The Best GitHub Repos for AI Builders and Security Teams in 2026
Most best GitHub repos lists are written for people learning to code. This one is for the people who have to ship AI features and then defend them to a customer security questionnaire or an auditor. Every repo below is something we would put in front of a founder, a platform engineer or a GRC lead, and every entry says what it is for, how to try it in one command, which controls it helps you evidence, and where it falls short.
We checked every repo against its own README and the GitHub API on the date at the top of this page. Star counts are live figures from that check, not rounded marketing numbers. Three repos that would have made this list a year ago are gone, and the section at the end explains why, because an unmaintained dependency is a finding in its own right.
Stars and activity from the GitHub API, checked 2026-09-25
The list at a glance
| # | Repo | What it is for | Stars |
|---|---|---|---|
| 1 | Claude Code | Anthropic’s agentic coding tool for the terminal, IDE and CI. | 147,986 |
| 2 | OpenAI Codex CLI | OpenAI’s open source coding agent that runs locally in your terminal. | 126,363 |
| 3 | MCP reference servers | The reference Model Context Protocol servers maintained by the MCP steering group. | 90,582 |
| 4 | n8n | Self-hostable workflow automation with native AI agent nodes and 400+ integrations. | 205,896 |
| 5 | Ollama | The simplest way to run open weight models on a laptop or server. | 181,654 |
| 6 | vLLM | The high-throughput inference engine behind most serious self-hosted LLM deployments. | 92,645 |
| 7 | LiteLLM | An AI gateway that puts 100+ model providers behind one OpenAI style API. | 59,579 |
| 8 | Langfuse | Open source tracing, evals and prompt management for LLM applications. | 35,026 |
| 9 | Promptfoo | Evals and automated red teaming for prompts, agents and RAG, run from the command line or CI. | 25,428 |
| 10 | garak | NVIDIA’s LLM vulnerability scanner, a probe library for model level weaknesses. | 9,350 |
| 11 | NeMo Guardrails | Programmable input, output, dialog and retrieval rails for LLM applications. | 7,188 |
| 12 | Presidio | Detect, redact and anonymise personal data in text, images and structured data. | 11,028 |
| 13 | Gitleaks | Fast secret scanning for git history, directories and stdin. | 29,472 |
| 14 | Trivy | One scanner for vulnerabilities, misconfigurations, secrets and SBOMs across images, code and clusters. | 38,068 |
| 15 | Semgrep | Fast static analysis with rules that look like the code they match. | 16,756 |
| 16 | zizmor | Static analysis for GitHub Actions workflows. | 6,574 |
| 17 | Prowler | Open source cloud security posture checks mapped to SOC 2, ISO 27001, PCI DSS and more. | 14,863 |
| 18 | Checkov | Policy as code scanning for Terraform, CloudFormation, Kubernetes, Helm and more. | 9,028 |
| 19 | Open Policy Agent | A general purpose policy engine for authorisation, admission control and CI gates. | 12,270 |
| 20 | Wazuh | Open source SIEM and XDR with file integrity, configuration assessment and compliance mapping. | 16,992 |
Swipe sideways to compare columns
Coding agents and agent plumbing
The tools that now write and run a meaningful share of production code, and the protocol and workflow layers that connect them to everything else.
Claude Code
anthropics/claude-code · Anthropic commercial terms (not an open source licence)
Anthropic’s agentic coding tool for the terminal, IDE and CI.
Claude Code reads your codebase, edits files, runs commands and handles git from natural language instructions. The repository is where Anthropic ships the plugins, examples and issue tracker, and it is one of the most starred developer tools on GitHub. It is on this list because it is where a lot of your code is now being written, which makes its configuration a security control whether you planned it or not.
Key features
- Permission modes that decide which commands and edits need approval
- Hooks that run your own checks before or after tool calls
- MCP support for connecting internal tools and data
- A plugin system with marketplaces, installable per project or per user
Try it
curl -fsSL https://claude.ai/install.sh | bashControls it helps evidence
ISO 27001 A.8.28 secure coding and A.8.32 change management, SOC 2 CC8.1, ISO 42001 Annex A AI system lifecycle
Honest take
The best general purpose coding agent we have used, and the hooks and permission settings are the part most teams skip. Commit a shared settings file with the permission rules you actually want, and treat plugins as third party code: Plugin4Shell in September showed that a pinned plugin is only as safe as the agent’s check that the pin landed.
