Australian businesses are installing agent skills and MCP servers written by strangers on GitHub, then giving them access to code, inboxes and client data. Here are 11 open source tools that audit code, find vulnerabilities, run AI pentests and check the agents themselves, with our honest take on each.
When your developer types one command to add a "skill" to Claude Code, Codex or Cursor, they're handing a stranger's instructions to software that can read your repo, run terminal commands and call your APIs. Same with MCP servers, the plug-ins that connect AI agents to your tools and data.
Most of the time it's fine. Some of the time it isn't. NVIDIA's SkillSpector team says that in a research set of 31,132 skills, 26.1% contained vulnerabilities and 5.2% showed likely malicious intent. Their number, not ours, but it's a useful reality check.
The security community has been busy. We checked every repo below on 23 October 2026. Each one exists, sits under the organisation you'd expect, and the star counts are current. Stars measure popularity, not safety. The cards under each tool are the live GitHub repository previews.
| # | Tool | What it is for | Licence | Stars |
|---|---|---|---|---|
| 1 | Cloudflare Security Audit Skill | Repeatable code audits inside a coding agent | MIT | ~40k |
| 2 | NVIDIA SkillSpector | Scan a skill before you install it | Apache 2.0 | ~21k |
| 3 | Snyk Agent Scan | Find agents, skills and MCP servers already on a machine | Apache 2.0 | ~3.2k |
| 4 | Cisco AI Defense Skill Scanner | Scan shared skills in CI before merge | Apache 2.0 | ~2.6k |
| 5 | SAST Skills | Cheap first-pass static scan from a coding assistant | MIT | ~1.3k |
| 6 | Strix | AI pentest of a running app, with proof of concept | Apache 2.0 | ~71k |
| 7 | Shannon | Source-aware web and API pentest. No exploit, no report | AGPL-3.0 | ~49k |
| 8 | PentAGI | Self-hosted multi-agent pentest, including local models | MIT | ~32k |
| 9 | PentestGPT | Staged pentest co-pilot, with published research | MIT | ~16k |
| 10 | HexStrike AI | MCP server that hands an agent 150+ offensive tools | MIT | ~13k |
| 11 | PentestAgent | Black-box and bug-bounty agent, with a human in the loop | MIT | ~3.2k |
Star counts are as of October 2026.
These tools either turn your coding agent into a security reviewer, or check the skills and MCP servers you're about to install. If you only read half of this article, read this half.
Turns your coding agent into a structured security auditor. It runs six phases: reconnaissance, bug hunting, validation by a separate agent that tries to disprove each finding, structured output, independent re-verification and a final report. Cloudflare says it's the skill that seeded its own internal vulnerability discovery harness.
Dev teams and agencies that own a codebase and want a repeatable audit.
Where we'd start for code review. The agent that checks a finding is never the one that found it, and severity needs real impact. Two caveats. It wants a sandbox with networking switched off before it executes target code. And Cloudflare says a single run found roughly half of what repeated runs found, so budget for several passes and the model costs.
Licence: MIT. Stars: about 40k as of October 2026.
Scans AI agent skills before you install them. It checks a repo, URL, zip or folder against 71 patterns across 17 categories, including prompt injection, data exfiltration, privilege escalation, supply chain risk and MCP tool poisoning. Static analysis first, optional LLM review second, dependency lookups against OSV.dev, and a 0 to 100 risk score.
Anyone whose staff install skills, from a solo developer to an IT team.
If your team uses skills at all, put this in the install process. NVIDIA uses it in its own pipeline for vetting skills, which is a decent sign it's built for real use. A low score isn't a guarantee, though. A clever attacker writes instructions that look boring. It catches the obvious and the lazy. A human still reads anything touching credentials.
Licence: Apache 2.0. Stars: about 21k as of October 2026.
Finds the agent harnesses, MCP servers and skills already installed on a machine and scans them for prompt injection, sensitive data handling and malware hidden in natural language. It grew out of Invariant Labs' MCP-Scan research.
