Speakeasy

AiSOC is an open-source, self-hostable AI Security Operations Center for ingesting security telemetry, detecting and correlating threats, investigating incidents with AI agents, and proposing human-approved response actions. It normalizes events into a common activity shape, carries them through Kafka, applies executable detection and sliding-window rules, groups resulting alerts into incidents, and can resweep collected telemetry when new threat intelligence arrives. Its agents read alerts, correlated entities, and prior verdicts, then use typed tools for lake queries, graph traversal, and enrichment rather than writing SQL. Prompts, tool calls, citations, verdicts, and token costs are recorded in an auditable Investigation Ledger, with signed evidence-bundle exports and grounding checks that can demote unsupported conclusions to human review. Playbooks are previewed by default; response actions require explicit authorization and human approval unless tenant policy grants autonomy for a specific verb. The project includes a local Ollama-served model, a REST API, web console, MCP server, connectors and collectors for security data sources, and a CISA Known Exploited Vulnerabilities feed that requires no API key. It runs with Docker Compose, can be deployed in core, full, or demo profiles, and is distributed under the MIT license. The repository states that AiSOC is not a drop-in SIEM replacement and cannot observe telemetry that has not been connected.

Agent S is an open-source computer-use agent framework from Simular. It accepts natural-language tasks, observes a real desktop through screen and accessibility signals, and operates ordinary applications by clicking, typing, scrolling, and executing optional local code rather than relying on per-application APIs or scripts. The project has progressed through three generations: accessibility-tree grounding with an LLM, a vision-based manager-worker architecture using multiple foundation models, and Agent S3, which scales computer-use attempts through parallel rollouts and selection. Its workflow can combine model-driven exploration with reusable automation code, replay saved skills, and recover when the interface changes. The framework supports macOS, Windows, and Linux, works with models from OpenAI, Anthropic, Gemini, OpenRouter, vLLM, and open-weight providers, and is distributed through the `gui-agents` Python package. An optional local coding environment can execute Python and Bash with the current user's permissions, so the repository warns that this capability should be used only in trusted environments.

Stripe MCP is Stripe's public-preview Model Context Protocol server that lets AI agents interact with the Stripe API and search Stripe's documentation and support knowledge base. It can be configured in clients including Cursor, Claude, Codex, ChatGPT, and VS Code; Stripe's agent plugins install and maintain the server and related agent skills, while manual setup is also available using OAuth or an agent API key. It can be used with Claude to build Stripe payments integrations, including recommendations for Stripe Tax or Checkout and sandbox provisioning with API keys through the Stripe CLI.

Evo by Snyk is a security and governance platform for AI-native applications, agentic development, and AI systems. It provides continuous visibility, governance, testing, and real-time control across the AI software lifecycle. Its Agentic Development Security capability discovers models, agents, MCP servers, datasets, plugins, tools, and services used by agents across repositories; generates an AI bill of materials; applies policy and guardrails to agent actions; and validates AI-generated code before it reaches repositories, pipelines, or production. Its Continuous Offensive Security capability autonomously stress-tests applications and AI systems like an adversary, with agents coordinating reconnaissance, vulnerability hunting, exploit validation, remediation, and reporting, and an independent validation model intended to confirm exploitability before reporting findings. Testing is intended to run on code changes and pull requests.

Keycard is a runtime authorization platform for AI agents. It gives each agent an identity and evaluates the full request context—including the agent, its runtime, the task, and any user it acts for—against policy before issuing credentials. Approved requests receive short-lived, task-scoped tokens for resources such as APIs, data stores, MCP servers, and other agents; denied requests receive no credentials and are logged. Keycard also provides resource configuration, session inspection, attribution-rich audit logs, SIEM export, and immediate credential revocation.