runtime-security

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Cloud Native Runtime Security

Linux Runtime Security and Forensics using eBPF

tirreno is a security framework. Event tracking, threat detection, and risk scoring for any product.

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

ebpfkit is a rootkit powered by eBPF

Runtime security for AI apps and agents: prompt injection detection, tool-call authorization, sensitive-data redaction, bot protection, and rate limiting. Drop it into your JS/TS code.

ANOLISA (Agentic Nexus Operating Layer & Interface System Architecture) | Agentic OS with runtime, security, observability, and Tokenless response compression for lower token usage and cost.

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS

Deep Linux runtime visibility meets Wireshark

Hades is a Host-Based Intrusion Detection System based on eBPF(mainly)

Open-source eBPF runtime security sensor for GitHub Actions and GitLab CI/CD.

Open-source security agents for cloud, code and runtime. 45 built-in agents audit AWS, GCP, Azure, Kubernetes, GitHub and GitLab for privilege escalation, public exposure, supply chain and more, or build your own in one markdown file. Live, read-only access to your infrastructure.

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

Runtime enforcement boundary for AI agents: a local sidecar that gates every outbound call against Cedar policies you own. Deterministic, call-level, no model on the hot path

Operation-bound protection for autonomous AI agents: contain and verify operations before committing changes, understand intent and risk across long-running work, and detect threats across agent and system activity.

🐝 BPFBox 📦 Exploring process confinement in eBPF