Week of 28 September to 5 October 2026
22 of the 69 tools shipped changes last week, across 805 commits and 45 releases. 1 joined: google/mantis. None left.
Last Week's Highlights
- Armur-Ai/Pentest-Swarm-AI: Pentest Swarm AI can generate and self-verify proof-of-concept exploits end to end with the new --verify-poc scan flag, and the pentestswarm poc command lets you generate or verify a PoC directly.
- h5i-dev/h5i: The websec workbench now speaks grpc, so you can probe grpc endpoints with the same browser-backed policy and receipts used for HTTP targets.
- microsoft/PyRIT: PyRIT adds an A2ATarget so testers can send prompts over the Agent-to-Agent protocol.
Armur-Ai/Pentest-Swarm-AI
v0.2.30 to v0.2.31, 17 commits
Pentest Swarm AI can generate and self-verify proof-of-concept exploits end to end with the new --verify-poc scan flag, and the pentestswarm poc command lets you generate or verify a PoC directly. Confirmed findings now ship with attached safe PoC scripts in the report. Headless-browser recon renders JS and captures the API surface, and authenticated sessions let the swarm reach IDOR, BFLA and ATO surface that needs a login. A negative-control fingerprinting fix stops the swarm from mistaking the wrong app for crAPI during recon. Confirmed findings no longer decay below confirmation, and a tier-weighted confidence gate guards against context poisoning during corroboration. Reports now include a Coverage and Confidence layer. OpenRouter is wired in as an LLM provider, giving access to over 400 models on one key, with per-role model mixing across the swarm.
KeygraphHQ/shannon
2 commits
PDF reports now link each finding ID directly to its detail section, letting you jump from the summary list straight to the full writeup. The pi agent runs its sessions at a high thinking level.
NVIDIA/garak
2 commits
When garak's Hugging Face InferenceClient generator gets a 404 from the InferenceAPI, it now raises a clear error instead of failing silently or with an unclear exception.
PurpleAILAB/Decepticon
v1.2.0 to v1.2.3, 67 commits
Decepticon now exposes itself over MCP, letting coding agents install it as an agent skill and call its plugin bundles and live Blue Cell observations directly. Blue Cell adds a continuous local monitor with CLI alerts, a local web sensor proof of concept, and an autonomous resident investigation watch that verifies telemetry coverage and evidence. Skillogy's skill search now runs a weighted full-text query, and its vector indexes are isolated by embedding dimension so cached vectors stay valid. OPPLAN validates the objective DAG before any mutation and rejects completion while dependencies remain unresolved, with each step backed by versioned evidence. Decepticon exposes October 2026 direct API models in the OSS build.
Tencent/AI-Infra-Guard
v4.6.4, 9 commits
Model calls now carry extra headers and body fields through to the model API. Skill-Scan forwards an optional reasoning effort setting to the model API. Interrupted deepteam red team runs can be resumed instead of restarted. MCP-scan and agent-scan now bound stalled streaming responses so they no longer hang. SARIF output preserves text remediation for valid results. Scanners keep findings during context compaction instead of losing them. RailFence in deepteam no longer crashes with an IndexError when rails is 1 or less. The vendored pikit prompt-injection research toolkit is now included under Research/pikit.
berylliumsec/nebula
118 commits
Nebula adds an opt-in Work hub that tracks agent check-ins and groups project hierarchies, now live by default, with Work conversation links opening directly in chat and Projects serving as the home for Work progress and its board. Codex and Grok harnesses now expose their permission modes directly in Nebula's settings. The code editor renders Markdown previews and lets you search files and folders across Files and Code. Timed goals surface in-turn reminders as they near their limit and raise a handoff warning when they go overdue, with goal hook failures now kept in the model's feedback loop. Project permission modes are explicit, returning policy denials and blocked hook output straight to the model. OpenRouter's zero-data-retention policy can now be set per profile.