Cons
Not open source, so you cannot audit or fork the CLI itself. Usage needs a paid Anthropic plan or API spend, and costs scale with how much autonomy you give it.
OpenAI Codex CLI
openai/codex · Apache 2.0
OpenAI’s open source coding agent that runs locally in your terminal.
Codex CLI is a Rust agent that plans, edits and runs code on your machine, with the same agent available in the ChatGPT app, IDE extensions and the cloud. Unlike most commercial agents the CLI is genuinely open source under Apache 2.0, so your security team can read exactly what it does with your files and your shell.
Key features
- OS level sandboxing of commands on macOS and Linux
- Approval modes from read only to full auto
- Works with a ChatGPT plan or an API key
- MCP client support and a non-interactive mode for CI
Try it
npm install -g @openai/codexControls it helps evidence
ISO 27001 A.8.28 and A.8.32, SOC 2 CC8.1, ISO 42001 Annex A AI system lifecycle
Honest take
The sandbox is the reason to look at Codex if you care about blast radius: it constrains what a command can touch at the operating system level rather than trusting the model to ask first. Being Apache 2.0 also makes it the easiest coding agent to put through a proper supplier review.
Cons
Tuned for OpenAI models first. It shared the Plugin4Shell plugin pinning flaw with other agents, so check you are on a patched release.
MCP reference servers
modelcontextprotocol/servers · Apache 2.0 (moving from MIT, older contributions remain MIT)
The reference Model Context Protocol servers maintained by the MCP steering group.
The Model Context Protocol is now the standard way to give agents tools and data, and this repo holds the small set of reference servers: filesystem, git, fetch, memory, time, sequential thinking and a test server called everything. It used to list hundreds of community servers. Those now live in the MCP Registry, and many older reference servers moved to an archive repo.
Key features
- Reference implementations in TypeScript and Python
- Examples of tools, resources and prompts
- A test server that exercises every protocol feature
- Links to the official MCP Registry for discovery
Try it
npx -y @modelcontextprotocol/server-memoryControls it helps evidence
ISO 27001 A.5.15 access control and A.5.19 supplier relationships, SOC 2 CC6.1, ISO 42001 AI system inventory
Honest take
Read these to understand how MCP servers should be built, not to run them in production. The README says so directly: they are educational reference implementations, and you are expected to add your own safeguards for your own threat model. That sentence belongs in your AI acceptable use policy.
Cons
Deliberately small and not hardened. If you want a list of every MCP server out there, the Registry is now the place, and a listing there is not a security review.
n8n
n8n-io/n8n · Sustainable Use License (fair-code, not OSI open source)
Self-hostable workflow automation with native AI agent nodes and 400+ integrations.
n8n is the most starred repo on this list, and for good reason: it lets operations teams wire LLM calls into real business processes with a visual editor, drop into code when they need to, and keep the whole thing on their own infrastructure. For regulated teams, self-hosting is the feature, because customer data never has to leave your environment to reach an automation vendor.
Key features
- Visual workflow builder with JavaScript and Python code nodes
- AI agent, memory and tool nodes built on LangChain
- 400+ integrations plus generic HTTP and webhooks
- Self-host with Docker or use n8n Cloud
Try it
docker run -it --rm --name n8n -p 5678:5678 -v n8n_data:/home/node/.n8n docker.n8n.io/n8nio/n8nControls it helps evidence
ISO 27001 A.5.23 cloud services and A.8.32 change management, SOC 2 CC6.1 and CC8.1, PCI DSS Requirement 6
Honest take
Excellent, and dangerous in exactly the way spreadsheets were: anyone can build a workflow that moves customer data to a model with a stored credential. Put workflows in source control, review them like code, and keep an inventory of which credentials each one uses.
Cons
The licence restricts offering n8n itself as a service, so check it before building a product on top. Some team features such as SSO and environments sit in paid editions.
Run, route and observe models
Self-hosted inference, a gateway to put in front of every provider, and the tracing you need before anyone asks what the model actually said.
Ollama
ollama/ollama · MIT
The simplest way to run open weight models on a laptop or server.
