AI agent tools for security tools
Short answer: Our top pick for security tools: SkillSpector, with the highest AgentPick Score (83/100) among tools tagged "security-tools". Runners-up: onecli (76) and stride-gpt (67). Compare what each does, its license and how recently it was updated below.
| # | Tool | What it does | Score | Stars | License | Updated |
|---|---|---|---|---|---|---|
| #1 | SkillSpector | Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chai… | 83/100 | ★ 20k | Apache-2.0 | 14 Oct 2026 |
| #2 | onecli | Open-source sandboxed agent harness for teams. Giving every employee a secured personal agent. | 76/100 | ★ 3.6k | Apache-2.0 | 14 Oct 2026 |
| #3 | stride-gpt | An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodolog… | 67/100 | ★ 1.1k | MIT | 13 Oct 2026 |
| #4 | open-kritt | Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code. | 63/100 | ★ 2.3k | AGPL-3.0 | 12 Oct 2026 |
| #5 | AutoCVE | Agent-driven automated CVE discovery platform for source code auditing, vulnerability verification, and report generation. | 58/100 | ★ 1.2k | AGPL-3.0 | 1 Oct 2026 |
| #6 | BurpMCP-Ultra | AI-powered MCP server for Burp Suite Professional — 149 tools across proxy, scanner, inline fuzzer, race conditions, guided injection, JWT/IDOR attack… | 53/100 | ★ 272 | MIT | 28 Sept 2026 |
| #7 | zerobox | Lightweight, cross-platform process sandboxing powered by OpenAI Codex's runtime. Sandbox any command with file, network, and credential controls. | 39/100 | ★ 721 | Apache-2.0 | 17 May 2026 |
| #8 | pentest-agents | Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP serve… | 21/100 | ★ 1k | See repo | 12 Jun 2026 |
Source: each project's public GitHub repository (description, stars, license, last push). Listed tools aren't tested or ranked by AgentPick.
How to choose
- Grant the narrowest permissions the server allows.
- Check whether it runs locally or calls a remote service.
- Prefer servers listed in the official MCP registry.
Get the best new agent tools every week. Free, with a verdict on each. Get the weekly digest
Related
AI agent tools for local-first setups →
MCP servers
AI agent tools for knowledge graphs and bases →
MCP servers
AI agent tools for RAG (retrieval-augmented generation) →
MCP servers
AI agent tools for MCP client →
MCP servers
AI agent tools for cybersecurity →
MCP servers
AI agent tools for DevOps →
MCP servers
AgentPick Weekly
The week's new agent tools with a verdict on each, every week. Free. We'll email you a link to confirm, and you can unsubscribe any time. See our Privacy Policy.