cisco-ai-defense/mcp-scanner
4.8.6, 5 commits
mcp-scanner now reports analyzer failures as incomplete scans instead of silent results, so you can tell when a scan did not actually complete. Runtime scanning of prompts and resources now works correctly for MCP bodies, along with the LLM analysis path that inspects them. The behavioral shell injection check for TypeScript has been fixed. The tool_poisoning.yara rule narrows its extracts_from_input match, which stops false positives on email search tools.
confident-ai/deepteam
1 commit
Merge commit only. Nothing changed in the tool.
dreadnode/ares
3 commits
Three dependency bumps. Nothing changed in the tool.
google/mantis
12 commits
Mantis adds an MCP server so you can run it inside a secure dev loop. Single-file scans now scope their threat models to just that file. A new structural index toolset gathers eval evidence directly from the codebase. Mantis rejects finding citations it can prove false. Mantis closes the two remaining threat-model leak paths. Mantis anchors finding paths at the repository root. Mantis scopes findings by campaign and stamps verdicts by finding id. The ResilientLiteLLMClient now supports streaming retries, so scans recover from dropped streams.
h5i-dev/h5i
v0.4.8, 16 commits
h5i app adds seven subcommands, extract, check, prove, lint, mutate, doctor, and new, for working directly with target artifacts. The websec workbench now speaks grpc, so you can probe grpc endpoints with the same browser-backed policy and receipts used for HTTP targets. websec validates cookie jars and supports per-set create, so each request set carries its own verified cookie jar. agent-browser now runs through a proxy you specify. The rendering engine ships inside the main h5i binary now, and h5i browser execs itself to become the engine, replacing the separate h5i-browser-light archive it used to require.
microsoft/PyRIT
55 commits
PyRIT adds an A2ATarget so testers can send prompts over the Agent-to-Agent protocol. MessageToolCallScorer scores tool calls recorded in stored messages, and LayaRefusalScorer runs a local CPU refusal check without calling an external API. A new Grid composite converter combines multiple converters into one transformation. Attack runs now correlate conversations across an attack's full set of turns. Scale scorers retry when a judge returns an out-of-range score instead of failing the run. HTTP targets now store decoded response text, and JSON keys may contain digits or hyphens. PromptTemplateConverter replaces TaskFramingConverter, which is deprecated. If you script it, TaskFramingConverter is now PromptTemplateConverter.
promptfoo/modelaudit
modelaudit-picklescan-v0.1.11 to v0.2.53, 28 commits
modelaudit now inspects hidden ZIP archives and malicious pickle payloads inside legacy GGML model variants. The scanner stops flagging a ZIP polyglot on GGUF or GGML files whose tensor data merely contains an end-of-central-directory signature, and picklescan no longer raises false positives on scalar storage pickles. Scan output and diagnostics now preserve raw evidence from each scan. Model-card network alerts now survive when documented image examples contain code outside the reviewed generated forms. Docker runtime images carry upgraded gzip, PCRE2, SQLite, Perl, and util-linux packages, closing CVE-2026-53615, and locked AnyIO and GitPython versions were bumped to address dependency audit advisories.
promptfoo/promptfoo
158 commits
Promptfoo now tests Claude Sonnet 5.5 and GPT-6.1 Sol and ultrafast models, and it can resume paused Claude server-tool turns mid-conversation. Coding agent providers now run in isolated workspaces. The --filter-metadata flag accepts comma-separated OR values, including a literal comma inside a value. Model catalogs, routing and per-model costs have been reconciled across providers, and recent model catalog gaps are filled in. A target error that stops an eval now fails the CLI exit code instead of passing. Per-call cache overrides and per-call Claude usage are now honored and reported correctly. WatsonX, Langfuse, Slack, OpenAI Agents, Codex Security, browser, and local Transformers SDKs are now opt-in installs. Promptfoo shows the install command when one is needed.
