Security tools we build and share.

Security testing keeps changing. New frameworks appear, cloud providers ship features faster than documentation, and AI integrations introduce attack surfaces that didn't exist a year ago. Keeping up is hard — for everyone, including us.

We publish these tools because building them helps us understand new territory deeply. When we create a vulnerable lab for MCP servers, we're forcing ourselves to map out the attack surface systematically. When we write a testing checklist, we're codifying what we've learned across dozens of engagements.

This approach benefits security teams who use these resources for training and reference. But it also benefits our testing work — the same rigor that produces a useful open-source tool produces a thorough security assessment.

The MCP pentesting checklist, for example, emerged from our first several AI agent security tests. We noticed patterns, documented them, and made the checklist public. Now other teams can learn from that work, and we have a structured foundation for every new engagement.