding in a sandbox and attacks its own patch to check the fix holds, working from source alone with no running target.

A hunt skill for each web and API bug class, with a dispatcher that reads the scope and loads the ones that fit. Patterns from disclosed bug-bounty reports sit behind each one.

Checks an agent skill before you install it, following the files it pulls in and asking a model whether any of it is trying to misdirect the agent. Each verdict carries the provenance behind it.

Reads an application's source to pick its attack paths, then attacks the running web app and its API through a browser and command-line tools. A finding reaches the report only after it has been exploited.

Rules on whether an agent skill is malicious, with a model judge whose catch and false-positive rates are published against a labelled test set. A team picks a policy and suppresses known findings, so the same skill gets the same verdict on every run.

One SKILL.md per attack surface, reaching into exploit development as well as web, Active Directory and network work. Nothing routes between them; you load the one that fits the target in front of you.

An orchestrator inside Claude Code that runs a team of agents across an internal network and Active Directory engagement. It lays out the paths open to you and you pick one, or it works through them on its own, keeping the engagement's state in one place.

A vendor's application-security skills for a coding agent: it scans source, dependencies and secrets, then confirms a finding against the running app through a proxy before it reaches the report.

Routes an agent handed an APK, a binary, obfuscated frontend JavaScript or a pentest target to the playbook that fits, then sets up the toolchain that playbook needs. Its playbooks also cover Windows identity attacks, beyond the reversing the name implies.

Works on the report an engagement ends in, inside Ghostwriter: it turns a sample Word report into a Ghostwriter template, drafts an executive summary traced back to the findings, and grades whether a finding or report is ready for final delivery. It runs offline on exported report data, or reads a live Ghostwriter over its GraphQL API.

Runs autonomous pentest agents from a self-hosted web console, each inside its own Docker container rather than on the host. You start a task in the browser and watch the agents work it.

A desktop workspace holding the terminal, notes, findings and report in one place, with an approval pause between what the model proposes and what actually runs.

Describes a test suite for an LLM app in a config file and runs it from the CLI or CI, either as a plain eval or as a red-team pass. The declarative file is the point: the same suite reruns on every change.

A library for assembling your own attack rather than a fixed suite: you compose an orchestrator from targets, converters and scorers, and it runs the conversation for you.

Runs from a host you have already compromised: it collects the agent credentials and configuration it finds there, reuses them against whatever AI services are reachable, and records the path it proved.

Runs a red-team engagement from a terminal CLI, with an orchestrator that starts specialist stacks like BloodHound or a C2 server only when the engagement reaches them.

Runs many agents against one scope at once, coordinating through a shared board so a new finding immediately wakes whichever agent it matters to. Written in Go.

A Burp Suite extension that opens the running instance to an AI client, so a model can work through the proxy history and replay requests from the session you already have.

Fires a catalogue of named probes at a model and reports which ones got through, covering jailbreaks, leakage, injection and toxicity. Probes are the unit you pick, the way you would pick scripts in a port scanner.

Finds the agent components already installed on your machine, the MCP servers, skills and agent configs, and scans each for prompt injection and known vulnerabilities.

Keeps an operation replayable: the plan, the approvals, the evidence and the attack-chain model live in one workspace you can re-run afterwards. Built in Go, with its tools served over MCP.

Gathers several separate AI security scans behind one console: the agent, the MCP servers, the skills, the serving infrastructure, and a jailbreak pass against the model itself.

Simulates jailbreaks and injection against an application you have already built, then ships the guardrail that blocks what it found, so the test and the defence come from the same vocabulary.

Judges an MCP server's tool definitions three ways, by YARA rule, by hosted inspection API and by asking a model, so a poisoned tool description has to clear more than one kind of reader.

Covers the widest range of model formats of any of these, emits SARIF for a CI gate, and says plainly where its own analysis was bounded rather than reporting clean.

Twenty-two skills, each carrying a methodology, the commands to run and a template for the write-up, reaching into OT and ICS, mobile and governance as well as the usual ground.

Drives a live pentest against a running web app or API, choosing each probe from what the last one returned, then reports what it found.

Chains recon, exploitation and post-exploitation, then carries a finding further than a report: it writes the fix and opens a pull request on your repository.

Decompiles pickle bytecode back into readable Python, and will rewrite or build one too. The same tool that tells you a model file is malicious is the one that shows you how such a file is made.

An audit firm's review practice published as plugins: how to approach an unfamiliar codebase, what to look at in it, and how to write up what you found.

Puts red and blue agents on the same live infrastructure at once: one side chains Active Directory attacks, the other reads the logs and writes detections back to the dashboard. A single Rust binary.

Packages SpecterOps' own engagement workflow as installable plugins, including the wiring that lets an agent drive BloodHound and Ghostwriter. It assumes you already run those.

A terminal UI for black-box testing that hands the model a real browser alongside the usual command tools, so it can work an application the way a user would.

Runs a second, independent agent whose only job is to re-exploit what the first one claimed, so a finding is either reproduced or dropped. One self-hosted binary with a local dashboard.

Works the defensive side: searches threat intelligence, generates Semgrep rules, puts a STRIDE model into a product spec, and gates a plan before anyone builds it.

Wraps the NetExec CLI as a subprocess and nothing more, across every protocol it speaks. Discovery meta-tools keep its 128 calls out of the model's context until it asks for them.

Installs into Ghidra as an extension and opens its decompiler and symbol table to a model, which can rename methods and data as it works through the program.

Produces the compliance artefact as well as the verdict: a CycloneDX or SPDX bill of materials for a model file, alongside the Keras, GGUF and ONNX payloads it found while reading it.

Drives the investigation from an AI client you already use, over MCP, and hands each claimed exploit to an oracle that has to reproduce it. What survives ships as a capsule you can replay yourself.

Fifty subagents, one per specialism, that Claude routes between on its own as the task moves. Each offensive agent also names the detection its technique would trip.

Ships the Kali toolkit as a container with an HTTP API in front, so the model's commands run in a prepared environment rather than on the machine you started from.

Installs into a Mythic C2 server and operates it from the inside, reasoning over the live callbacks and the BloodHound graph to issue Mythic tasks. It never touches the target itself.

A framework for building your own testing agent rather than a finished one. It supplies the model plumbing, the target connectors and the run limits, and you write the use-case in a few dozen lines.

Reads a saved model file and reports the unsafe calls hiding in it, across pickle, HDF5 and SavedModel, so a download from a public registry can be checked before anything loads it.

Organises its skills along the kill chain and adds a dispatcher that loads at the start of every session, so the scope check and the OPSEC note happen whether or not you remember to ask.

Exposes an open IDA Pro database to an LLM client, so you ask about a binary in chat instead of clicking through the GUI: rename functions, read decompiled code, chase cross-references.

Scans a pickle for the dangerous imports it would execute on load, and will fetch one straight from Hugging Face, a URL or an archive rather than making you download it first.

Probes across text, images and audio rather than prompts alone, and uses reinforcement learning to adapt a multi-step attack as the model's defences respond.

Takes a target and an objective in plain language, then plans and runs the whole job inside a sandbox. A second mode answers questions about a finding without acting on it.