Ollama wraps model download, quantisation and serving into one binary with a local API, and it runs the major open weight families including Gemma, Qwen, DeepSeek and gpt-oss. For compliance teams it is the fastest way to keep a sensitive workload entirely on hardware you control, for example classifying documents that are not allowed to leave the building.
Key features
- One command to pull and run a model
- Local REST API plus OpenAI compatible endpoints
- Runs on macOS, Windows and Linux, CPU or GPU
- Modelfiles to pin a model, parameters and system prompt
Try it
curl -fsSL https://ollama.com/install.sh | shControls it helps evidence
ISO 27001 A.5.34 privacy and protection of PII and A.8.20 network security, ISO 42001 data for AI systems
Honest take
The default is safe because it binds to localhost. The incidents come from people exposing port 11434 to a network so a colleague can use it, and the API has no authentication. If it needs to be shared, put it behind a gateway with auth, which is what the next two entries are for.
Cons
Built for convenience, not throughput. For many concurrent users vLLM is the better server, and running open weight models means you now own model version control and evaluation too.
vLLM
vllm-project/vllm · Apache 2.0
The high-throughput inference engine behind most serious self-hosted LLM deployments.
vLLM serves open weight models at production scale using PagedAttention and continuous batching, and exposes an OpenAI compatible API so application code does not need to change. If your plan is to self-host a model for data residency or cost reasons, this is the engine you will most likely end up running.
Key features
- PagedAttention and continuous batching for high throughput
- OpenAI compatible server out of the box
- Tensor and pipeline parallelism across GPUs
- Broad support for quantisation formats and hardware
Try it
pip install vllmControls it helps evidence
ISO 27001 A.8.6 capacity management and A.8.9 configuration management, ISO 42001 AI system operation
Honest take
Genuinely production grade, and the operational burden is the real cost. Self-hosting shifts GPU capacity, patching and model provenance from a vendor’s SOC 2 report onto yours, so budget for that before celebrating the lower token price.
Cons
GPU first and heavy to operate. Configuration is deep, and a fast moving release cadence means you need a real upgrade and regression process.
LiteLLM
BerriAI/litellm · MIT core, enterprise directory separately licensed
An AI gateway that puts 100+ model providers behind one OpenAI style API.
LiteLLM is both a Python SDK and a proxy server. Run the proxy and every team calls one endpoint, with virtual keys, per team budgets, spend tracking, logging and guardrail hooks applied centrally. It turns scattered provider keys into one controlled egress point, which is the fix for most of the shadow AI problems we write about.
Key features
- One API across OpenAI, Anthropic, Bedrock, Vertex, Azure and self-hosted models
- Virtual keys with budgets and rate limits per team or project
- Spend tracking and request logging to your own database
- Fallbacks, retries and load balancing across deployments
Try it
uv tool install 'litellm[proxy]'Controls it helps evidence
ISO 27001 A.5.15 access control, A.8.15 logging and A.8.16 monitoring, SOC 2 CC6.1 and CC7.2, ISO 42001 AI system inventory
Honest take
A gateway is the single most useful AI control you can deploy, and LiteLLM is the most complete open source one. It is also a reminder of why the next section exists: in March 2026 attackers used a compromised Trivy GitHub Action in LiteLLM’s CI to steal its PyPI token and publish backdoored versions 1.82.7 and 1.82.8, and the proxy itself has had several security advisories this year, including SSRF and an MCP authentication bypass. Pin versions, verify hashes, patch quickly and treat the component that holds every provider key as your most sensitive dependency.
Cons
SSO, audit logs and some admin features sit in the enterprise tier. It becomes a critical path service, so it needs the same availability and patching discipline as your API gateway.
Langfuse
langfuse/langfuse · MIT core, ee directories separately licensed
Open source tracing, evals and prompt management for LLM applications.
Langfuse records every model call, tool call and agent step as a trace, with cost, latency and the exact prompt and output. On top of that it runs evaluations and manages prompt versions. It is now owned by ClickHouse, and it remains self-hostable, which matters when the traces contain customer data.
Key features
- Traces for LLM calls, tools and multi step agents
- Evaluations with LLM as judge, human annotation and datasets
- Prompt management with versioning and rollout
- SDKs for Python and TypeScript plus OpenTelemetry support
Try it
git clone https://github.com/langfuse/langfuse.git && cd langfuse && docker compose upControls it helps evidence
ISO 27001 A.8.15 logging, SOC 2 CC7.2, EU AI Act Article 12 record keeping, ISO 42001 AI system monitoring
Honest take
If a customer or regulator asks what your AI feature said to someone on a given day, this is how you answer. Decide your trace retention and redaction rules on day one, because a tracing tool that stores full prompts is also a new store of personal data.
