Before an AI agent meets real users, put it through a security checkup it cannot sweet-talk. DodoGuard is a web console and command line where teams register their agents, run evaluation and red-team tasks against them, and decide if each one is cleared for launch. The overview page shows a security index, open risks, remediation counts, and a pipeline that runs from asset intake through detection and remediation to launch monitoring and audit reports. An asset ledger lists every managed agent with its platform, environment, and risk level. A guided wizard creates assessment tasks that pick a test library for prompt injection, instruction leakage, tool misuse, and output risks, then runs black-box conversations against the agent. Evaluation configs cover prompts, providers, variable cases, and several assertion types, with OpenAI, Anthropic, Azure, Bedrock, Ollama, and any OpenAI-compatible endpoint supported. Findings land in a closed-loop board where owners confirm, fix, retest, and close each risk, and finished tasks export as reports for release evidence. Docker Compose with SQLite brings up the web UI on port 3000, and the same engine runs in continuous integration. Security teams use it for launch gates, platform owners use it for regression checks after prompt changes, and auditors use it for evidence. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Promptfoo replaces vibes-based prompt tweaking with measurable tests, then attacks your AI app the way a hostile user would. An evaluation matrix lines up every prompt and model side by side, with pass or fail badges, assertion messages, latency, token counts, and cost in each cell. A red team wizard walks through the target, application details, plugins, and strategies, then probes for prompt injection, data exposure, broken access control, and harmful content. Preset bundles map plugins to the OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS, GDPR, ISO 42001, and the EU AI Act. Meta Agent and Hydra Multi-Turn strategies adapt attacks across a whole conversation instead of firing one-shot prompts. Providers span OpenAI, Anthropic, Gemini, Bedrock, Azure, and local Ollama models, and any HTTP endpoint, Python script, or JavaScript function can be tested as a target. The history page lists every run with pass rates and raw scores, and prompt and dataset pages show which templates and test sets each run used. A provider allowlist file narrows the models offered in the web editor for cost control. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

A hacking gym for AI apps: every lab is a chatbot or agent with a planted weakness, and your job is to exploit it and capture the flag. The dashboard tracks score, rank, badges, and a live activity feed across three tiers. Ten core labs map to the OWASP Top 10 for LLM Applications, ten advanced labs need multi-turn tactics like persona escalation, stored injection, and tool chaining, and an encrypted expert tier unlocks last. Each lab opens with a short reference panel on the weakness, offers hints, and ends with the defense that would have stopped you. Play mode uses scripted assistants so flags reproduce every time and the whole range runs offline without API keys. Live mode points attacks at a real local model through Ollama, mints a fresh secret per session, streams replies token by token, and checks the output instead of a flag box. Scenarios cover direct prompt injection, a hidden payload in an uploaded image, and unsafe rendering of model output. A RAG lab accepts text and markdown uploads, so poisoning a knowledge base is hands-on. Two themes, Neon and Phosphor green-CRT, change the look. Security teams run workshops with it, red teamers sharpen prompt injection skills, and developers see why their guardrails fail. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Prismor sits between your AI coding agents and the tools they want to use, judging every shell command, file read, and API call before it runs so a helpful agent cannot quietly become a destructive one. Run it in observe mode to watch what agents actually do across every workspace, then switch chosen rules to enforce and block secret leaks, prompt-injection pivots, privilege escalation, and risky package installs before execution. When a call is sensitive rather than forbidden, Prismor can pause it for human approval, letting a person decide instead of the model. Plain-language prompt guardrails such as never push to main are added to the agent context per agent and per session, and edits are picked up on the next prompt. Every action lands in a hash-chained, Ed25519-signed audit trail you can verify later, while the web dashboard breaks down sessions, findings, friction, and token spend so you can see where runs went wrong. Agents that cannot be hooked are still governed through the LLM proxy or the MCP gateway, which evaluates each tool call and scans responses for injected instructions before the model sees them. Honeytoken canary files trip a critical finding the moment an agent reads them, catching reconnaissance early. