Week of 21 to 28 September 2026
19 of the 68 tools on the list moved last week, across 804 commits and 59 releases. 3 joined, GhostManager/ghostwriter-skills and KeygraphHQ/shannon and h5i-dev/h5i. None left.
Last Week's Highlights
- AIPentest/CyberStrikeAI: CyberStrikeAI now audits non-allowlisted tool calls through TypeSafe Jev, a human-in-the-loop backend that receives the tool name, arguments, and policy in one request and returns a structured pass or block decision instead of relying on chat model JSON.
- microsoft/PyRIT: Scorer evaluation identity is now order-independent for commutative scorers, a breaking change to how those results are computed.
- berylliumsec/nebula: Nebula now reports native provider refusals, blocks and output limits instead of returning empty replies, and sends malformed tool calls back to the model instead of failing the turn.
AIPentest/CyberStrikeAI
v1.7.20, 6 commits
CyberStrikeAI now audits non-allowlisted tool calls through TypeSafe Jev, a human-in-the-loop backend that receives the tool name, arguments, and policy in one request and returns a structured pass or block decision instead of relying on chat model JSON. Built-in rules approve authorized pentest activity by default and only block live-system destruction, irreversible data loss, account or ACL changes, and config tampering, with custom org policy layered on top and the OpenAI-compatible reviewer still available as an option. Runtime storage now gets cleaned up with per-category retention. A fix removes duplicate token limits during summarization, and another fixes exit and transfer handling for Eino on AgenticMessage state.
Armur-Ai/Pentest-Swarm-AI
v0.2.19 to v0.2.29, 51 commits
Every run now produces an interactive attack-map, an HTML rendering plus a JSON export, and the graph models an SSRF-to-cloud-credential path through IMDS to the objective. The graph itself is built from real swarm findings and includes a most-likely-path planner, with the planned attack path surfaced in the report. Exploit chains are now a first-class concept: an embedded library of 13 CVE-tied chains, a chain CLI with list, info and run, and an on-demand updater via chain update and chain pull. Chain Forge can draft exploit chains from an advisory, using a new Muse Spark provider. Adaptive attack-path scoring via the jev-adaptive flag now streams its full scoreboard to the live view, and cross-finding kill-chains get mapped to MITRE ATT&CK technique names in reports.
GH05TCREW/pentestagent
1 commit
One dependency bump. Nothing changed in the tool.
PurpleAILAB/Decepticon
v1.1.45 to v1.1.47, 10 commits
Soundwave's interview now caps at 8 questions, down from around 18. The rules-of-engagement check now honors signed root URLs in both web fetch and sandbox egress, which changes what it allows through in those paths. Benchmark runs now record reproducible provenance for each run. Streaming persists event times for sub-agent runs.
Tencent/AI-Infra-Guard
v4.6.3, 4 commits
skill-scan now forwards an optional reasoning effort setting to the model API, so requests can carry that parameter through to the model. DeepTeam writes finished test cases to disk during a run, giving you the results on disk even if a run doesn't complete cleanly. API Checker refills failed fingerprint samples for more reliable model identification and adds support for Claude 5 signatures. Prompt-Eval gets rate-limit aware backoff, a circuit breaker, and process-group termination, and shares its rate-limit counter between the breaker and the model so both back off from the same signal. A prompt-injection research toolkit called pikit was added under research.
berylliumsec/nebula
243 commits
Nebula caps working context at 200,000 tokens on large windows, compacts long conversations mid-turn or in the background so the next turn doesn't wait, and reports which limit is binding the context window. It now scales the default output budget from the model's own limit instead of a flat 2,048 tokens, and caps that budget at a quarter of the context window. The delegating model or an operator can now set subagent reasoning effort, with delegated subagents defaulting to low effort; operators can also cap how many subagents run, unlimited unless a limit is set. Nebula now reports native provider refusals, blocks and output limits instead of returning empty replies, and sends malformed tool calls back to the model instead of failing the turn.
dreadnode/ares
3 commits
Three dependency bumps. Nothing changed in the tool.
h5i-dev/h5i
v0.4.6 to v0.4.7, 17 commits
h5i websec now prints text by default instead of its previous output format. The plugin gained nuclei support, and the commits describe improvements to its bug detectors and to recon, though not what changed in them specifically. The browser component was also revised, again without detail on what moved. Installation falls back to a user directory when sudo is unavailable, so a machine without sudo access no longer blocks the install step. The h5i project itself picked up durable findings, evidence, checklists and reports as part of its workflow, alongside a documented impact-first bug bounty process.
hypnguyen1209/offensive-claude
3 commits
The web pentest module gains checks for auth and session testing gaps, flagged by the project's review agent. The commits don't say which specific gaps are now covered, only that this landed as part of the offensive auth and session testing work. No other functional changes went in last week.
microsoft/PyRIT
93 commits
Scorer evaluation identity is now order-independent for commutative scorers, a breaking change to how those results are computed. Simulated conversation prompts are now normalized to SeedPrompt objects, also marked breaking. Krippendorff's alpha no longer returns NaN for unpairable identical ratings. PromptInject run summaries report the canonical technique identity instead of a raw one. The JBB-Behaviors loader now seeds attacks from the Goal field rather than the Behavior label. Scenario resume no longer creates duplicate attacks when its history file cannot be read. The report printer adds a format flag for pretty, json, or html output, plus an output flag to write it to a file.
