Directory

Security tools directory

Open-source tooling the Secracy team tracks — from OSINT and digital forensics to autonomous AI pentesting agents. Each entry links straight to its upstream project; credit belongs to the maintainers listed.

Authorized use only. Every tool below is dual-use. Run them against your own infrastructure, your own identities, or systems you have explicit written permission to assess. Unauthorized reconnaissance against third parties is illegal in most jurisdictions — and the upstream projects say the same. Read each project's disclaimer and licence before use.

OSINT & Digital Forensics

Reconnaissance, exposure assessment, and investigation tooling — for mapping what's already exposed.

MailAccess

Email OSINT Python MIT Self-hostable

A self-hostable OSINT platform for investigating email addresses. It fans out across breach databases, social networks, DNS records and the open web, then returns a unified exposure score with structured findings you can export or pipe into Maltego.

  • Identity graph — correlates accounts, usernames, display names, avatars and breach data across platforms.
  • Name Consensus Engine — combines independent name signals into confirmed / probable / possible / unknown bands.
  • Defender's Brief — a risk summary written for security managers, with prioritised findings and a concrete next action.
  • Domain harvesting — discovers organisation addresses via Common Crawl, GitHub, CT logs, registries, keyservers and employee pages.
  • Credential Risk Score — a separate 0–100 exposure band with its top drivers.
  • Exports — JSON, CSV, PDF, Markdown, STIX 2.1 and Maltego XML.
pip install mailaccess && mailaccess investigate you@example.com
Blue-team angle: run it against your own corporate domain to see what an attacker can assemble about your staff before they do — then work the Defender's Brief as a remediation list.
Repository mailaccess.pro

Horus

Digital Forensics Python GPL-3.0 CLI

An all-in-one investigations assistant — the maintainers describe it as your "pre-ops buddy." Horus wraps a wide set of investigative capabilities behind a single CLI, leaning on external APIs where needed and compiling the results for you.

  • Cryptocurrency analysis — wallet and transaction investigation helpers.
  • Encryption & decryption — plus steganography tooling for hidden-payload work.
  • Geolocation — the geolock command covers much of the location workflow without a paid key.
  • Shodan integration — deeper host intelligence for those with a Shodan subscription.
  • Operational hygiene — built-in ProtonVPN / OpenVPN commands for investigation opsec.
  • Managed API keys — configure credentials interactively with the apicon command.
git clone https://github.com/6abd/horus && pip install -r requirements.txt && python3 horus.py
Blue-team angle: useful during incident response when you need varied lookups fast without juggling a dozen separate scripts and API clients.
Repository Documentation

TorBot

Dark Web Intelligence Python 3.10+ OWASP Project

An OWASP-affiliated OSINT crawler for hidden services. TorBot walks .onion addresses over Tor, records what it finds, and builds a navigable map of how sites link to each other.

  • Onion crawling — traverses .onion sites to a configurable depth, and custom clearnet domains too.
  • Page intelligence — returns page titles (or hostnames) with short site descriptions.
  • Liveness checks — confirms whether a given link is still reachable.
  • Link trees — visualises relationships between sites, viewable inline or saved to file.
  • JSON export — save the crawl tree for downstream analysis or diffing over time.
  • Flexible transport — SOCKS5 via Tor, or disable it with --disable-socks5 for clearnet testing.
python main.py -u https://example.com --depth 2 --visualize tree
Blue-team angle: monitor hidden services for mentions of your brand, leaked credentials, or data from a breach you're responding to — and re-crawl on a schedule to track what changes.
Repository OWASP Project

Autonomous AI Offensive Security

Agent-driven pentesting frameworks that reason, exploit, and report on their own. Powerful and strictly authorization-only — these actively attack systems, not just observe them.

Strix

AI Pentesting Python Apache-2.0 CI/CD

Autonomous AI penetration-testing agents that act like real hackers — they run your code dynamically, find vulnerabilities, and validate them with working proofs-of-concept rather than the false positives of static analysis. Built for developers and security teams who want fast, accurate testing that plugs into CI/CD.

  • Full pentest toolkit — reconnaissance, exploitation and validation out of the box.
  • Multi-agent orchestration — teams of AI pentesters that collaborate and scale across a target.
  • Real exploit validation — produces working PoCs instead of unverified "maybes."
  • CI/CD integration — scan on every pull request and block insecure code before it ships.
pip install strix-agent
Blue-team angle: wire it into your pipeline so vulnerabilities are caught — and proven exploitable — before code reaches production, not after an incident.
Repository Documentation

Decepticon

Autonomous Red Team Python Apache-2.0 LangGraph

An autonomous red-team agent that orchestrates a full engagement rather than just running a scanner and writing a report. A LangGraph-based management plane coordinates specialist workloads — Active Directory tooling, C2, and reverse-engineering integrations — spun up on demand as the engagement needs them.

  • Orchestrated specialists — the core plane spawns BloodHound CE, Sliver C2, Ghidra MCP and more only when the run calls for them.
  • Terminal CLI + web dashboard — drive engagements from the CLI, bring up the dashboard on demand with /web.
  • Provider-flexible — an onboarding wizard configures your model provider, API key and profile.
  • Cross-platform — macOS, Linux, and Windows (native or via WSL2/Kali), Docker-based.
curl -fsSL https://decepticon.red/install | bash && decepticon onboard
Purple-team angle: run realistic autonomous red-team engagements against your own lab to test detection and response — then tune your blue-team playbooks against what it actually does.
Repository decepticon.red

Pentest Swarm AI

Agent Swarm Go AGPL-3.0 Alpha

Autonomous penetration testing built on a genuine agent swarm — not a single planner calling recon → exploit → report down a fixed line. Dozens of agents work a target concurrently, coordinating through a shared stigmergic blackboard so a finding immediately wakes whichever specialist it's relevant to. It exploits what it finds and backs it with captured evidence.

  • Real swarm coordination — recon, classification, exploitation and reporting specialists working in parallel at machine speed.
  • Evidence-backed reports — proves findings with captured PoC evidence, not scanner "maybes."
  • Multiple modes — bug bounty, continuous monitoring, and CTF.
  • Any model, incl. local — Claude, OpenAI-compatible, security-tuned open models, or fully local Ollama / LM Studio for air-gapped, zero-cost runs.
git clone https://github.com/Armur-Ai/Pentest-Swarm-AI
Blue-team angle: the continuous-monitoring mode lets you keep re-testing a changing attack surface between formal engagements, air-gapped with a local model so nothing leaves your environment.
Repository

Want these workflows automated?

Secros AI is Secracy's autonomous security assistant — built to reason over findings like these instead of leaving you to correlate them by hand.

Explore Secros AI