owasp-llm

Independent Auditing of AI Agents. Run by human or the agent itself, to answer the most crucial question in the AI Agent Economy. Is the agent doing what is supposed to do? With iFixAi you can have this answer in less than 120 seconds.

Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for release decisions.

DodoGuard: Take AI Agents to Production. Test, validate, and operate AI Agents before and after deployment.for Dify, Coze, FastGPT, n8n, Tencent ADP, ByteDance HiAgent, and more.

AIGoat - Open-source AI security playground for hands-on LLM red teaming. Explore prompt injection, RAG poisoning, AI agents, MCP security, and OWASP Top 10 for LLM Applications through practical attack labs, CTF challenges, and progressive defenses all running locally.

Better agentic security inside a sandbox; one wrapper, any agent.

Runtime security platform for LLM agent tool calls on Kubernetes

25 production-tested defensive security skills for Claude Code - WordPress, VPS, Cloudflare, Next.js hardening, AI agent guardrails, MCP security, prompt injection defense, OWASP LLM Top 10, LLM coding failure modes (slopsquatting, hallucinated APIs, sycophancy), incident response, GDPR/DACH compliance. MIT, battle-tested.

Open-source AI security firewall. 81 engines for PII detection, prompt injection defense, MCP security, and egress classification. Local-first. Zero cloud dependency.

Unofficial one-stop study resource for CompTIA SecAI+ (CY0-001): study guide, 3x60-question practice exams with explanations, 210+ Anki flashcards, cheat sheets & a study plan — structured to the official exam objectives.

Claude Code plugin for code-anchored threat modeling and security architecture review.

Vulnerable AI applications and hands-on labs for learning the OWASP Top 10 for Large Language Model Applications.

Explainable security gate for LLM apps — blocks prompt injection with an auditable reason for every decision.

LLMForge is probably the most modern AI vulnerability lab for OWASP VulnerableApp — real-LLM-backed labs for prompt injection, LLM-orchestrated BOLA, and RAG attacks.

Rule-based prompt-injection, jailbreak and social-engineering detection for documents and agent inputs, available as a skill, CLI, hook and GitHub Action.

Secrets firewall for AI pipelines — redact credentials and PII before they reach (or leave) LLMs.

A BOLA/IDOR access-control confirmation engine — code adjudicates every verdict, not just the model, with a reproducible evidence chain.

Hands-on AI agent security resource: OWASP GenAI attack/fix/verify demos on a LangChain IT-helpdesk agent, deployed to the cloud.

nod is a platform-agnostic, rule-based linter that ensures AI/LLM specifications contain critical security and compliance elements before any agentic or automated development begins.

Adversarial testing for LLM agents: injection, jailbreaks, tool abuse, measured

Evidence-driven AI red teaming platform for LLM, RAG, and agentic applications.