Cognis Digital

C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel

No-train, on-prem code knowledge graph served to AI agents over MCP, with a hash-chained audit row for every read.

Analyze an ADS-B feed/CSV for anomalies: callsign spoofing, squawk 7500/7600/7700, and unusual loiter patterns.

Condensed, cross-walked reference for SOC2, ISO 27001, NIST CSF/800-53/800-171, CMMC, GDPR, CCPA, HIPAA, PCI DSS, EU AI Act

AIS vessel tracking & sanctions-evasion anomaly detection

Umbrella catalog of the Cognis Neural Suite (100+ tools)

Free-tier blockchain investigator — ETH/BTC clustering + sanctions xref

DISA STIG-aligned osquery configs + RMF mapper

GRC control crosswalk engine (NIST 800-53 / CIS / SOC 2) + gap analysis

Mobile runtime-integrity detection: root/jailbreak/emulator/hook/tamper indicators with a scored posture verdict (RASP-style, zero deps).

Run simple YARA-style string/regex rules over a directory

Validate OTA update packages end-to-end: signature chains, rollback protection, anti-downgrade counters, and delta-patch integrity.

Generate a CycloneDX SBOM directly from an unpacked firmware root filesystem and flag components with known CVEs and EOL kernels.

Sniff and decode BLE GATT traffic, fingerprint device profiles, and assert on insecure pairing/characteristics in CI against a capture.

Citation-grade OSINT dataset: 8,300+ foreign components across 195+ drone & missile platforms, with cited effectiveness/EW/counter-UAS statistics. MIT (code) / CC BY 4.0 (data).

Model your sales pipeline as a YAML state machine and compute conversion rates, stage velocity, and weighted forecast straight from CRM exports.

MCP server hardening linter — capability declarations, transport, tool descriptions

BLOS PACE communications architecture validator & failover simulator — four-pathway validation, physical-domain diversity, no-pLEO enforcement, LPI scoring, automated failover simulation. Self-hosted, verified.

Multi-domain ISR sensor fusion for counternarcotics (non-kinetic) — EO/IR+radar+AIS+ADS-B track fusion, dark-contact cross-cue, coverage cost modeling, GeoJSON. Self-hosted, verified metrics.

Audit UEFI firmware dumps for missing Secure Boot keys, unsigned modules, S3 boot-script vulns, and known SMM threats.

Spin up a high-interaction Modbus/DNP3 ICS honeypot that logs attacker register reads/writes as structured JSON.

Scan firmware blobs and filesystem dumps for hardcoded private keys, API tokens, default creds, and weak RSA/ECC material.

Independent open-source LOCAL reimplementation of core Google Cloud Platform primitives (object storage, document DB, pub/sub, event functions) for offline development and testing. Pure stdlib. Not affiliated with Google.

GSA Schedule opportunity surveyor — SAM.gov + eBuy + FedConnect

Self-hosted password cracking queue — multi-user hashcat with audit log

Re-identification risk assessment that computes k-anonymity, l-diversity, and HIPAA Safe Harbor compliance on a dataset.

Token and cost counter / budgeter for LLM apps, CI-ready

Replay, fuzz, and assert on CAN bus traffic from a .pcap or SocketCAN interface with a tiny YAML DSL.

Summarize flows/talkers/protocols from a pcap text export

DISA STIG checker + NIST 800-53 RMF mapper + POAM emitter

Static packer/loader fingerprinter (C) — UPX/ASPack/Themida/MPRESS/VMProtect + entropy; emits YARA + SARIF. JSON out, CI-tested.

FedRAMP boundary visualizer & OSCAL-format SSP/POAM generator

Android APK static security analyzer — MASTG-aligned, from-scratch binary-AXML decoder, zero dependencies.

Diff two firmware images and surface exactly what changed: new binaries, flipped config flags, added certs, and shifted entropy regions.

Air-gap software supply-chain gate — SBOM (CycloneDX), SLSA/in-toto-style provenance + signature, CI policy gate

Third-party / vendor risk questionnaires with SBOM cross-ref

Dependency risk visualizer — Scorecard + OSV + typosquat + maintainer signals

Damn Vulnerable Mobile — a self-contained, intentionally-vulnerable mobile backend lab with MASVS-mapped challenges, writeups, and a flag scoreboard. Training only.