Cons
Self-hosting v3 means running Postgres, ClickHouse, Redis and blob storage, which is more than a quick docker compose suggests for production. Some features sit under the enterprise licence.
Test and guard AI applications
Red teaming, vulnerability scanning, runtime guardrails and PII handling for LLM features, the layer most teams still test by hand.
Promptfoo
promptfoo/promptfoo · MIT
Evals and automated red teaming for prompts, agents and RAG, run from the command line or CI.
Promptfoo lets you describe test cases in a YAML file and run them against any model, then generates adversarial attacks such as prompt injection, jailbreaks and data exfiltration against your own application. OpenAI agreed to acquire Promptfoo in March 2026 and committed to keeping the open source tool under its current licence.
Key features
- Declarative test suites that compare models and prompts side by side
- Red team plugins mapped to OWASP LLM Top 10 and other frameworks
- CI integration that fails a build on regressions
- Runs locally, so test data does not need to leave your machine
Try it
npx promptfoo@latest initControls it helps evidence
ISO 27001 A.8.29 security testing, SOC 2 CC7.1 and CC8.1, ISO 42001 AI system verification and validation, EU AI Act Article 15
Honest take
The quickest way to turn we tested the chatbot into a repeatable artefact with a date and a pass rate. Wire the red team run into CI so every prompt or model change produces evidence, rather than running it once before launch.
Cons
Now owned by a model vendor, which some buyers will want to note in a supplier review even with the licence commitment. Generated attacks need human triage to separate real issues from noise.
garak
NVIDIA/garak · Apache 2.0
NVIDIA’s LLM vulnerability scanner, a probe library for model level weaknesses.
garak works like a network vulnerability scanner for language models. It fires a large library of probes at a model, covering prompt injection, encoding tricks, jailbreaks, data leakage and toxicity, and uses detectors to decide whether each attempt landed. Where Promptfoo is strongest on your application, garak is strongest on the model underneath it.
Key features
- Large probe library across injection, jailbreak, leakage and misuse
- Targets for OpenAI, Hugging Face, Bedrock, REST endpoints and more
- Detectors that score each probe automatically
- Reports in JSONL for tracking results over time
Try it
python -m pip install -U garakControls it helps evidence
ISO 27001 A.8.29 security testing, ISO 42001 AI system verification and validation, EU AI Act Article 15 robustness
Honest take
Most useful when you are choosing or self-hosting a model and need evidence that you compared candidates on something other than benchmarks. Run it against a new model before it goes into your gateway, and keep the report with the approval.
Cons
A full run is slow and can be expensive against paid APIs. Results describe the model, not your application, so pair it with application level testing.
NeMo Guardrails
NVIDIA-NeMo/Guardrails · Apache 2.0
Programmable input, output, dialog and retrieval rails for LLM applications.
NeMo Guardrails sits between your application and the model and enforces rules you define: block certain topics, check inputs for jailbreak attempts, fact check outputs against retrieved sources, or require a tool call before an answer. Rails are written in Colang, a small language for describing conversation flows, plus Python actions.
Key features
- Input, output, dialog, retrieval and execution rails
- Built in jailbreak, moderation and hallucination checks
- Colang for describing allowed conversation flows
- Integrates with LangChain and most model providers
Try it
pip install nemoguardrailsControls it helps evidence
ISO 42001 Annex A controls for AI system operation, EU AI Act Article 14 and 15, ISO 27001 A.8.28
Honest take
The right tool when a policy needs to be enforced in code rather than hoped for in a system prompt. Keep the rail configuration in the same repo and review process as the application, because a rail change is a behaviour change.
Cons
Colang has a learning curve, and each rail that calls a model adds latency and cost. Rails reduce risk, they do not remove it, so keep testing with the tools above.
Presidio
data-privacy-stack/presidio · MIT
Detect, redact and anonymise personal data in text, images and structured data.
