ivo's home

Knife is a standalone Rust CLI for static binary analysis of PE, ELF, and Mach-O files. It combines header parsing, strings extraction, and disassembly into a single tool that recovers functions from stripped binaries using exception directories. The audit command specifically flags dangerous call sites where argument provenance suggests potential bugs like integer underflows.

This is a solid alternative to juggling five separate tools if you need to triage untrusted binaries quickly. However, it is strictly static and will not help with dynamic debugging or network traffic analysis. The analysis depth depends on the quality of the binary's metadata, so heavily obfuscated or packed targets may not yield much insight.

more: https://github.com/bl4ckr0ss3/knife

my other side: ivo.blogspot.com

This is a dark-mode web UI for running authorized penetration tests with multiple LLM providers. It uses a plugin architecture to manage shell access, web research, and durable session states. You bring your own API keys for any OpenAI-compatible model.

The setup is straightforward if you have Node 20 and pnpm installed. It requires explicit authorization for every engagement, so it is not for casual curiosity. The interface is dense and assumes you know what you are doing.

more: https://github.com/S1N6H/pentest-harness

my other side: ivo.blogspot.com

AgentSafe is a lightweight HTTP proxy (v0.2.0) that you can install via Homebrew, Docker, or Helm. It intercepts each request from an AI agent or service, forwards the intent to the Decionis control plane, and only forwards the request onward when Decionis returns an ALLOW grant. The proxy records every decision as a signed dossier and never makes its own policy decisions.

If you need a clear authority boundary for autonomous agents, AgentSafe gives you a reproducible test harness and a single‑use grant model. It depends on a running Decionis service (and optionally the Presence layer) and only works for HTTP traffic, so it isn’t a drop‑in for non‑HTTP workloads or environments without those services.

more: https://github.com/decionis/agent-safe-pipeline

my other side: ivo.blogspot.com

Cybermes is a Go‑based offensive security framework released on GitHub (v0.9.1) that bundles more than 200 modular playbooks and a native Model Context Protocol (MCP) server. It can be run as a standalone CLI for headless CI pipelines or as an MCP service that streams security tools into AI‑assisted IDEs such as Gemini, Claude, and Cursor. The package includes Docker support, Windows PowerShell installers, and a health‑check script that validates dependencies and API keys. It aims to replace ad‑hoc script collections and manual tool chaining with a single, versioned pipeline.

If you already have a mature suite of custom scripts, Cybermes adds little beyond convenience and may feel heavyweight for small bug‑bounty jobs. The MCP integration works only with supported AI clients, so environments without those assistants get only the CLI path. It’s a solid time‑saver for teams that need repeatable, AI‑augmented assessments, but not essential for solo developers who prefer direct tool control.

more: https://github.com/Zyrexnn/Cybermes

my other side: ivo.blogspot.com