Starred by over 6,500 users on GitHub and trusted by organizations including Toyota, CTFd has been the leading open-source platform for hosting cybersecurity competitions since 2015, providing everything needed to run professional Capture The Flag events through a clean web-based administration panel without touching a database query. The framework supports both individual and team-based competitions with automatic tie resolution, configurable score freezing, and scoregraphs comparing the top teams with detailed progress tracking. Challenge creation offers static and regex-based flags, dynamic scoring that adjusts point values based on solve count, unlockable hints purchasable with points, file attachments uploaded to local storage or Amazon S3-compatible backends, and challenge attempt limits with automatic bruteforce protection. Version 3.8 introduced challenge logic fields controlling flag submission behavior with any, all, and team modes, integrated dynamic scoring into the standard challenge type, participant ratings and reviews on challenges, and admin-stored challenge solutions viewable after competition. The Markdown-based content management system enables custom pages for rules, FAQs, and resources, while SMTP and Mailgun integration handles email confirmation and password recovery. The plugin architecture supports custom challenge types, flag validators, and scoring algorithms, while the theme system provides complete visual customization. Import and export functionality preserves entire competition configurations for archival and reuse across events. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

When cybersecurity instructors and competition organizers host Capture The Flag tournaments, GZCTF orchestrates isolated per-team challenge containers, dynamic anti-cheat flags, and live exponential scoreboards from a single web platform. Event administrators can configure four distinct challenge modes covering static attachments, team-specific dynamic attachments, shared static containers, and isolated dynamic containers where unique flags are injected into each team's environment at launch. A customizable exponential scoring engine adjusts point values automatically as more teams solve a problem while awarding first, second, and third blood bonuses to top contenders. Built-in flag-sharing detection monitors every submission in real time, flagging suspicious cross-team flag reuse alongside live event streams and container logs. Participants can group into divisions, track their ranking trajectory on interactive score timelines, and upload post-game writeups directly into the portal for organizer review and batch archiving. Built-in network proxying forwards challenge traffic over WebSocket tunnels with optional packet capture so referees can audit exploit payloads during active matches. Multi-language localization, customizable branding, invitation gates, and email domain restrictions adapt the portal to university courses, corporate security drills, or international tournaments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Promptfoo replaces vibes-based prompt tweaking with measurable tests, then attacks your AI app the way a hostile user would. An evaluation matrix lines up every prompt and model side by side, with pass or fail badges, assertion messages, latency, token counts, and cost in each cell. A red team wizard walks through the target, application details, plugins, and strategies, then probes for prompt injection, data exposure, broken access control, and harmful content. Preset bundles map plugins to the OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS, GDPR, ISO 42001, and the EU AI Act. Meta Agent and Hydra Multi-Turn strategies adapt attacks across a whole conversation instead of firing one-shot prompts. Providers span OpenAI, Anthropic, Gemini, Bedrock, Azure, and local Ollama models, and any HTTP endpoint, Python script, or JavaScript function can be tested as a target. The history page lists every run with pass rates and raw scores, and prompt and dataset pages show which templates and test sets each run used. A provider allowlist file narrows the models offered in the web editor for cost control. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Your AI coding agent has your API keys in its environment and unrestricted network access, which means one prompt injection away from sending those secrets anywhere. Pipelock closes that gap by sitting as a proxy between your agents and every outbound connection, scanning the actual content of HTTP, WebSocket, MCP, and Agent-to-Agent traffic before it leaves your server. An 11-layer scanner pipeline checks every request against 62 credential patterns covering AWS, GCP, Azure, GitHub, OpenAI, Anthropic, SSH keys, and database URLs, then inspects every response for prompt injection using 29 detection patterns with six-pass normalization that catches base64-encoded, leetspeak, and whitespace-obfuscated payloads. The MCP proxy wraps any Model Context Protocol server (stdio, HTTP, or WebSocket) with bidirectional scanning that detects tool description poisoning and mid-session rug-pull changes via SHA-256 fingerprinting. Every scanning decision produces a cryptographically signed action receipt that third parties can verify offline without trusting the agent or the vendor. The Operator Console provides a web dashboard for reviewing evidence scorecards, receipt timelines, agent sessions, enforcement decisions, and fleet posture at a glance. Cross-request taint tracking catches slow-drip exfiltration attempts that spread a secret across multiple calls. Canary tokens plant synthetic secrets that trip alerts the moment an agent tries to exfiltrate them. Pre-built Prometheus metrics and a Grafana dashboard provide real-time visibility into traffic volumes and block rates. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Put a checkpoint in front of every tool call your AI agents make, so a poisoned web page or file cannot quietly move money or send private data. Each call is classified and policy-checked before it executes, then allowed, blocked, or held for a person. Held calls land in an approvals queue that shows what the user asked, which passage the agent read, and the exact recipient or amount in question, with one-click block or allow. Instruction provenance flags destinations that appeared only in untrusted content, like an IBAN hidden in a file. The cockpit lists every run as a timeline of steps with verdicts, groups violations by the protection that caught them, and scores ten attack surfaces on a Security 360 page. An agent registry tracks owners, scope, and call counts. Budgets, anomaly alerts, and a kill switch cap runaway behavior. Sensitive values are redacted from traces, signed receipts prove a call was allowed, and exports produce PDF and CSV audit evidence. Python and TypeScript SDKs plug in with one line, or an LLM proxy catches calls with an environment variable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Prismor sits between your AI coding agents and the tools they want to use, judging every shell command, file read, and API call before it runs so a helpful agent cannot quietly become a destructive one. Run it in observe mode to watch what agents actually do across every workspace, then switch chosen rules to enforce and block secret leaks, prompt-injection pivots, privilege escalation, and risky package installs before execution. When a call is sensitive rather than forbidden, Prismor can pause it for human approval, letting a person decide instead of the model. Plain-language prompt guardrails such as never push to main are added to the agent context per agent and per session, and edits are picked up on the next prompt. Every action lands in a hash-chained, Ed25519-signed audit trail you can verify later, while the web dashboard breaks down sessions, findings, friction, and token spend so you can see where runs went wrong. Agents that cannot be hooked are still governed through the LLM proxy or the MCP gateway, which evaluates each tool call and scans responses for injected instructions before the model sees them. Honeytoken canary files trip a critical finding the moment an agent reads them, catching reconnaissance early. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Point an AI pentesting crew at a web app you own and watch it hunt: BugTraceAI plans the checks, sends specialist agents after each weakness class, and brings back evidence you can inspect. A scan moves through six visible phases, from crawling and endpoint discovery through strategy, exploitation and validation, and ends in a findings table where every result carries a severity, a CVSS score and a confirmed status. The web dashboard follows the hunt live as a graph of specialists branching from a coordinating agent, and its API discovery workspace brute-forces routes and loads the interesting ones straight into a scan. Analysts get their own toolbox of more than twenty utilities for poking HTTP traffic by hand, an AI repeater for replaying requests, and ModelLab for comparing models on cost and results. Findings download as a ZIP with the full report, and a terminal workspace with pipeline, findings, agents, timeline and logs views suits keyboard-driven work. Bring your own model through OpenRouter, Anthropic, Z.ai or a local endpoint, and aim the whole suite at the bundled BugStore practice shop when you want to rehearse safely. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Watchtower puts AI-driven security assessments into one web console, where sessions probe your attack surface while every request, finding, and piece of evidence is captured as it happens. The AI session console follows the attack surface, session progress, tool calls, and findings as an assessment runs, so you can watch an engagement unfold instead of reading a log afterwards. A built-in proxy workflow records HTTP and HTTPS traffic history with highlighted patterns, and any captured request can be sent to the Repeater for editing, replay, and response comparison. Mobile work is covered too: connect phones over USB or wireless, capture app traffic separately from accessibility control, and import WeChat mini-program packages to configure an assessment session. A public vulnerability intelligence library can be searched by component, severity, and source and kept synchronized locally, giving assessments current context without sending your targets anywhere. Findings are managed by source, severity, and status, each linked back to its supporting evidence, and the report editor assembles them with a live preview, impact notes, and remediation guidance. The dashboard tracks assets, tasks, AI sessions, token usage, and runtime resources, and task admission is budgeted against physical memory so heavy scans do not starve the host. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Hunting for the hole is only half the job, because a scanner alert nobody believes wastes more time than the bug itself. Add a domain, CIDR, or bug-bounty scope and Reconner builds the map first: passive and active subdomain enumeration, live HTTP probing and fingerprinting, JavaScript analysis that digs endpoints, secrets, and API keys out of bundles, plus parameter and hidden-param discovery. Then it attacks what it mapped with a context-aware engine covering reflected, stored, and DOM XSS, SQL, NoSQL, SSRF, IDOR, LFI, SSTI, XXE, injection, and open redirects, and every candidate has to survive differential, out-of-band, or control-based proof, re-verified before it is ever reported. Blind issues are not dropped either: OAST callbacks catch out-of-band SSRF, RCE, SQLi, and SSTI that never respond inline. Networks get the same treatment, with port scanning, service detection, network-CVE checks, and IP-camera auditing. Findings land in a live dashboard streamed over WebSocket, with an attack-path view, coverage ledger, monitoring diffs, and HTML, Markdown, and PDF reports, while Telegram can alert you and even start, stop, or resume scans remotely. Run it only against assets you own or are authorized to test; behind a VPN and TLS it becomes your private proving ground. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Xalgorix delivers AI-driven penetration testing that proves vulnerabilities exist rather than guessing, pairing an autonomous LLM agent with an independent exploit verifier that re-exploits every finding before it reaches your report. The 22-phase methodology mirrors how a skilled human pentester works through an engagement, covering reconnaissance, subdomain enumeration, port scanning, web crawling, parameter fuzzing, SQL injection testing, XSS detection, authentication bypass, API testing, and more. Select all phases or pick specific ones per target. The platform ships with 85+ offensive security tools preinstalled (nmap, nuclei, httpx, subfinder, katana, ffuf, gobuster, sqlmap, masscan, dalfox, feroxbuster) plus 14 built-in agent tools for browser automation, terminal execution, and note-taking. Connect your own LLM provider (OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, or MiniMax) so no scan data or target information leaves your infrastructure. The web dashboard on port 9137 provides live WebSocket telemetry showing tool calls, agent reasoning, and findings as scans progress. A findings index with CVSS scoring and severity filters organizes results, and branded PDF reports include your company name and logo. Wildcard and multi-target scans handle red team attack-surface mapping, while source-code scanning audits repositories directly without requiring a deployed target. A REST API enables scripted scans and SIEM pipeline integration, and webhooks push notifications to Discord or Telegram. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Autonomous red team execution without manual script coordination is what PentaGI delivers through a multi-agent penetration testing platform engineered for automated security assessments. Security engineers configure testing scopes, target IP ranges, domain lists, and rules of engagement through an interactive web console with real-time execution graphs. Autonomous agent personas break down high-level assessment goals into discrete tactical phases, orchestrating network port discovery, service banner fingerprinting, web application crawling, and CVE verification. Specialized agents query integrated Graphiti knowledge graphs and local vulnerability repositories to synthesize attack paths, validate exploitability, and confirm finding veracity before issuing alerts. Operators monitor live agent terminal streams, inspect sandboxed tool executions, and adjust active LLM provider routes across OpenAI, Anthropic, or local Ollama endpoints. The template editor allows red teams to compose reusable testing playbooks with customizable security prompt chains, safety constraints, and automated remediation reporting. Audit logs capture full command histories, raw tool outputs, and LLM reasoning steps to generate compliance-ready technical documentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

One endpoint for every MCP server you run: MCPHub gathers local and remote Model Context Protocol servers behind stable URLs, so AI clients connect once and see what you allow. Claude Code, Cursor, and Cherry Studio can use four routes: everything at /mcp, a named group at /mcp/{group}, one server at /mcp/{server}, or semantic tool search at /mcp/$smart. Smart routing runs vector search on PostgreSQL with pgvector and an OpenAI-compatible key, so the model gets a shorter tool list. Servers attach over stdio, SSE, or streamable HTTP, OpenAPI services can be wrapped as MCP tools, and changes apply without downtime. In the other direction, MCP tools can be exported as an OpenAPI 3.0.3 spec for OpenWebUI and other OpenAPI clients. Bearer keys, OAuth 2.0 (client and server modes), and GitHub or Google sign-in in database mode control access, with per-user visibility for servers and groups. Encrypted per-user credentials let one shared server use each person's own key. Logs show tool-call activity, request status, and latency, health checks track each connection, and the dashboard controls which tools, prompts, and resources each server exposes. Large text tool results can be compressed, interactive MCP Apps are proxied through MCPHub routes, and a built-in market lets you browse a server catalog. Typical uses include a team-wide gateway, per-project groups, and direct single-server routes for debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Preloop is a self-hostable control plane that governs every AI agent tool call and model call, and can run ticket-triggered agent work that returns as reviewable pull requests. An MCP firewall can allow, deny, or hold any tool call for approval, with require-justification rules written as YAML and CEL policy. Human approvals arrive on mobile, watch, Slack, Mattermost, email, webhook, or the command line, and agents can ask a person a question before continuing. The model gateway speaks OpenAI, Anthropic, and Gemini formats, applies budgets and allowed-model lists, and attributes token spend by model, agent, session, API key, flow, and user. Flows start agents from GitHub, GitLab, Bitbucket Cloud, Jira, webhooks, or CI jobs, in hosted containers or on private runners that connect over an outbound WebSocket. Twenty-one presets review pull requests, implement issues, triage tickets, scan for vulnerabilities, and collect evidence packs. Operators can steer a running agent from the console, phone, or watch with notes, then review the resulting pull request. One session timeline records tool calls, model calls, policy decisions, approvals, spend, outcomes, and synchronized recordings. Fleet Map shows people, devices, agents, models, and observed work in one view. An account kill switch blocks gateway and tool traffic and stops managed runs, with audited recovery. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

One endpoint for every model account you own: 9Router Pro sits between your applications and a fleet of LLM providers, decides which account answers each request, and keeps the whole operation visible on a live dashboard. Its signature trick is prompt injection scoped three ways, globally, per API key, or per model, delivered either as a system prompt or as a scripted chat history that primes the model far harder than instructions alone. Keys are products here: each carries a rolling token budget over 24 hours, 7 days, or 30 days plus rate limits per minute, hour, and day, so a resold plan enforces itself with polite 429 responses. Routing stays healthy on its own, with accounts tiered as clean, suspect, or cooldown, least-recently-used spreading across the fleet, flaky upstream responses retried against the next account, and proxy pools health-checked with one-click cleanup of the dead. The monitoring dashboard leads with VPS specs, fastest and most-used providers, top API key, and usage spectrum charts, while backup and restore cover providers, combos, keys, and settings section by section. Everything runs as a single application with one SQLite file and a dashboard localized into 34 languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.