Dependency license + SBOM gate, developer-CLI first

CI/CD supply-chain auditor — GH Actions / GitLab CI / OWASP CI/CD Top 10

Open-source conflict monitoring & situational awareness — ACLED/GDELT/UCDP + OSINT feeds, hotspots/trends, and a sourced 'what's working' lessons KB (OSINT/force-protection)

Image geolocation toolkit — EXIF, sun-shadow, OCR, reverse-search

Hardened security baseline for air-gapped/regulated Kubernetes — assess + generate NetworkPolicy/PodSecurity/RBAC/quota controls

Tamper-evident audit-log aggregator with hash-chained attestation

Game/desktop binary integrity scanner that fingerprints executables, detects common packers/obfuscators, and diffs against a known-good baseline to catch tampering.

Detect & score AIS transponder-gap anomalies in vessel tracks (maritime situational awareness / defensive OSINT)

Kubernetes policy-as-code admission engine — declarative allow/deny/mutate with built-in CIS/NSA hardening policies

Benign, authorized-use-only adversary-emulation & detection-validation harness mapped to MITRE ATT&CK (purple-team; Caldera/Atomic Red Team category).

Cryptographically prove an AI answer came from a specific local model + private corpus, verifiable by a third party without revealing either. Signed Merkle attestation transcripts with selective disclosure.

Scope-gated red-team reconnaissance & attack-surface mapping for AUTHORIZED engagements. Passive-first, fail-closed scope gate, STIX/SARIF/HTML export. Offline-capable, zero deps.

No description.

No description.

Empirically characterizing convergence of the AI code generate-verify-repair loop: converge / stall / oscillate / exhaust. Deterministic CI study + data-only 43-task benchmark.

Deterministic, auditable multi-agent orchestration — register tools, run a fixed or rule-driven plan, get a fully-traced reproducible result. Zero deps, offline.

Classify findings against Microsoft's AI-agent threat taxonomy with mitigations

Breaking-change detector for OpenAPI / GraphQL across commits

Scans any wallet for dangerous ERC-20/721/1155 token approvals and infinite allowances, scoring drainer exposure and emitting revoke transactions.

Substrate-agnostic, structure-complete memory fabric — read the whole book from any address; forward-compatible across classical, photonic, and quantum hardware (rare-earth quantum memory). Reproducible O(N^2)->O(N) LLM efficiency.

Self-hosted, edge-capable multi-INT fusion & agent orchestration — offline entity extraction, provenance-tracked knowledge graph, TF-IDF retrieval, deterministic multi-agent loop, pluggable local-LLM (Ollama), STIX 2.1. Verified with ground-truth metrics.

Declarative pentest-toolkit orchestrator (authorized engagements)

Agentic workflow replay & audit with OTel GenAI semantic conventions

COM-hijack & persistence detector (C#/.NET) — parses .reg exports, maps to MITRE ATT&CK, emits Sigma. JSON out, CI-tested.

Self-hostable analyst start-page / dashboard generator

Longform timeline static-site generator with a recency engine

Self-hosted livestream relay control plane (ffmpeg)

WireGuard overlay-network config generator + healthcheck

Cross-platform sysadmin script library with an audited runner

Scan a repo or infra manifest for HIPAA Security Rule gaps and produce a Business Associate readiness scorecard.

AI Agent Permission & Access Auditor — surfaces the lethal trifecta of credentials + injection + reach

Durable, idempotent at-least-once job queue (library + HTTP service)

Detection-rule tuning lab: score signatures against a labeled corpus

Go client SDK + CLI for the safequeue durable job-queue API

Fixed-width record validator (COBOL/GnuCOBOL) — numeric-field integrity for batch pipelines. JSON out, CI-tested.

Access-log scanner (Lua) — scanning, sensitive-path probing, flooding. JSON out, CI-tested.

X.509 certificate auditor (C#/.NET) — expiry, weak keys, weak signatures, SANs. JSON out, CI-tested.

Scaffolder, validator & test harness for local MCP servers

Portable packaging format & CLI for AI-agent skills

Multilingual content-risk lexicon + classifier for moderation pipelines

Turn raw/uncensored text into provider-acceptable text for Claude, ChatGPT, and other LLM providers — strips profanity, slurs, PII, secrets, and hostile tone (rules engine + LLM rewriter). A compliance normalizer, not a filter-evasion tool.

The trust gate for agent skills — vet a Claude Skill / MCP server / plugin BEFORE you install it. Static capability analysis + TRUST/REVIEW/BLOCK verdict, offline.

Engagement authorization & scope enforcement for authorized mobile security testing (signed scope, ROE gating, tamper-evident audit log).

