runtime-security

Mobile 安全 Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Cloud Native Runtime 安全

Linux Runtime 安全 and Forensics using eBPF

tirreno is a security framework. Event tracking, threat detection, and risk scoring for any product.

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub 操作 runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

ebpfkit is a rootkit powered by eBPF

Runtime security for AI apps and agents: prompt injection detection, tool-call authorization, sensitive-data redaction, bot protection, and rate limiting. Drop it into your JS/TS code.

ANOLISA (Agentic Nexus Operating Layer & Interface System Architecture) | Agentic OS with runtime, security, observability, and Tokenless response compression for lower token usage and cost.

Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS

Deep Linux runtime visibility meets Wireshark

Hades is a Host-Based Intrusion Detection System based on eBPF(mainly)

Open-source eBPF runtime security sensor for GitHub 操作 and GitLab CI/CD.

Build your own security agents. Open-source framework for agents with live, read-only access to your infrastructure, with no path to widen it. Reasons across AWS, GCP, Azure, Kubernetes, GitHub and GitLab as one system.

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

Run AI harnesses like Claude Code, Codex, Copilot, Antigravity, and Omnigent in disposable workspace forks. Review, merge, or roll back changes with policy enforcement and provenance.

Runtime enforcement boundary for AI agents: a local sidecar that gates every outbound call against Cedar policies you own. Deterministic, call-level, no model on the hot path

🐝 BPFBox 📦 Exploring process confinement in eBPF