capability

High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.

Fast service fingerprinting CLI for 170+ protocols (TCP/UDP/SCTP) - built by Praetorian

Fast, zero-dependency credential testing tool in Go. Brute force SSH, MySQL, PostgreSQL, Redis, MongoDB, SMB, and 20+ protocols. Hydra alternative with native nerva/naabu pipeline integration.

User Controlled Authorization Network (UCAN) Specification

LLM security testing framework for detecting prompt injection, jailbreaks, and adversarial attacks — 190+ probes, 28 providers, single Go binary

Docker容器逃逸工具（Docker Escape Tools）

Simple LLM service identification - translate IP:Port to Ollama, vLLM, LiteLLM, or 60+ other AI services in seconds

Extensional capabilities and deriving combinators

RVM — The Virtual Machine Built for the Agentic Age, in Rust.

API discovery tool that maps attack surfaces from captured traffic and generates specs for REST, GraphQL, SOAP, and WebSocket APIs

Organizational asset discovery tool with 20+ plugins covering certificate transparency, passive DNS, and all 5 Regional Internet Registries.

TACIT — Tracked Agent Capabilities In Types

API security testing framework for REST, GraphQL, and gRPC that validates authorization logic using role-based testing and YAML-driven templates

Open-source cloud security reconnaissance framework

A command-line tool to mount SMB shares and scan them for secrets using NoseyParker.

Our research-based report on establishing the conditions for success with open source in governments

Object capability (ocap) tools and macros for Scala.

Camel.js is JavaScript library for visualizing process capability index.

RBAC APIs for SAAS based services in Rust

Field-fit agents to real work. Turn tacit know-how into reusable capabilities.