owasp-llm

Independent Auditing of AI Agents. Run by human or the agent itself, to answer the most crucial question in the AI Agent Economy. Is the agent doing what is supposed to do? With iFixAi you can have this answer in less than 120 seconds.

Open-source AI security verification — model artifacts, live endpoints, MCP servers and recorded agent traces. One rule engine for your laptop, CI and production, mapped to OWASP/MITRE ATLAS/NIST. Deterministic evidence, a measured verdict, and an explicit "could not tell". Apache-2.0.

AIGoat - Open-source AI security playground for LLM red teaming. AI Goat provides hands-on labs covering the full OWASP LLM Top 10 with progressive defenses.

Runtime security platform for LLM agent tool calls on Kubernetes

25 production-tested defensive security skills for Claude Code - WordPress, VPS, Cloudflare, Next.js hardening, AI agent guardrails, MCP security, prompt injection defense, OWASP LLM Top 10, LLM coding failure modes (slopsquatting, hallucinated APIs, sycophancy), incident response, GDPR/DACH compliance. MIT, battle-tested.

Claude Code plugin for code-anchored threat modeling and security architecture review.

Open-source AI security firewall. 81 engines for PII detection, prompt injection defense, MCP security, and egress classification. Local-first. Zero cloud dependency.

Explainable security gate for LLM apps — blocks prompt injection with an auditable reason for every decision.

Secrets firewall for AI pipelines — redact credentials and PII before they reach (or leave) LLMs.

A BOLA/IDOR access-control confirmation engine — code adjudicates every verdict, not just the model, with a reproducible evidence chain.

Erkennt Prompt Injection, Jailbreaks und Social Engineering in Dokumenten, Skills und System-Prompts. 28 Kategorien inklusive Unicode-Tarnung.

LLMForge is probably the most modern AI vulnerability lab for OWASP VulnerableApp — real-LLM-backed labs for prompt injection, LLM-orchestrated BOLA, and RAG attacks.

Hands-on AI agent security resource: OWASP GenAI attack/fix/verify demos on a LangChain IT-helpdesk agent, deployed to the cloud.

nod is a platform-agnostic, rule-based linter that ensures AI/LLM specifications contain critical security and compliance elements before any agentic or automated development begins.

A practitioner maturity model for securing conversational and agentic AI.

Adversarial testing for LLM agents: injection, jailbreaks, tool abuse, measured

Unofficial one-stop study resource for CompTIA SecAI+ (CY0-001): study guide, 3x60-question practice exams with explanations, 210+ Anki flashcards, cheat sheets & a study plan — structured to the official exam objectives.

AI/LLM security knowledge base — OWASP LLM Top 10, MITRE ATLAS, prompt injection, agentic security. An Obsidian vault: 92 interlinked, fully-cited pages.

LLM Güvenlik Tarama Aracı

Open Agent Security Fabric — red-team agentic AI, MCP firewall SDK, action oracles & SARIF CI gates. Assure, Enforce & Govern. Python + TypeScript. OWASP LLM/Agentic/MCP Top 10.