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Put a checkpoint in front of every tool call your AI agents make, so a poisoned web page or file cannot quietly move money or send private data. Each call is classified and policy-checked before it executes, then allowed, blocked, or held for a person. Held calls land in an approvals queue that shows what the user asked, which passage the agent read, and the exact recipient or amount in question, with one-click block or allow. Instruction provenance flags destinations that appeared only in untrusted content, like an IBAN hidden in a file. The cockpit lists every run as a timeline of steps with verdicts, groups violations by the protection that caught them, and scores ten attack surfaces on a Security 360 page. An agent registry tracks owners, scope, and call counts. Budgets, anomaly alerts, and a kill switch cap runaway behavior. Sensitive values are redacted from traces, signed receipts prove a call was allowed, and exports produce PDF and CSV audit evidence. Python and TypeScript SDKs plug in with one line, or an LLM proxy catches calls with an environment variable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Your AI coding agent has your API keys in its environment and unrestricted network access, which means one prompt injection away from sending those secrets anywhere. Pipelock closes that gap by sitting as a proxy between your agents and every outbound connection, scanning the actual content of HTTP, WebSocket, MCP, and Agent-to-Agent traffic before it leaves your server. An 11-layer scanner pipeline checks every request against 62 credential patterns covering AWS, GCP, Azure, GitHub, OpenAI, Anthropic, SSH keys, and database URLs, then inspects every response for prompt injection using 29 detection patterns with six-pass normalization that catches base64-encoded, leetspeak, and whitespace-obfuscated payloads. The MCP proxy wraps any Model Context Protocol server (stdio, HTTP, or WebSocket) with bidirectional scanning that detects tool description poisoning and mid-session rug-pull changes via SHA-256 fingerprinting. Every scanning decision produces a cryptographically signed action receipt that third parties can verify offline without trusting the agent or the vendor. The Operator Console provides a web dashboard for reviewing evidence scorecards, receipt timelines, agent sessions, enforcement decisions, and fleet posture at a glance. Cross-request taint tracking catches slow-drip exfiltration attempts that spread a secret across multiple calls. Canary tokens plant synthetic secrets that trip alerts the moment an agent tries to exfiltrate them. Pre-built Prometheus metrics and a Grafana dashboard provide real-time visibility into traffic volumes and block rates. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

An AI agent that maps your attack surface, proves what is exploitable, and drafts the code fix: RedAmon is a red team for domains you are authorized to test. A six-phase recon pipeline runs subdomain, port, HTTP, and vulnerability scanners in parallel and merges every result into a Neo4j graph you can query in plain language. The agent works from a Kali sandbox with 100+ security tools, asks for human approval before risky steps, and can deploy a Fireteam of specialist sub-agents that investigate separate angles of one target at once. CypherFix triages each finding, then a code agent opens a GitHub pull request with the patch. AI Gauntlet attacks chatbots and LLM endpoints with prompt injection and jailbreak batteries, mapped to the OWASP LLM Top 10. TrafficMind records every HTTP request the tools send, with a searchable history the agent can replay. An Insights dashboard charts findings, CVE severity, and attack chains per project, and the settings page connects OpenAI, Anthropic, OpenRouter, Bedrock, or local Ollama and vLLM models. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Xalgorix delivers AI-driven penetration testing that proves vulnerabilities exist rather than guessing, pairing an autonomous LLM agent with an independent exploit verifier that re-exploits every finding before it reaches your report. The 22-phase methodology mirrors how a skilled human pentester works through an engagement, covering reconnaissance, subdomain enumeration, port scanning, web crawling, parameter fuzzing, SQL injection testing, XSS detection, authentication bypass, API testing, and more. Select all phases or pick specific ones per target. The platform ships with 85+ offensive security tools preinstalled (nmap, nuclei, httpx, subfinder, katana, ffuf, gobuster, sqlmap, masscan, dalfox, feroxbuster) plus 14 built-in agent tools for browser automation, terminal execution, and note-taking. Connect your own LLM provider (OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, or MiniMax) so no scan data or target information leaves your infrastructure. The web dashboard on port 9137 provides live WebSocket telemetry showing tool calls, agent reasoning, and findings as scans progress. A findings index with CVSS scoring and severity filters organizes results, and branded PDF reports include your company name and logo. Wildcard and multi-target scans handle red team attack-surface mapping, while source-code scanning audits repositories directly without requiring a deployed target. A REST API enables scripted scans and SIEM pipeline integration, and webhooks push notifications to Discord or Telegram. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Hunting for the hole is only half the job, because a scanner alert nobody believes wastes more time than the bug itself. Add a domain, CIDR, or bug-bounty scope and Reconner builds the map first: passive and active subdomain enumeration, live HTTP probing and fingerprinting, JavaScript analysis that digs endpoints, secrets, and API keys out of bundles, plus parameter and hidden-param discovery. Then it attacks what it mapped with a context-aware engine covering reflected, stored, and DOM XSS, SQL, NoSQL, SSRF, IDOR, LFI, SSTI, XXE, injection, and open redirects, and every candidate has to survive differential, out-of-band, or control-based proof, re-verified before it is ever reported. Blind issues are not dropped either: OAST callbacks catch out-of-band SSRF, RCE, SQLi, and SSTI that never respond inline. Networks get the same treatment, with port scanning, service detection, network-CVE checks, and IP-camera auditing. Findings land in a live dashboard streamed over WebSocket, with an attack-path view, coverage ledger, monitoring diffs, and HTML, Markdown, and PDF reports, while Telegram can alert you and even start, stop, or resume scans remotely. Run it only against assets you own or are authorized to test; behind a VPN and TLS it becomes your private proving ground. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Watchtower puts AI-driven security assessments into one web console, where sessions probe your attack surface while every request, finding, and piece of evidence is captured as it happens. The AI session console follows the attack surface, session progress, tool calls, and findings as an assessment runs, so you can watch an engagement unfold instead of reading a log afterwards. A built-in proxy workflow records HTTP and HTTPS traffic history with highlighted patterns, and any captured request can be sent to the Repeater for editing, replay, and response comparison. Mobile work is covered too: connect phones over USB or wireless, capture app traffic separately from accessibility control, and import WeChat mini-program packages to configure an assessment session. A public vulnerability intelligence library can be searched by component, severity, and source and kept synchronized locally, giving assessments current context without sending your targets anywhere. Findings are managed by source, severity, and status, each linked back to its supporting evidence, and the report editor assembles them with a live preview, impact notes, and remediation guidance. The dashboard tracks assets, tasks, AI sessions, token usage, and runtime resources, and task admission is budgeted against physical memory so heavy scans do not starve the host. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Autonomous red team execution without manual script coordination is what PentaGI delivers through a multi-agent penetration testing platform engineered for automated security assessments. Security engineers configure testing scopes, target IP ranges, domain lists, and rules of engagement through an interactive web console with real-time execution graphs. Autonomous agent personas break down high-level assessment goals into discrete tactical phases, orchestrating network port discovery, service banner fingerprinting, web application crawling, and CVE verification. Specialized agents query integrated Graphiti knowledge graphs and local vulnerability repositories to synthesize attack paths, validate exploitability, and confirm finding veracity before issuing alerts. Operators monitor live agent terminal streams, inspect sandboxed tool executions, and adjust active LLM provider routes across OpenAI, Anthropic, or local Ollama endpoints. The template editor allows red teams to compose reusable testing playbooks with customizable security prompt chains, safety constraints, and automated remediation reporting. Audit logs capture full command histories, raw tool outputs, and LLM reasoning steps to generate compliance-ready technical documentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Change an agent's prompt, model, or audience from a dashboard and watch it go live without a single redeploy. MATE opens in a Work Room where any root agent can be picked from a card grid and chatted with