Presidio finds PII such as names, emails, phone numbers, card numbers and national identifiers using a mix of NLP models, patterns and checksums, then masks, replaces or encrypts it. It started life at Microsoft as microsoft/presidio and now lives under the data-privacy-stack organisation. For AI teams it is the standard way to scrub prompts, logs and training data before they reach a model or a trace store.
Key features
- Analyzer for PII detection with configurable recognisers
- Anonymizer for masking, replacement, hashing and encryption
- Image redaction, including DICOM medical images
- Custom recognisers for your own identifiers
Try it
pip install presidio_analyzer presidio_anonymizer && python -m spacy download en_core_web_lgControls it helps evidence
ISO 27001 A.5.34 PII protection and A.8.11 data masking, PCI DSS Requirement 3, ISO 42001 data for AI systems, GDPR data minimisation
Honest take
The component you add in front of a model when your data processing agreement says personal data should not go to the provider. Put it in your gateway or trace pipeline, not in each application, so there is one place to tune and evidence it.
Cons
Detection is probabilistic and needs tuning per language and data type, especially for Australian identifiers such as TFNs and Medicare numbers. Treat it as risk reduction, not a guarantee.
Secure the software supply chain
Secrets, dependencies, code and CI pipelines. The unglamorous controls that stopped being optional after this year of package compromises.
Gitleaks
gitleaks/gitleaks · MIT
Fast secret scanning for git history, directories and stdin.
Gitleaks scans commits and files for API keys, tokens and credentials using a large set of regex and entropy rules, and runs as a pre-commit hook, a CI step or a one off audit of a repository’s full history. With AI provider keys now worth real money to attackers, a leaked key is a billing incident as well as a security one.
Key features
- Scans full git history, a directory or piped input
- Hundreds of built in rules plus custom TOML rules
- Baselines so you can adopt it on an old repo without noise
- Pre-commit hook and GitHub Action
Try it
brew install gitleaks && gitleaks git -vControls it helps evidence
ISO 27001 A.5.17 authentication information and A.8.4 access to source code, SOC 2 CC6.1, PCI DSS Requirement 8
Honest take
The first tool on this list we would install, because it takes five minutes and finds something in almost every older repo. Run it on history once, rotate what it finds, then keep it in pre-commit so it stays clean.
Cons
It tells you a string looks like a secret, not that the secret is live. TruffleHog verifies credentials against the provider, which is useful for triage, under the more restrictive AGPL licence.
Trivy
aquasecurity/trivy · Apache 2.0
One scanner for vulnerabilities, misconfigurations, secrets and SBOMs across images, code and clusters.
Trivy scans container images, filesystems, repositories, Kubernetes clusters and infrastructure as code, and can generate or consume SBOMs in CycloneDX and SPDX. For a small team it replaces three or four separate tools with one binary and one report format.
Key features
- Vulnerability scanning for OS packages and language dependencies
- Misconfiguration checks for Terraform, Kubernetes and Dockerfiles
- Secret scanning and licence detection
- SBOM generation for EU Cyber Resilience Act and customer requests
Try it
brew install trivy && trivy fs --scanners vuln,secret,misconfig .Controls it helps evidence
ISO 27001 A.8.8 technical vulnerabilities, SOC 2 CC7.1, PCI DSS Requirements 6.3 and 11.3, EU Cyber Resilience Act SBOM expectations
Honest take
Still the best all in one open source scanner. It is also the clearest lesson of 2026. In March attackers published a malicious Trivy 0.69.4 release and force-pushed 76 of the 77 version tags in trivy-action, plus every tag in setup-trivy, to point at credential stealing code (CVE-2026-33634). Anyone referencing those actions by tag ran the attacker’s code, and the secrets it stole led to the backdoored LiteLLM releases. Workflows pinned to a full commit SHA were not affected. Pin every action that way, and scope CI tokens so a scanner cannot publish your packages.
Cons
Vulnerability output is noisy without triage rules. The deeper cloud and runtime features are in Aqua’s commercial platform.
Semgrep
semgrep/semgrep · LGPL 2.1 engine, rules under a separate licence
Fast static analysis with rules that look like the code they match.
Semgrep finds bugs and insecure patterns across 30+ languages using rules that read like source code, which means security engineers and developers can both write them. It is well suited to catching the specific mistakes your own codebase keeps making, including ones introduced by coding agents.