samugit83/redamon
123 commits
Recon can send four AI-driven hooks, page type classification, FFuf base path generation, tool health checks and crawl seed ordering, to TypeSafe Jev instead of the LLM, chosen per hook via a settings flag, with a preflight showing each hook's effective engine. Recon presets and project rescope now run over MCP, alongside mute_findings, unmute_findings and search_muted_findings for muting findings through MCP. Node tables show a Node ID and a Mute column, and the node drawer lets you copy a node's context, start an agent session, mute or delete it. Redamon closed three tenant-isolation holes in the graph query scope. Findings from nmap, Nuclei, TruffleHog, GVM and httpx are no longer dropped when a scan crashes, times out or gets throttled.
snyk/agent-scan
v0.6.8, 11 commits
Scan now discovers MCP servers that editor extensions register directly in code, in addition to config files, when scanning VS Code. The extension MCP provider scan is gated per fork so it only runs where applicable.
trailofbits/fickling
2 commits
Two dependency bumps. Nothing changed in the tool.
trailofbits/skills
2 commits
Static analysis now scans files larger than 1 MB instead of skipping them outright. Any files still skipped after that are reported by name, so you can see what the scan did not cover.
usestrix/strix
v1.7.0, 78 commits
Strix lets the verified user define and change scope mid-chat during a run. A budget_policy=pause setting parks every agent at the cost limit until the operator resumes it. Running strix --resume with no run name opens an interactive picker over prior runs. The --fail-on severity threshold now applies regardless of how the run ended. finish_scan report fields no longer require a leading section heading. The CLI runs headless instead of crashing the TUI when no terminal is attached. Docker connection failures now report the endpoint and the raw error instead of per-platform cause tables.
vxcontrol/pentagi
v2.2.0, 7 commits
PentAGI adds Bedrock provider configuration, so you can run agent flows against Bedrock-hosted models. Flow creation now retries on a second configured provider when the first fails, instead of failing the run. Knowledge management validates and handles documents more carefully before indexing them. The installer detects the host stack correctly, and its proxy and port documentation is fixed.
xalgorix/xalgorix
v4.6.118 to v4.6.147, 68 commits
ReDoS testing now runs as a single bounded probe held until other planned work and reconnaissance finish, and a finding only counts complete once a probe actually returns. XXE file-read findings now require repeated, controlled differential evidence, so raw reflection, parser errors, blocked substitutions and unstable content fail closed instead of confirming. SQLi verification is now deterministic, and CSRF findings no longer confirm from HTTP acceptance alone. Wildcard scans run the same shared methodology as standalone scans, with public-suffix-aware discovery roots and the operator's target and root now mandatory inventory members that survive filtering. Scans against dead targets now end with a typed target_unresponsive reason after a bounded unresponsive streak, and a wedged exec channel returns a THROTTLE result within ten minutes instead of hanging for hours. Settings can be exported and imported as a JSON backup for migrating an install.
zebbern/zebbern-kali-mcp
21 commits
Thirteen new guards now check persistence and PTY behavior, added after running inside a live container surfaced failures the test suite missed. PTY sessions get a single file descriptor lifecycle, so sessions survive a server restart. Request loops are now bounded, and a timeout that had gone unread is now resolved. Tools that used to answer a question they had not asked now only answer what was asked. A round of fixes addressed a field report's defects, after ruling out six reports that were not actual defects.
What is a highlight?
Each week an AI model reads every entry and picks up to three changes that matter most to the people running these tools. It looks for these, most important first. Each highlight quotes the sentence from the tool's entry that shows the change, with the sentence before it when it needs one.
| 1 | The tool can run a test, technique or attack it could not before, or reach a new kind of target. |
| 2 | The tool produces a new kind of output a tester can hand on, such as an attack map, a report or verified proof of a finding. |
| 3 | The tool's results can be trusted where they could not before: findings are now verified, or a fix corrected results that were wrong. |
| 4 | The tool tests more of a target than before: more vulnerability classes, more hosts or roots, more of a methodology. |
| 5 | The tool keeps a test inside its scope or rules of engagement in a way it could not before. |