directly. The Studio holds the builder: a drag-and-drop canvas draws parent and child agents, attaches tools and MCP servers, and keeps every configuration versioned with one-click rollback. Trace Replay plays a past conversation back across that canvas so each hand-off is visible. A template library imports ready-made agent teams, from research pipelines to support desks. The Control Room covers governance: role-based access per agent, dollar costs per agent and project, budgets that warn or block, guardrails for personal data and prompt injection, and alerts to Slack, Discord, email, or a webhook. Eval suites score replies by exact match, similarity, or an LLM judge, and a Playground compares models or prompts side by side on score, speed, and cost. Agents can be embedded as a chat widget, called through an OpenAI-compatible endpoint, or exposed over MCP and A2A. Agencies running client agents and platform teams juggling dozens of them can manage the lot from one dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Preloop is a self-hostable control plane that governs every AI agent tool call and model call, and can run ticket-triggered agent work that returns as reviewable pull requests. An MCP firewall can allow, deny, or hold any tool call for approval, with require-justification rules written as YAML and CEL policy. Human approvals arrive on mobile, watch, Slack, Mattermost, email, webhook, or the command line, and agents can ask a person a question before continuing. The model gateway speaks OpenAI, Anthropic, and Gemini formats, applies budgets and allowed-model lists, and attributes token spend by model, agent, session, API key, flow, and user. Flows start agents from GitHub, GitLab, Bitbucket Cloud, Jira, webhooks, or CI jobs, in hosted containers or on private runners that connect over an outbound WebSocket. Twenty-one presets review pull requests, implement issues, triage tickets, scan for vulnerabilities, and collect evidence packs. Operators can steer a running agent from the console, phone, or watch with notes, then review the resulting pull request. One session timeline records tool calls, model calls, policy decisions, approvals, spend, outcomes, and synchronized recordings. Fleet Map shows people, devices, agents, models, and observed work in one view. An account kill switch blocks gateway and tool traffic and stops managed runs, with audited recovery. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

MCPProxy puts one safe endpoint in front of every MCP server your AI agents use, and it holds each new server in quarantine until a person approves it. Add stdio or HTTP servers on the Servers page, then review the captured tool definitions and scanner findings in the Review queue before any agent can call them. The Tools page lists every tool with a Read, Write, or Destructive tier, an approval state, and a usage count, plus switches to hide whatever you do not want exposed. Agents see a short set of discovery and call tools instead of the full catalog, and the Home dashboard estimates how much context that saves per request. The Activity Log records each call with its server, intent, status, and duration, and exports for audits. The Usage page charts calls per tool, response sizes, errors, latency, and activity over time, filtered by profile, client, or token. Profiles and agent tokens scope what each client may reach, a Secrets page keeps credentials out of config files, and a setup wizard connects Claude Code, Claude Desktop, Cursor, Windsurf, and VS Code. Platform teams and solo builders get one place to see and control everything their agents can touch. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

One endpoint for every model account you own: 9Router Pro sits between your applications and a fleet of LLM providers, decides which account answers each request, and keeps the whole operation visible on a live dashboard. Its signature trick is prompt injection scoped three ways, globally, per API key, or per model, delivered either as a system prompt or as a scripted chat history that primes the model far harder than instructions alone. Keys are products here: each carries a rolling token budget over 24 hours, 7 days, or 30 days plus rate limits per minute, hour, and day, so a resold plan enforces itself with polite 429 responses. Routing stays healthy on its own, with accounts tiered as clean, suspect, or cooldown, least-recently-used spreading across the fleet, flaky upstream responses retried against the next account, and proxy pools health-checked with one-click cleanup of the dead. The monitoring dashboard leads with VPS specs, fastest and most-used providers, top API key, and usage spectrum charts, while backup and restore cover providers, combos, keys, and settings section by section. Everything runs as a single application with one SQLite file and a dashboard localized into 34 languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.