Key features
- Pattern based rules that are easy to read and write
- Large public rule registry, including OWASP Top 10 coverage
- Fast enough to run on every pull request
- Autofix suggestions for many rules
Try it
brew install semgrep && semgrep scan --config autoControls it helps evidence
ISO 27001 A.8.28 secure coding and A.8.29 security testing, SOC 2 CC8.1, PCI DSS Requirement 6.2
Honest take
The best way to encode we never do X here as a check that runs on every change, which matters more now that a coding agent writes a lot of the code. Start with the default rules, then add a handful of custom rules for your own footguns.
Cons
Cross file and cross function analysis are in the paid tier. Semgrep changed the licence on its maintained rules in late 2024, which led to the community Opengrep fork, so check what you are allowed to do with the rules before redistributing them.
zizmor
zizmorcore/zizmor · MIT
Static analysis for GitHub Actions workflows.
zizmor audits your .github/workflows files for the mistakes attackers actually exploit: template injection from untrusted input, over broad token permissions, unpinned third party actions, cache poisoning and credentials persisted into artifacts. After a year in which compromised actions were the entry point for several major package attacks, it is the fastest way to find out how exposed your pipelines are.
Key features
- Template injection and dangerous trigger detection
- Excessive permissions and credential persistence checks
- Unpinned and impostor action detection
- SARIF output for GitHub code scanning
Try it
brew install zizmor && zizmor .Controls it helps evidence
ISO 27001 A.8.25 secure development lifecycle and A.8.32 change management, SOC 2 CC8.1, PCI DSS Requirement 6
Honest take
Run it once on your busiest repo and you will almost certainly find an action pinned to a tag and a workflow with write permissions it does not need. It pairs directly with the Trivy lesson above: pinning is the control, and zizmor tells you where it is missing.
Cons
GitHub Actions only. It will not catch a pinned SHA that points at malicious code, so pinning still needs a review step.
Compliance and cloud posture as code
Open source scanners and policy engines that map findings to SOC 2, ISO 27001 and PCI DSS, and produce evidence an auditor can re-run.
Prowler
prowler-cloud/prowler · Apache 2.0
Open source cloud security posture checks mapped to SOC 2, ISO 27001, PCI DSS and more.
Prowler runs hundreds of checks against AWS, Azure, Google Cloud, Kubernetes, Microsoft 365, GitHub and other providers, and maps each finding to compliance frameworks. On AWS alone it ships 662 checks and 50 frameworks, including SOC 2, ISO 27001:2022 and PCI DSS 4.0, which makes it the closest open source equivalent to the cloud tests inside Vanta or Drata.
Key features
- CLI, API and web UI
- Compliance reports per framework with pass and fail per control
- Checks across major clouds, Kubernetes, M365 and GitHub
- Outputs to CSV, JSON, OCSF and AWS Security Hub
Try it
pip install prowler && prowler aws --compliance soc2_awsControls it helps evidence
SOC 2 CC6 and CC7, ISO 27001 A.5.23 cloud services and A.8.9 configuration management, PCI DSS Requirements 1, 2 and 10
Honest take
If you are preparing for a first SOC 2 or ISO 27001 audit on AWS, run this before you buy anything. The report tells you how far you are from a clean cloud baseline, and a dated, re-runnable scan is good evidence in its own right.
Cons
A posture scanner, not a compliance programme: it does not do policies, vendor reviews, access reviews or auditor workflow. Expect a long first report that needs triage.
Checkov
bridgecrewio/checkov · Apache 2.0
Policy as code scanning for Terraform, CloudFormation, Kubernetes, Helm and more.
Checkov scans infrastructure as code before it is deployed and flags misconfigurations such as public buckets, unencrypted storage and over permissive security groups. It shifts the same checks Prowler runs against live cloud accounts left into the pull request, where fixing them is cheap.
Key features
- Over a thousand built in policies across major clouds
- Terraform plan scanning, not just static files
- Custom policies in Python or YAML
- Inline suppressions with a written justification
Try it
pip install checkov && checkov -d .Controls it helps evidence
ISO 27001 A.8.9 configuration management and A.8.27 secure architecture, SOC 2 CC8.1, PCI DSS Requirements 1 and 2
Honest take
Most useful when you treat suppressions as the real output. Every skipped check should carry a reason in the code, which gives an auditor a clear record of accepted risk instead of a wall of red.
Cons
Noisy by default, and teams often give up on it rather than baselining. Owned by Palo Alto Networks through the Bridgecrew acquisition, so some features point toward Prisma Cloud.
Open Policy Agent
open-policy-agent/opa · Apache 2.0
A general purpose policy engine for authorisation, admission control and CI gates.
OPA evaluates policies written in Rego against any JSON input, which lets you apply the same rules to Kubernetes admission, API authorisation, Terraform plans and CI pipelines. It is a CNCF graduated project and the usual answer when an organisation wants one policy language instead of a rule engine per tool.
Key features
- Rego policy language with a test framework
- Runs as a library, sidecar, daemon or CLI
- Gatekeeper for Kubernetes admission control
- Decision logs for audit trails
Try it
brew install opa && opa eval --data policy.rego --input input.json 'data.example.allow'Controls it helps evidence
ISO 27001 A.5.15 access control and A.8.9 configuration management, SOC 2 CC6.1 and CC8.1, ISO 42001 AI system operation
Honest take
Worth the learning curve once you have more than a couple of places where the same rule should apply. Decision logs are the underrated feature: they record every allow and deny with its input, which is exactly the evidence an access control audit asks for.
Cons
Rego is unfamiliar to most developers and takes time to learn well. For simple cases, a tool’s built in rules are faster to live with.
Wazuh
wazuh/wazuh · GPL 2.0
Open source SIEM and XDR with file integrity, configuration assessment and compliance mapping.
Wazuh collects logs and security events from endpoints, servers and cloud workloads, then adds file integrity monitoring, vulnerability detection and configuration assessment against CIS benchmarks. Alerts come mapped to PCI DSS, GDPR, HIPAA, NIST 800-53 and the SOC 2 trust services criteria, which is why it shows up in so many first time compliance programmes.
Key features
- Agents for Windows, macOS and Linux plus cloud log ingestion
- File integrity monitoring and configuration assessment
- Vulnerability detection across the fleet
- Dashboards and alerts mapped to compliance frameworks
Try it
curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -aControls it helps evidence
ISO 27001 A.8.15 logging and A.8.16 monitoring, SOC 2 CC7.2, PCI DSS Requirements 10 and 11.5
Honest take
The most capable free answer to how do you monitor for security events, and it covers several PCI DSS requirements that small teams otherwise pay a lot to meet. It is a platform to run, not a tool to install, so assign an owner and a weekly alert review from the start.
Cons
Heavy to operate at scale, with an indexer cluster to size and maintain. Out of the box alert volume is high and needs tuning before anyone will read it.
Dropped from the list, and why
If any of these are in your dependency inventory, they deserve a ticket.
- continuedev/continue: The README now says the repository is no longer actively maintained and read-only. Version 2.0.0 was the final release, so it should not be a new dependency.
- protectai/llm-guard: Now archived on GitHub, with its last commit in July 2026. It was a strong input and output scanner, and anyone still running it should plan a move to NeMo Guardrails or a gateway guardrail.
- strongdm/comply: An early open source SOC 2 policy framework with no push since July 2022. Fine for reading, not for running a compliance programme in 2026.
Near misses worth knowing
- trufflesecurity/trufflehog for verified secret detection
- anchore/syft for SBOM generation
- ggml-org/llama.cpp, the engine under many local runtimes
- open-webui/open-webui for a self-hosted chat interface
- CISOfy/lynis for host hardening audits
- usnistgov/OSCAL for machine readable control catalogues
- ossf/scorecard for scoring your dependencies
- sigstore/cosign for signing images and binaries
Frequently asked questions
How did you choose these repositories?
Are the star counts accurate?
Can open source tools replace Vanta, Drata or another compliance platform?
Is it safe to run AI coding agents like Claude Code or Codex on company code?
Which repo should a small team install first?
What is the most useful single control for AI risk?
Do open source security tools create their own supply chain risk?
Does the open source licence matter for a commercial product?
Turn the tools into evidence
- Compliance software matrix for what Vanta, Drata and the rest add on top of open source scanners
- Control-to-policy map to connect each tool to SOC 2, ISO 27001, ISO 42001 and PCI DSS controls
- ISO 42001 guide for the AI system inventory these tools feed
- AES Tech blog for the 2026 incidents referenced above
Get the AI tools shortlist
The tools worth paying for, the deals worth taking, a short, no-spam email.