IT teams who want to know what's actually running on developer laptops.
Great for the "what have we got?" audit, which is where we start with most new clients. Read the README warning: to get tool descriptions, it starts the MCP servers in your config. Scanning an untrusted server can run that server, so do it in a container or throwaway VM. Snyk also calls the CLI output experimental.
Licence: Apache 2.0. Stars: about 3.2k as of October 2026.
Checks third-party agent skills for prompt injection, data exfiltration and malicious code before installation, using pattern rules, dataflow analysis and an optional LLM judge. Outputs SARIF and ships a GitHub Actions workflow and pre-commit hook.
Teams keeping shared skills in a repo who want every change scanned in CI.
We like that Cisco is honest. The README calls it "best-effort" and says no findings doesn't mean no risk. That's the right attitude for this whole category. Pairing it with SkillSpector isn't overkill for skills with real permissions. Minor note: the licence file says Apache 2.0 but GitHub doesn't auto-detect it, so procurement may ask.
Licence: Apache 2.0. Stars: about 2.6k as of October 2026.
Turns your coding assistant into a static code scanner. One skill maps the architecture, then 13 detection skills run in parallel for SQL injection, XSS, RCE, SSRF, IDOR, JWT flaws, missing authorisation, business logic bugs and more, before a final severity-ranked report. Works with Claude Code, Codex, OpenCode and Cursor.
Small dev teams and freelancers wanting a cheap first-pass review.
Simple, which counts for a lot. The business logic check is the interesting part, because traditional scanners miss those bugs. But it's one maintainer (security researcher Utku Sen), the last commit was April 2026, and you copy your project into its folder. Fine for a review, not a pipeline tool.
Licence: MIT. Stars: about 1.3k as of October 2026.
This half is different. These tools attack running systems: real requests, real exploit tools, sometimes real changes to data. Powerful, and easy to misuse, even by accident.
Read the legal section before running any of them. Point them only at systems you own, or systems you have written permission to test.
Teams of AI agents that run your app, probe it like an attacker and validate findings with working proofs of concept, then suggest fixes. Runs locally in Docker with your own model key, and plugs into GitHub Actions.
Dev teams who want security testing more often than an annual pentest.
The most popular project here by a mile, and it earns it on usability. Proof-of-concept validation cuts the false positives that make people ignore scanners. But "autonomous AI hackers" is marketing. It does the grunt work of a pentest, not the judgement. We'd run it against staging on every release and still book a human tester for anything holding customer data.
Licence: Apache 2.0. Stars: about 71k as of October 2026.
An AI pentester for web apps and APIs that reads your source code, works out attack paths, then runs real exploits to prove them. Its rule: "no exploit, no report."
Teams testing an app whose source code they have.
That rule is the right instinct. Nobody needs another report full of maybes. Take the README seriously: it can create users, submit forms and change application state. Never point it at production. The licence is AGPL-3.0, which matters if you modify it and offer it as a service, and the advanced features sit in paid editions.
Licence: AGPL-3.0. Stars: about 49k as of October 2026.
A self-hosted multi-agent pentest system. You describe a target and goal; specialised agents plan the work, run 20+ tools like nmap, Metasploit and sqlmap in an isolated Docker sandbox, remember what worked and write a report. Supports local models through Ollama or vLLM.
Security engineers and red teams who want everything on their own infrastructure.
Local model support is the draw for regulated Australian firms, because findings never have to leave your servers. It's a substantial install (Docker Compose, PostgreSQL, optional Neo4j), so it's a job for a specialist. Built by VXControl, a Dubai-based security company, with commercial enterprise features.
Licence: MIT. Stars: about 32k as of October 2026.
An agent framework that works through a pentest in stages (discovery, vulnerability identification, reporting) and can drive Claude Code or Codex to run tools. It began as research published at USENIX Security 2024.
Pentesters, students and CTF players who want an AI co-pilot.
The elder statesman here, created in early 2023, with peer-reviewed research behind it. That's worth something in a category full of brand-new repos. It leans towards capture-the-flag work, and the last push was July 2026. A good assistant for a skilled tester, not something to hand a non-specialist.
