deepsec

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.

DeepSeek Harness (dsh) is an open-source agent harness developed by DeepSeek AI. It uses an architecture in which everything is a plugin and is powered by Cordis, whose design is described in “A Programming Paradigm for Spatiotemporal Composability.” The npm package can launch a local Web UI with `npx @deepseek-ai/dsh web`, serving at `http://127.0.0.1:3080` by default and opening the default browser; it can also be built and run from a repository checkout. The project is in developer preview and warns that compatibility-breaking changes may occur. It is licensed under the MIT License, with third-party dependencies and their licenses documented separately.

geiger is a read-only command-line scanner from Atomburst that inventories AI agents, harnesses, MCP servers, plugins, skills, hooks, browser extensions, desktop AI applications, and related IDE configurations on a machine. It reads known configuration files and directories, identifies each finding's origin and evidence path, and labels capabilities such as code execution, secret storage, broad filesystem access, broad web access, and network access. Credential-shaped values are reported by key name, file, and secret type without exposing value contents; the scanner performs no telemetry and writes only an explicitly requested report file. It can emit terminal, HTML, or versioned JSON reports, scan specified project or home directories, enforce a strict exit status for findings that can execute code or hold secrets, and compare JSON snapshots to identify newly appeared, removed, or escalated findings. It runs through npx with Node.js 18 or newer, has no runtime dependencies or account requirement, and is licensed under MIT. The project notes that it reads configuration rather than runtime behavior, covers known locations, and does not determine whether a package is malicious.

security-audit is a Cloudflare coding-agent skill that orchestrates multi-phase security audits of codebases. It uses reconnaissance to map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage; assigns isolated agents to coverage-led hunting; sends each unique candidate to a fresh verifier; and records confirmed, needs_validation, and rejected results in machine-readable findings.json validated against a report schema. Independent agents verify final source claims, after which the skill derives target-neutral reports and coverage records. It can be installed with the Skills CLI and requires a tool-using coding agent with parallel sub-agent support, Node.js for its validators, and an OS-enforced sandbox for target-controlled execution. The repository is licensed under MIT.

Jevgrep is a command-line tool for coding agents that finds relevant files and source context in unfamiliar repositories from natural-language questions. It uses Jev to judge relevance across folders, files, and declarations, explores qualifying branches of the repository hierarchy, selects files through content previews, identifies useful source units and surrounding context, and returns a summary followed by file locations, reading leads, and verbatim excerpts with line references. Python and TypeScript/JavaScript support declaration parsing, while other text uses a fallback. It also includes an agent skill that teaches supported coding agents when to invoke the CLI and how to use its results. The CLI is distributed through npm as @dzhng/jevgrep, requires Node.js 22 or later on macOS or Linux, and requires authentication with a supported AI provider. Searches send eligible source content to Jev through the selected provider; local filtering excludes ignored, hidden, dependency/build, binary, and obvious credential files but is not a guarantee that sensitive data is removed. The project is MIT-licensed.