The Shadowserver Foundation

Sysdig is a cloud-security platform that provides real-time visibility from runtime through development. It is described in the video context as a customer-side CVE-scanning tool that produces security reports; its website also presents capabilities for assessing cloud risk, prioritizing critical risks, detecting threats, and responding to them.

php2shell-checker is an OpenAI version-based PHP security checker. It checks a website's advertised PHP version from the X-Powered-By and Server headers, or checks a local/server installation, then compares the version with listed upstream fixed releases and reports OK, POTENTIALLY VULNERABLE, or UNKNOWN. Its URL mode sends a HEAD request and falls back to GET only for 405 or 501 responses; it does not follow redirects, inspect response bodies, or send exploit probes. Because HTTP headers may not reveal backported fixes, an OK result describes only the advertised version and does not verify the installation. It provides phpcheck-url and phpcheck-server skills, supports JSON output, and is licensed under the Apache License 2.0.

Shannon is an open-source autonomous AI penetration-testing tool developed by Keygraph for web applications and APIs. It analyzes source code to map architecture, trust boundaries, data flows, interfaces, dependencies, and potential attack paths, then combines those candidates with live reconnaissance and specialized testing for injection, XSS, SSRF, authentication, and authorization. Exploitation agents use browser automation and command-line tools against a running application to produce reproducible proof-of-concept attacks; candidates that cannot be demonstrated are discarded, so only exploited vulnerabilities become findings. Shannon runs locally from the command line or in CI/CD, including GitHub Actions and GitLab CI/CD, and can test deployed staging or development environments on pull-request, release, or scheduled workflows. It produces evidence-rich PDF and Markdown reports plus JSON and SARIF 2.1.0 output, supports authenticated testing and resumable workspaces, and can gate a pipeline on proven vulnerabilities at configured severity levels. The open-source edition runs in an ephemeral Docker worker, mounts the target repository read-only, stores results locally, and uses credentials supplied for a selected model provider or compatible local endpoint. Shannon is licensed under AGPL-3.0. It actively executes exploits and may mutate application state, so the project requires authorization and recommends sandboxed, staging, or local environments rather than production systems.

ThreatXtension is an open-source security tool for analyzing browser extensions and detecting potentially malicious ones. It combines static analysis, permission analysis, VirusTotal intelligence, web-store information, and AI-based assessment.

OSS Scanner is an Anthropic service that scans enrolled critical open-source repositories for security vulnerabilities. Maintainers enroll a project by opening a pull request that adds a project directory with a configuration file and Dockerfile; the Dockerfile sets up dependencies and builds the project, initially with network access enabled. After the build, the project is moved into an isolated virtual machine with Internet access disabled for the security analysis. Findings are emailed to the configured contacts with reproduction steps and, where available, a proposed patch. Reports are model-generated and are not reviewed by a human. The repository includes validation and local-checking tools for testing the build and no-network audit environment before enrollment.