ThreatXtension

VirusTotal is a threat-intelligence service that provides external intelligence used to enrich browser-extension analysis.

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.

Strix is an open-source AI penetration-testing tool from usestrix that uses autonomous, multi-agent AI pentesters to dynamically run applications, perform reconnaissance and exploitation, and validate vulnerabilities with working proof-of-concept exploits rather than static-analysis findings. Its developer-oriented CLI produces remediation guidance, generated patches, and pentest reports, and it can run scans in CI/CD pipelines to detect insecure changes before deployment. The tool runs in a Docker sandbox and requires an LLM API key; the associated Strix platform supports repository and domain testing, continuous scanning, and integrations with development and issue-tracking workflows.

geiger is a read-only command-line scanner from Atomburst that inventories AI agents, harnesses, MCP servers, plugins, skills, hooks, browser extensions, desktop AI applications, and related IDE configurations on a machine. It reads known configuration files and directories, identifies each finding's origin and evidence path, and labels capabilities such as code execution, secret storage, broad filesystem access, broad web access, and network access. Credential-shaped values are reported by key name, file, and secret type without exposing value contents; the scanner performs no telemetry and writes only an explicitly requested report file. It can emit terminal, HTML, or versioned JSON reports, scan specified project or home directories, enforce a strict exit status for findings that can execute code or hold secrets, and compare JSON snapshots to identify newly appeared, removed, or escalated findings. It runs through npx with Node.js 18 or newer, has no runtime dependencies or account requirement, and is licensed under MIT. The project notes that it reads configuration rather than runtime behavior, covers known locations, and does not determine whether a package is malicious.

Knockoff is a browser extension that filters pseudo-brand listings from Amazon search results by hiding, dimming, or labeling them. It runs locally in a content script and resolves each listing's brand against user allowlists and blocklists, bundled lists of flagged and established brands, and name heuristics for patterns such as all-caps strings, unusual consonant runs, non-English letter pairs, non-Latin characters, and irregular capitalization. The extension supports Chrome, Firefox, and Safari; the public repository is a frozen, fully local snapshot with no accounts, tracking, or network requests, while maintained auto-updating versions are distributed through browser extension stores.