Alternatives
Products that do what SandGuard Malware Analysis Platform does
Confidential Advanced Malware Analysis Platform
- 1
- 2MS
I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
2025 · github.com
- 3
- 4
- 5
- 6CT
When I came across a study that traced 4.5 million fake GitHub stars, it confirmed a suspicion I’d had for a while: stars are noisy. The issue is they’re visible, they’re persuasive, and they still shape hiring decisions, VC term sheets, and dependency choices—but they say very little about actual quality. I wrote StarGuard to put that number in perspective based on my own methodology inspired with what they did and to fold a broader supply-chain check into one command-line run. It starts with the simplest raw input: every starred_at timestamp GitHub will give. It applies a…
2025 · github.com
- 7
- 8
- 9TL
Hi HN, I spent the past year building this in my spare time because I got tired of enterprise security tools that cost $50K/year and don't understand Linux. TheProtector is a comprehensive security monitoring tool that actually runs on the systems we use (Linux) instead of being a Windows-first afterthought. Built it entirely on a $500 laptop because I believe good security shouldn't require unlimited budgets. Features: - Real-time process, network, and file monitoring - YARA malware detection with custom rules - eBPF kernel monitoring (when available) - Behavioral baseline…
2025 · github.com
- 10ZS
I'm excited to introduce Zerobox, a cross-platform, single binary process sandboxing CLI written in Rust. It uses the sandboxing crates from the OpenAI Codex repo and adds additional functionalities like secret injection, SDK, etc. Watch the demo: https://www.youtube.com/watch?v=wZiPm9BOPCg Zerobox follows the same sandboxing policy as Deno which is deny by default. The only operation that the command can run is reading files, all writes and network I/O are blocked by default. No VMs, no Docker, no remote servers. Want to block reads to /etc? zerobox…
Mar 2026 · github.com
- 11
- 12
- 13OT
hey guys, wanted to show one of my side projects i just made public. the idea is basically another osint tool for pentesters and bug bounty hunters. it watches certificate transparency logs and checks newly-seen domains for exposed stuff like .env files, open .git dirs, config files, db dumps and so on, and puts whatever it finds into a searchable db. you just search a domain (or part of one) and see what's exposed. it's read-only and free. one thing i've been thinking about adding is a way to register for certain keywords and get notified when something new shows up for that search. would…
Jul 2026 · search.cerast-intelligence.com
- 14
- 15IB
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com
- 16MS
Hi HN! We kept seeing devs get pwned through MCP tools in ways that security scanners completely miss. So we built an open-source analyzer to catch these attacks. Our first OSS by Mighty team. The problem: At Defcon, we saw MCP exploits with 100% success rate against Claude and Llama. Three attack patterns: Hidden Unicode in "error messages" - Paste a colleague's error into Claude, your SSH keys get exfiltrated Trusted tool updates - That database tool you've used for months? Last week's update added credential theft Tool redefinition - Malicious tool redefines "deploy to prod" to run…
2025 · github.com
- 17DO
2023 · github.com
- 18SJ
2022 · github.com
- 19
- 20DI
I built an open-source malware detection daemon that monitors all running processes in real-time using ML + heuristics. No kernel modules or eBPF required. Key points: - Polls /proc for new processes (works on any Linux kernel 2.6+) - Random Forest model trained on EMBER 2018 dataset (2.3M samples) - Heuristic rules for crypto miners, ransomware, rootkits - ~20MB RAM, <1% CPU, sub-millisecond scan latency - Pure C, zero runtime dependencies - Model embedded directly in binary (50KB) Why I built this: Existing solutions either require modern kernels (eBPF) or are heavy/proprietary.…
Nov 2025 · github.com
- 21
Discover and revoke risky SaaS integrations in 90 seconds
Apr 2026 · scopguard.com
- 22
Private, on-device AI that detects phishing before you tap
Aug 2026 · edgephishguard.web.app
- 23
AI-Powered Shield Against Digital Scams & Fraudulent Links
Apr 2026 · scam-guard-ten.vercel.app
- 24LF
Hi HN, I just wanted to share what I have been working on for the past few months: A firmware analyzer for embedded Linux systems that helps uncovering security issues running entirely in the browser. This is a very early Alpha. It is going to be rough around the edges. But I think it provides quite a lot of value already. So please go ahead and drop a firmware (only .tar rootfs archives for now) and try to break it :)
Mar 2026 · xray.boldwark.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →