The open-source stack

Star count is the least reliable signal in this whole ecosystem — Strix has 54.4k stars and lost to an unranked PentAGI in the one independent benchmark that exists; Daytona carries 72k stars from a period before its own README started warning people away from betting on it going forward. The real map splits into four layers (offensive agents, defensive/code analysis, AI-security, infrastructure), and the decision that matters most is not "what's popular" but "what license, what maintainer, and what happens the day the sponsoring company gets acquired."

#Master table

Project	What it does	Stars	License	Maintainer	Commercial backing	Health	Foundation?
Offensive agents
Strix	Hierarchical multi-agent pentester, Docker-sandboxed, bundled Caido proxy	54.4k	Apache-2.0	OmniSecure, Inc.	Seed-funded — Strix	Active	Reference architecture, not detection coverage — see below
PentAGI	Multi-agent pentest platform, Neo4j memory, 20+ tools	21.1k	MIT	vxcontrol	Unclear/indie	Active	Yes — best-evidenced open architecture
SWE-agent	General agent-loop framework; explicit offensive-security/CTF mode (EnIGMA merged in)	20.2k	MIT	Princeton/Stanford	Academic	Active, NeurIPS-grade	Yes — cleanest license, best base for the reasoning loop
PentestGPT	LLM-guided pentest task tree; USENIX Sec 2024 origin	14k	MIT	NTU Singapore (academic)	None	Active	Reference only
HexStrike-AI	MCP server wrapping 150+ security tools (nmap, sqlmap, nuclei) for any LLM client	11.4k	MIT	Solo author	Indie	Active	Yes — tool-adapter shortcut
CAI	General agent-building framework for security, 300+ model support	9.4k	Apache-2.0/MIT	Alias Robotics	Commercial Pro tier	Active	Eval suite (CAIBench) more valuable than the framework
Vulnhuntr	Static+LLM taint tracing, Python repos	2.7k	AGPL-3.0	Protect AI (→Palo Alto Networks)	Acquired	Maintained	Run only, don't embed — see license trap
Defensive / code
Semgrep OSS	Workhorse SAST engine	16.2k	LGPL-2.1	Semgrep, Inc.	VC-funded	Active	Core is open, cross-file analysis is not
Opengrep	Fork of Semgrep after Semgrep Inc. paywalled advanced features	2.6k	LGPL-2.1	10+ vendor consortium	Consortium-governed	Active, May 2026 release	Yes — no rug-pull risk by design
CodeQL	Queries/libraries open; the analysis engine is not	9.9k	MIT (queries only)	GitHub/Microsoft	Commercial engine	Active	Queries yes, engine no — see license trap
Bearer	Privacy/security SAST	2.7k	Elastic License 2.0	Cycode	Acquired	Active	No for SaaS use — see license trap
Google OSS-Fuzz-Gen	LLM-generated fuzz harnesses on top of OSS-Fuzz	1.4k	Apache-2.0	Google	Google-backed	Active	Yes
RepoAudit	Autonomous repo-exploring bug-finding agent, cross-language	408	Custom "Purdue" license	Purdue PurCL	None	Slow	Legal review required before commercial use
Agentless	Non-agentic localize→repair→validate baseline that beats many agents on SWE-bench	2.1k	MIT	UIUC (academic)	None	Slow	Benchmark your harness against this before building one
ARVO	Dataset: 6,138 reproducible OSS-Fuzz vulnerabilities, container-native	83 (meta repo)	BSD-2-Clause	Academic	None	Active (v3.0.0, Oct 2025)	Yes — ground-truth eval and RL environment data, see Post-training playbook
AI-security
garak	LLM vulnerability scanner — jailbreak/hallucination/leakage probes	9.1k	Apache-2.0	NVIDIA	Corporate-backed	Active	Yes — see credibility discussion below
PyRIT	Microsoft AI Red Team's official probing framework	4.0k	MIT	Microsoft	Corporate-backed	Active	Yes
promptfoo	Prompt/agent/RAG red-teaming CLI, largest star count in this bucket	24.2k	MIT	promptfoo, Inc. — independent, not acquired by OpenAI (promptfoo.dev)	VC-funded	Active	Yes
Giskard	Evals/red-teaming for agentic systems	5.8k	Apache-2.0	Giskard AI (France)	€3M raised	Active	Yes, notably EU-based
mcp-scan (→ Snyk)	MCP server security scanning	3.0k	Apache-2.0	Snyk (acquired Invariant Labs)	Acquired	Active	Consolidated category leader
Rebuff / LLM Guard	Prompt-injection / LLM I/O safety scanning	1.5k / 3.2k	Apache-2.0 / MIT	Protect AI	Both archived (May 2025 / Jul 2026)	Abandoned	No
Infrastructure
E2B	Sandboxed code-execution SDK for agents	13.4k	Apache-2.0	E2B	VC-funded	Active	Yes
gVisor	Userspace container-sandboxing kernel	18.5k	Apache-2.0	Google	Google-backed	Active	Yes — foundational isolation layer
Daytona	Dev-environment sandbox infra	72k	—	Daytona	Commercial	Still public and active through Jul 2026 — did not go closed-source (GitHub)	Confirm current terms before betting on it
browser-use	LLM-drivable browser automation	109.3k	MIT	Browser Use	VC-funded	Active	Yes — most-starred repo in this whole research pass

Full detail on Strix's architecture and funding lives in Strix; the wider funded-competitor landscape is in Offensive AI security companies and AI code security companies.

#The license trap

Ranked by how likely each one is to actually bite a commercial product:

AGPL-3.0 — Vulnhuntr. The network-use clause means embedding Vulnhuntr's logic into anything you offer as a service (hosted SaaS scanning, an API) can obligate you to release your combined work's source. Fine to run as an unmodified external CLI in a pipeline; risky to fork and embed into a proprietary product without a clean-room reimplementation. Trail of Bits' AIxCC-derived Buttercup — one of the seven open-sourced AIxCC systems, see AIxCC: the closest thing to a proof — is also AGPL-3.0, which matters if you're evaluating it as a base.

Elastic License 2.0 — Bearer. Not OSI-approved. Explicitly prohibits offering the software as a competing hosted service. The code is readable and self-hostable; the SaaS business model is not available to you.

CodeQL's split license. Queries and libraries are MIT and genuinely free. The CLI/engine that actually runs those queries against closed-source code requires a separate GitHub Advanced Security license. This is the easiest trap to walk into by accident — the GitHub repo reads as "open source" at a glance, and the restriction lives in the CLI's separate terms, not in the code you're browsing.

Non-standard academic licenses — RepoAudit's "Purdue license" and similar university tech-transfer terms scattered across the research-paper tier (IRIS, SVEN). Always pull the actual LICENSE file; a README that says "MIT" in prose is not a substitute for reading the file.

Acquisition/abandonment risk — a non-license trap that behaves like one. Rebuff and LLM Guard, both Protect AI, both went archived within 14 months of each other after Palo Alto Networks' acquisition. Apache-2.0 and MIT let you keep forking freely, but you inherit 100% of the maintenance burden the day the archive notice appears. Budget for that possibility with any VC-backed dependency, not just the restrictively-licensed ones.

#The gap between stars and working software

The sharpest evidence for treating GitHub stars as a popularity metric, not a health metric, is the one independent head-to-head benchmark in this space. Escape.tech ran four agentic pentesters — its own commercial scanner, PentAGI, Shannon, and Strix — against "Duck Store," an app with 20 known vulnerabilities, holding the model constant (DeepSeek v3.2) across the three open-source tools to isolate architecture from model quality.

Strix has 2.6x PentAGI's star count and found one-ninth as many vulnerabilities under identical conditions. A separate hands-on black-box review found Strix produced zero confirmed vulnerabilities against an unfamiliar target, wasting roughly 1,300 of 1,350 requests guessing endpoints that didn't exist (protego.me) — the tool becomes meaningfully more effective with source-code access, but that's a materially smaller claim than "autonomous black-box pentester." Full detail on what Strix is and isn't is in Strix.

None of this makes Strix worthless — it is a real, well-engineered, funded project with a working open-core distribution model, and its sandbox/orchestration plumbing is worth studying regardless of its current detection weakness. The lesson is narrower and more useful: read every open-source security agent's README as marketing until an independent third party has run it against a fixed target set.

#What you would actually assemble in 2026

Nobody should hand-roll container isolation, an agent loop, or a browser-automation stack from scratch. The fastest realistic path to a working harness:

1. Sandboxing: E2B or gVisor. Both Apache-2.0, both solved and boring in the good sense. E2B if you want a managed SDK, gVisor if you want to own the isolation layer directly. (Daytona was a third contender until the closed-source rumor spooked people away from it — the rumor is false, but the caution about betting on any single infra repo's license trajectory is still sound.)
2. Agent loop: SWE-agent. MIT, zero downstream obligations, an explicit offensive-security mode already merged in from the EnIGMA CTF research, NeurIPS-grade design behind the agent-computer interface. The best-licensed, best-documented starting point for the reasoning/action loop itself.
3. Browser automation: browser-use. MIT, 109.3k stars, purpose-built. Every pentest agent reviewed in this research — Strix included — rolled its own browser driver rather than reuse a shared one. That's duplicated effort you don't need to repeat.
4. Tool inventory: HexStrike-AI's adapter code. 150+ security tools already wrapped over MCP. Even if you don't use its orchestration layer, its tool-adapter code is a shortcut worth cannibalizing rather than writing your own nmap/sqlmap/nuclei wrappers.
5. Orchestration reference: study PentAGI before Strix. Its multi-agent-plus-knowledge-graph design is the most evidence-backed open architecture in this category — not the most-starred, the best-performing under independent test.
6. Code-layer detection, if in scope: Opengrep, not raw Semgrep OSS — fully open, vendor-neutral consortium governance, no risk of a second rug-pull.
7. Eval harness: CAIBench and ARVO, not a homegrown benchmark. Both give reproducible, previously-validated targets rather than a self-reported number nobody can check.

Combining 1+2+3+4 is realistically a multi-week integration project for a small team, not a multi-quarter build. The barrier to producing a working agent is now low — which is exactly why dozens of near-identical single-author "Kali MCP server" clones exist. The barrier that stays high, per the Strix evaluation above, is producing one that's actually good. See Unit economics and the compute bill for what that integration effort costs against buying or licensing instead, and Where the gaps actually are for where the resulting product would actually sit.

#What's genuinely missing

Four gaps recur across this entire ecosystem, and the first is where a credibility play actually lives.

A shared, standardized evaluation harness for offensive agents. Every project — Strix, PentAGI, Shannon, PentestGPT — reports its own benchmark, on its own targets, under its own methodology, and self-reported numbers routinely disagree wildly with independent testing, as the Escape-vs-Strix gap shows starkly. CAIBench and ARVO are the closest things to a shared standard and neither is close to universal adoption. Nobody has built the "SWE-bench of offensive pentesting agents" — a fixed, versioned, non-gameable target set with standardized scoring. A lab that publishes one, with a clear methodology and a willingness to show where an incumbent's self-reported number is wrong, gets outsized attention for exactly the reason the Escape benchmark did — see The three ideas, judged on why this is a more defensible entry point than out-building a funded pure-play.

A shared browser-automation and tool-adapter layer purpose-built for security agents. browser-use and HexStrike-AI exist and are good, but nearly every pentest-agent project rolled its own proxy integration and tool wrappers instead of converging on a shared library — the same Caido/Burp hookup, session management, and tool-output parsing work rebuilt, usually worse, a dozen-plus times across the small MCP-wrapper repos alone.

Automated vulnerability repair that's actually production-grade. Detection is a full generation ahead of repair. Almost nobody has a trustworthy open pipeline for turning a found bug into a validated, mergeable patch — which is exactly the gap OpenAI (Aardvark, rebranded Codex Security, still research-preview rather than GA) and Google DeepMind (CodeMender, not open at all) are racing to fill privately. See What the frontier labs do themselves for what those closed systems claim, and Post-training playbook for why patch-generation reward signals are the hardest part of training a model to do this well.

Black-box-to-white-box bridging. Strix's 96%-wasted-requests black-box failure mode is structural across the whole category, not Strix-specific. Almost every "good" open-source result in this research came from tools given source access; almost every "bad" one came from pure black-box runs. Nobody has a reusable open-source component for building an accurate application map from external observation alone — API discovery, schema inference, auth-flow mapping. Everyone re-derives this badly, per-project, as part of their recon phase.

#The AIxCC systems: an underused asset

DARPA's AI Cyber Challenge produced seven fully autonomous cyber-reasoning systems, and every finalist was contractually required to open-source its CRS under an OSI-approved license to keep its prize money — all seven did. See AIxCC: the closest thing to a proof for the full competition retrospective. What's striking is how little the wider industry has built on top of them:

System	Team	Final rank	License	Stars	Status
ATLANTIS	Team Atlanta	1st, $4M	MIT	615	Sibling repos (crs-claude-code) actively developed
Buttercup	Trail of Bits	2nd, $3M	AGPL-3.0	1.6k	Live open-source project, v1.0 shipped, feeds Patch the Planet
RoboDuck	Theori	3rd, $1.5M	AGPL-3.0	269	Archived Feb 2026, "will NOT be supported or updated"
FuzzingBrain	Texas A&M (O2 Lab)	4th	Apache-2.0	134	Actively maintained, CLI/REST/MCP modes
ARTIPHISHELL	Shellphish (UCSB)	5th	MIT	138	Academic, tagged releases
BugBuster	Northwestern-led	6th	GPL-3.0	30	Single-commit snapshot
Lacrosse	SIFT	7th	MIT	9	Single-commit snapshot

These star counts are trivial next to Strix's 54.4k or browser-use's 109.3k, yet ATLANTIS and Buttercup represent genuinely more validated engineering — 87.2% and roughly 68% real patch-success rates respectively, on real code, under DARPA's independently-scored competition rubric, not a self-reported benchmark. Buttercup in particular is worth taking seriously as infrastructure: modular services (orchestrator, fuzzer, patcher, scheduler), Kubernetes/Helm/Terraform deployment, an explicit design goal that "world-class automated vulnerability discovery doesn't require massive infrastructure investment," and it's the direct ancestor of Trail of Bits' ongoing Patch the Planet initiative pairing the same CRS techniques with human security engineers across dozens of real OSS projects.

The likely reason almost nobody has built on these systems is discoverability, not quality — they read as one-off competition artifacts, several are archived, and Buttercup's AGPL-3.0 license repeats the same commercial-embedding caution as Vulnhuntr above. But running Buttercup or ATLANTIS unmodified, or studying ATLANTIS's ensemble-fuzzing (LibAFL→AFL++→libFuzzer fallback) and verification-gated patch discipline, is meaningfully cheaper than reconstructing DARPA-grade engineering from a paper. AIxCC: the closest thing to a proof has the full architecture detail; Data, and whether a moat is possible covers the ARVO dataset these systems and their fuzzing pipelines both build on.

#What this means for us

• Do not fork Strix expecting pentesting coverage — fork it (or study it) for sandbox/orchestration plumbing, and expect to build detection quality from scratch or start from PentAGI instead.
• Treat every unlicensed or vaguely-licensed academic repo (RepoAudit, IRIS, SVEN) as requiring legal review before it touches anything commercial — the "Purdue license" pattern will recur.
• Avoid embedding AGPL-3.0 code (Vulnhuntr, Buttercup) into anything sold as a hosted service; run it as an external process instead, or budget for a clean-room reimplementation.
• The fastest credible build is E2B/gVisor + SWE-agent + browser-use + HexStrike-AI's tool catalog — a multi-week integration, not a multi-quarter one — but "fast to build" and "good" are different bars, and only an independent benchmark against CAIBench or ARVO closes that gap.
• The strongest low-competition credibility play in this whole landscape is publishing a rigorous, independently-checkable evaluation methodology (garak-style novel probes, or a genuine "SWE-bench of pentesting") rather than trying to out-fund or out-build Strix, XBOW, or RunSybil directly — see The three ideas, judged and Where the gaps actually are.
• ATLANTIS and Buttercup deserve a serious look before assuming a security-agent harness has to be built from generic components — they are DARPA-scored, real-code-validated, and almost nobody outside the competition has touched them yet.