Licence: MIT. Stars: about 16k as of October 2026.
An MCP server that lets AI agents run more than 150 security tools for pentesting, bug bounty and research. In plain terms, it hands an agent an entire offensive toolkit.
Experienced offensive security people who already know those tools.
Handle with gloves. Shortly after its 2025 release, Check Point reported criminals on underground forums discussing using it against fresh Citrix NetScaler flaws, though Check Point said it had no proof the tool was actually used in attacks. That's not a reason to ban it. It's a reason to run it only in an isolated lab, against your own systems. It's also a textbook case for MCP server security: wire this into a general-purpose agent and one prompt injection could aim it at the wrong target.
Licence: MIT. Stars: about 13k as of October 2026.
An agent framework for black-box testing, bug bounty and red teaming, with single-instruction, autonomous, multi-agent "crew" and guided interactive modes, plus prebuilt attack playbooks. Works with any LiteLLM-supported model and can run tools in Docker, including a Kali image.
Bug bounty hunters and pentesters testing from the outside.
The interactive mode is the smartest feature, because a human stays in the loop on every step. Smaller community, rougher edges. Use the Docker option every time. Running Kali tools straight on your work laptop is how a test turns into an incident.
Licence: MIT. Stars: about 3.2k as of October 2026.
The Part 2 tools don't know whose server they're pointed at. You do. Part 10.7 of the Criminal Code Act 1995 (Cth) covers computer offences, including unauthorised access, modification or impairment with intent to commit a serious offence (section 477.1) and unauthorised access to or modification of restricted data (section 478.1). "The AI did it" won't help you.
Get a written scope before any active test, and check your hosting and SaaS terms, since many ban testing without notice. Testing your own staging server from your Sydney CBD office is fine. Pointing Strix at a competitor's checkout page is not.
The Essential Eight is still the baseline most Australian businesses are measured against, and two controls map straight onto AI agents.
On 15 October 2026 the Australian Signals Directorate also launched ASD Essentials, an evolution of the Essential Eight aimed first at government, critical infrastructure and large organisations. ASD will maintain both during the transition. Smaller businesses can keep targeting the Essential Eight. Larger ones should start a gap analysis.
Read the ASD Essentials announcement
If an agent can read customer records, it's handling personal information under the Privacy Act 1988 and the Australian Privacy Principles. The OAIC's guidance on commercially available AI products recommends against putting personal information, especially sensitive information, into publicly available AI tools. A malicious skill sending data offsite is a data breach, and if serious harm is likely, the Notifiable Data Breaches scheme applies. Pentest reports are a map of your weaknesses, so store them like one.
OAIC guidance on commercial AI
Notifiable Data Breaches scheme
Mostly, especially those from Cloudflare, NVIDIA, Snyk and Cisco. But they're still code you didn't write, and some run other code to do their job. Sandbox them, pin versions and treat output as a lead, not a verdict.
No. They're fast and broad, and Strix and Shannon cut false positives by proving exploits. They're weaker on business context and judging real-world impact. Use them between human pentests, not instead of them.
MCP servers connect AI agents to your email, files, CRM and code. A poisoned one can feed the agent hidden instructions or quietly move data out. If your team uses Claude, Cursor or similar tools with plug-ins, you already have MCP servers, approved or not.
Yes, on systems you own or have written permission to test. Unauthorised testing can be an offence under Part 10.7 of the Criminal Code Act 1995 (Cth), whether a person or an agent sends the requests.
We put AI agents to work inside Australian businesses, and we show the controls that make them safe to keep. That includes auditing what's already there: the skills, MCP servers, permissions and data flows your team set up, often without anyone writing it down.
Whether you're in North Sydney, Parramatta, the Northern Beaches or elsewhere in Australia, we can give you a straight answer on your AI agent and MCP setup: what to fix, what to keep and what to switch off.
Get expert guidance on implementing ai security solutions for your Australian business
