Open-source tools, research artifacts, and utilities from our research and day-to-day security work. Actively maintained projects first.

AI × Security#

The current focus: putting LLMs and coding agents to work on security problems — and keeping what leaves the device under control.

  • ida-pro-mcp — AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP. Python
  • burp-ollama — Burp Suite extension providing AI-powered security testing using local Ollama models. Kotlin
  • burp-mcp — MCP server exposing Burp Suite’s REST API as tools for AI assistants. Python
  • daedalus — Detonation, analysis & experimentation architecture for Linux containers and sandboxing. Python — writeup →
  • ollama-forge — pull models from Hugging Face, convert them, add adapters, run them in Ollama. Python

LLM Agent Infrastructure#

  • manifold — chain multiple LLM proxy services into a single transparent pipeline. Python — writeup →
  • local-splitter — MCP-compatible outbound shim that cuts cloud token usage by running a local model as triage in front of a frontier model. Python — writeup →
  • llm-redactor — privacy-preserving shim that removes, masks, or transforms sensitive content before it leaves the device. Python — writeup →
  • resilient-write / resilient-read — MCP servers giving coding agents a fault-tolerant write surface and safe chunked reads of very large files. Python — writeup →
  • hivemind — OS-inspired scheduler for concurrent LLM coding agents. Python
  • gen-pilot — context-aware generation planning and deferred document rendering for LLM coding agents. Python

Reverse Engineering & Mobile Security#

  • reFlutter — Flutter reverse engineering framework. Python — related writeup →
  • hermes-dec — decompiler and disassembler for React Native Hermes bytecode. Python
  • MEDUZA — a more or less universal SSL unpinning tool for iOS. Python
  • ssl-kill-switch2 — blackbox tool to disable certificate validation, including pinning, on iOS and macOS. Objective-C
  • Clutch — fast iOS executable dumper. Objective-C
  • APKProxyHelper — patches APKs for proxy use. Python
  • APK-Downloader — download APKs from the Play Store. Python

Research Artifacts#

Code accompanying peer-reviewed work and courses.

  • GhanaPostGPS-REST-API — REST API reverse engineered from Ghana’s national digital addressing system, for local developers — publication →
  • ghanapostgps — Go package for the GhanaPostGPS API. Go
  • RFF — assessing the feasibility of RF fingerprinting for security in unmanned aerial vehicles. Python
  • QCIP — quantum computing & information processing. Python
  • levis / levis-ts-client — a lightweight messaging protocol, with its TypeScript client. Go/TypeScript
  • TE-751 — AI/ML for next-generation communication systems. Python
  • Network-intrusion-dataset-creator — synthetic network intrusion dataset generator. Python

Utilities#

  • ProxyMe — lightweight Android app that routes any app’s traffic through HTTP/SOCKS5 proxies via the VPN Service. Kotlin
  • dns66 — DNS-based host and ad blocker for Android. Java
  • block-ads — DNS ad-blocker blocklists for iOS, macOS, and Android. Python
  • Hack-Tools-Safari-Extension — the Hack-Tools panel as a Safari extension. Swift
  • Cookie-Editor — cookie editor extension for Safari. JavaScript
  • unminifyjs — free tool to unminify JS, CSS, HTML. unminifyjs.sperixlabs.org
  • WikiLeaksDownloader — batch-download the Vault 7 documents. Python
  • snowflake — WebRTC pluggable transport for Tor, packaged for Safari. JavaScript

Earlier Projects#

Everything lives on GitHub — most tools also get a full writeup on the blog.