mpgn/NetExec-mcp
v1.0.4 to v1.0.5, 3 commits
The smb_sccm tool drops its method parameter; calls passing method="wmi" now fail, since upstream turned --sccm into a plain flag. WMI-based SCCM dumping moved to a new wmi_sccm tool. Seven other new tools track that same NetExec update: ftp_cat reads a remote file's contents, smb_get_folder downloads a directory recursively, mssql_dpapi and wmi_dpapi dump DPAPI secrets with cookies/nosystem modes plus mkfile and pvk, mssql_db_hash pulls local database login hashes, and mssql_list_backups lists backup paths. winrm_dpapi's dpapi flag now takes the same cookies/nosystem modes instead of being a plain switch. smb_ntds gained a just_trust_keys option, though trust keys were already part of a normal ntds dump. The new upstream shadow-creds module for KeyCredentialLink add/clear is not wrapped. Tool count is now 135.
mrexodia/ida-pro-mcp
14 commits
The tool now prints a banner recommending ida-mcp as a replacement. Search and instruction queries match sign-extended immediates, which they previously missed. Passing count=0 to entity_query and type_query now returns every result instead of a smaller set. A blank IDA_MCP_URL is treated as unset rather than used as a literal download base, and the idalib supervisor now falls back to defaults when IDA_MCP_* environment variables are blank. JSON-RPC calls no longer attempt to JSON-decode string arguments when the parameter type is a union that includes str. The installer keeps IPv6 brackets intact when generating transport URLs, and uninstalling against an IDA Free install is no longer blocked.
msoedov/agentic_security
5 commits
The audio generator now removes the temporary file when gTTS save fails, so a failed save no longer leaves stray temp files behind. The remaining commits fix a self-referential type annotation and a CI poetry installation path. Nothing else changed in the tool.
promptfoo/promptfoo
118 commits
Redteam runs now honor an explicitly configured redteamProvider in the iterative, crescendo and iterative:tree strategies, and the grader report now names the actual turn it flagged instead of a different one. Assertions using the not- prefix now work correctly against model-graded-closedqa and factuality, and inverse RAG scores are clamped to the documented 0 to 1 range instead of falling outside it. Provider model names that include colons are preserved when read from provider paths rather than being truncated. Grok 4.7, GPT-6 Sol and Luna, and Claude Opus 5.5 are now supported as providers, and Bedrock's GPT-6 Sol and Luna are treated as reasoning models. JUnit output sanitizes invalid XML characters and keeps sanitized name identities stable across reports.
samugit83/redamon
49 commits
The recon pipeline adds five web cache poisoning checks: auth-aware cache deception (class 10), an unauthenticated cache-purge endpoint check (class 14), a blocked-vs-allowed WAF payload differential (class 13), cache-key normalization (class 9), and fat-GET parameter cloaking (class 8). The http_request_smuggling agent skill is unblocked and gains CL.0/0.CL desync, HTTP/2 downgrade, Expect and byte-mutation fuzzing, and client-side desync steps. Partial recon now covers every root of a Domain-batch project across discovery, passive URL, vuln, port, HTTP, OSINT and Tlsx tools, replacing the one-root narrowing. A new Mute Rules feature lets you save, load and apply presets for rule-based muting, and the MCP server can no longer unmute a finding through a verdict.
snyk/agent-scan
v0.6.7, 10 commits
The scanner now discovers Claude Desktop on Linux, in addition to whatever platforms it already covered, and reports Claude Desktop connectors under the guard checks. It also discovers Claude Desktop plugins. Two fixes affect binary resolution: relative Codex MCP binaries now resolve correctly, and signed binaries found via PATH are now verified. An anyio dependency bump landed alongside these but changes nothing in the tool's behavior.
trailofbits/skills
2 commits
Two dependency bumps to ruff. Nothing changed in the tool.
usestrix/strix
5 commits
Agents can now delete a vulnerability report they filed, letting them retract findings from the scan output. Blank tool-call ids in the conversation history get filled in, so strict LLM providers accept the history instead of rejecting it. LLM calls now produce a structured per-attempt log that includes provider request ids, so you can trace an individual request back to the provider. MCP connections initialize lazily rather than at startup.
xalgorix/xalgorix
v4.6.85 to v4.6.117, 167 commits
Coverage enforcement tightened across the agent. Model-authored plans now enforce class coverage with logged wave deferrals, recon runs before exploitation, and the planner enforces unconditional coverage of every vulnerability class. The full 22-phase checklist is restored as the default methodology, and coverage-floor task skips now require a justification note. Malformed tool output triggers a hard context reset and is classified as recovery rather than error, with the resilience threshold set to 10 and a protocol reset at 5. Operator credentials are scrubbed from terminal and Python environments, and default credential testing is allowed when no operator account is supplied. Per-specialist toggles are now configurable via XALGORIX_DISABLED_SPECIALISTS, including from the dashboard's Environment settings.
What is a highlight?
Each week an AI model reads every entry and picks up to three changes that matter most to the people running these tools. It looks for these, most important first. Each highlight quotes the sentence from the tool's entry that shows the change, with the sentence before it when it needs one.
| 1 | The tool can run a test, technique or attack it could not before, or reach a new kind of target. |
| 2 | The tool produces a new kind of output a tester can hand on, such as an attack map, a report or verified proof of a finding. |
| 3 | The tool's results can be trusted where they could not before: findings are now verified, or a fix corrected results that were wrong. |
| 4 | The tool tests more of a target than before: more vulnerability classes, more hosts or roots, more of a methodology. |
| 5 | The tool keeps a test inside its scope or rules of engagement in a way it could not before. |