Holistic Application Security — Offensive & Defensive Open Source Tooling
A complete open-source ecosystem for application security. From AI-powered pentesting to LLM guardrails and structured assessment methodologies.
Scroll
Holistic Application Security — Offensive & Defensive Open Source Tooling
A complete open-source ecosystem for application security. From AI-powered pentesting to LLM guardrails and structured assessment methodologies.
What We Do
Most AI “pentesters” are chatbots wrapped around a script library. Agent-Smith flips the model—skills teach the methodology, the LLM invents the attack. Self-chaining across 25+ disciplines: web, cloud, AD, AI red-team, white-box review. Nothing else in open source comes close.
Seraph isn’t another blocklist. A two-tier proxy runs a semantic allow-list (NeMo + embeddings) that decides what users are even allowed to ask, then hands edge cases to an LLM-as-judge. A defense designed for prompts you haven’t seen yet. Drop-in for OpenAI, Anthropic, Azure, Ollama—zero code changes.
25+ chainable slash-command skills covering the full lifecycle—recon, exploit, defend, remediate. Aligned to OWASP ASVS 5.0, LLM Top 10, MITRE ATT&CK, PASTA, STRIDE. Built by the community, pluggable into any AI agent.
Open Source Arsenal
Three projects. One mission: security that moves at the speed of AI—so your defense does too.
Point it at a target and watch a full pentest run itself—findings, PoCs, patches, and reports. It builds a live world model of everything it discovers.
A positive-security allow-list defines what users are even allowed to ask—so there’s nothing to jailbreak past.
25+ chainable commands that turn any MCP-capable agent into a red-teamer. One git clone. No SaaS.
The Ecosystem
Every tool feeds the next. Methodology informs testing, testing reveals what to defend, defense generates knowledge, and knowledge refines the methodology.
← Learn. Break. Defend. Repeat. →
From the Blog
Deep dives on offensive tooling, LLM defense, and the methodology behind the ecosystem.
Community
NullPointer is fully open source and community-driven. Whether you're a pentester, security engineer, or developer—there's a place for you. Contribute code, share knowledge, or just hang out.