Sherlock

User Scanner is an open-source command-line and Python library OSINT suite for investigating email addresses and usernames across hundreds of platform modules. It checks account registrations and scrapes profile metadata such as avatars, biographies, follower counts, user IDs, seller statuses, and other account attributes. The tool supports cross-scan pivoting: initial results can yield handles, profile links, aliases, or exposed email addresses that are used as inputs for subsequent scans. It also provides username permutation generation, Hudson Rock infostealer-breach lookups, parallel HTTP scanning with TLS fingerprint impersonation, proxy rotation and validation, category or module targeting, bulk-file input, and PDF, JSON, and CSV exports. It can be installed from PyPI or run through Nix. An optional Model Context Protocol server exposes username scanning, email scanning, and module-discovery tools to compatible AI clients. The project describes itself as intended for educational use, authorized security research, and defensive OSINT investigations.

sigwood is a local-first, command-line threat-hunting tool for self-hosters, developed as a Python package and distributed through PyPI. It analyzes logs already on the host, including Zeek, Pi-hole or dnsmasq, syslog or the systemd journal, and AWS CloudTrail, without an agent, daemon, database, network connection, or account. Its detectors cover periodic beaconing using an FFT over connection timing; anomalous DNS using HDBSCAN clustering; rare syslog events using Drain3 templating and rarity; authentication structure; port scans; bulk outbound transfers; protocol and TLS anomalies; unusual CloudTrail activity using a per-principal z-score composite; and behavior in names blocked by Pi-hole. The default hunt runs a curated subset, while individual detectors or all detectors can be selected explicitly. Commands also include digest for profiling logs, graph for producing a self-contained HTML flow artifact, init for writing configuration, and export and allowlist utilities. Findings identify the technique and supporting evidence, and are presented as leads for investigation rather than verdicts. The tool can read a directory or individual log file and supports text, HTML, PDF, JSON, and CSV output; its stable scripting interfaces include the command, detector names, configuration section, exit codes, and machine-readable JSON and CSV formats. The project states that it supports Python 3.11 through 3.14 and is licensed under the MIT License.

SkillSpector is an open-source security scanner for AI agent skills, developed by NVIDIA. It scans Git repositories, URLs, ZIP archives, directories, and individual skill files before installation, looking for prompt injection, data exfiltration, privilege escalation, supply-chain issues, dangerous code, MCP permission problems, tool poisoning, and other malicious patterns. Its two-stage pipeline combines static analysis—including regex, Python AST, taint tracking, YARA signatures, and OSV.dev dependency lookups—with optional LLM-based semantic evaluation. It produces terminal, JSON, Markdown, or SARIF reports containing findings, severity labels, a 0–100 risk score, and installation recommendations. Baselines can suppress accepted findings, and the CLI can be used in CI or install gates through exit codes and machine-readable output. SkillSpector can also run as an MCP server callable by compatible agents. It does not execute scanned skills or sandbox them; optional LLM analysis sends eligible file contents to the configured provider, while dependency checks query OSV.dev. The project is distributed under the Apache License 2.0 and is part of NVIDIA's Verified Skills pipeline.

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.

CrawlSEO is an open-source, self-hosted SEO monitoring dashboard for founders. It combines Google Search Console analytics for keywords, pages, clicks, impressions, click-through rate, and position changes with 28-day comparisons; a concurrent site crawler that handles up to 2,000 pages, assigns a health score, identifies 16 issue types, scores content, and provides per-page audit and remediation data; Core Web Vitals monitoring through PageSpeed Insights; historical rank tracking; SEO opportunity detection; alerts; and CSV export. Optional keyword research and backlink analysis use DataForSEO with a bring-your-own-key setup, while Google Autocomplete provides a free fallback for keyword suggestions. The included Model Context Protocol server exposes 10 tools for Claude Code, Claude Desktop, and Cursor. Connected AI agents can query SEO data, run crawls, inspect crawl issues and performance, and find opportunities. The application is built with Next.js, TypeScript, PostgreSQL, Prisma, and NextAuth.js, and is distributed under the MIT license for local or Docker Compose deployment with Google OAuth and a database. It is described as free and open source, with self-hosting intended to keep site data under the operator's control.