Auth-log brute-force & password-spray detector (Perl port of logsift). JSON out, CI-tested.

Extract & defang IOCs from any text (Ruby). JSON out, CI-tested.

Windowed Shannon-entropy scanner (C) — flags packed/encrypted/embedded-key regions. JSON out, CI-tested.

Cognis Digital org profile

Snare — one blocklist that snares ads, trackers, scams & redirect attacks in any browser. Aggregates AdGuard + 20 more public lists, compiles to hosts/AdGuard/dnsmasq. Self-hosted, keyless, zero-dependency.

Detection-engineering kit — 10 tools (IOC/YARA/Sigma/Elastic/ATT&CK/SIEM) + an ATT&CK-mapped rule library + a live-refreshable known-bad blocklist. Offline, zero-dep.

Defense Acquisition Navigator — open, self-hostable software for DoD acquisition & program management: pathway recommender, transparent transition-probability scoring, TRL/MRL readiness, color-of-money, JCIDS alignment, milestone gates, pilot-to-program planning.

Open, self-hostable, standards-based phishing-resistant authentication tooling: WebAuthn/FIDO2 verifier, attestation, zero-trust assurance scoring, and policy.

Open situational-awareness data engine: real public feeds (quakes/fires/weather/volcanoes/disasters/ADS-B/space-weather/tsunami/OSINT) exported into ATAK and Google Earth formats. Defensive SA only.

Build your app, own every line. The open-source, local-AI full-stack app builder — menu-driven, generates + verifies your Next.js app until it's green. No cloud, no lock-in.

Counter-Threat-Finance Attribution & Fusion Platform — fuses IP/infrastructure deanonymization with multi-chain blockchain analytics into a confidence-scored, STIX-exportable threat-actor graph. Self-hosted, offline, zero-dependency. Verified with ground-truth metrics.

Cross-OS federated gateway unifying every OpenAI-compatible inference backend (Cognis fleet, Ollama, llama.cpp, vLLM) behind one /v1 endpoint

Map findings to MITRE ATT&CK techniques + coverage heatmap

Elastic detection-rule CLI: validate, diff & deploy

Lint and unit-test Sigma detection rules against sample events

Generate candidate YARA rules from sample files/strings

Build STIX 2.1 bundles from a list of IOCs/observables

Score IOCs against offline reputation/allow lists with explainable verdicts

Extract & defang IOCs (IPs/domains/hashes/URLs) from any text

the LLM vulnerability scanner

🛡️ A curated list of resources on agent skills security: attacks, defenses, frameworks, and benchmarks for securing AI agent tool use and skill ecosystems

🔥🔒 Awesome MCP (Model Context Protocol) Security 🖥️

The open detection-signature library for AI-agent threats — prompt injection, jailbreaks, tool poisoning. Mapped to MITRE ATLAS + OWASP LLM Top 10. nuclei-templates for AI agents.

The autonomous security agent for your AI stack — finds the vulns in your MCP servers & agent tools AND writes the fixes, on a local model.

Detect symlink-hijack / one-click-RCE / unsafe-trust settings in AI coding-agent projects

Prompt-injection & indirect-injection scanner for any LLM context input

Consent-based SSRF probe harness for MCP servers that fetch URLs

Trust-On-First-Use pinning & drift detection for MCP tool definitions — catches the tool-poisoning / rug-pull attack

Drop-in token-auth gateway in front of unauthenticated MCP servers

Scan MCP servers for RCE/SSRF/no-auth/tool-poisoning vulnerabilities

Geospatial change detection & pattern-of-life for counternarcotics (non-kinetic) — AOI-grid new-activity hotspots, off-pattern anomaly detection, geofencing. Self-hosted, verified metrics.

AI/ML multi-modal illicit-crop detection & yield estimation — multispectral + SAR classification, area estimation with confidence intervals, yield modeling, change detection, GeoJSON. Self-hosted, verified metrics. Early prototype.

Cognitive-architecture-inspired NL context engine (entities/intent/affect + working/episodic/semantic memory) that speaks agentlex. Models facets of cognition, not a literal brain.

Local uncensored AI coding suite — one endpoint wired into VS Code, JetBrains, Cursor, Zed, Neovim, opencode, and Aider

Access governance for git repos you already host: RFC 8628 device-flow auth, scoped revocable tokens, branch protection as a pre-receive hook.

The AI content team you own: voice-trained hooks, scripts, captions, thumbnails & multi-platform packaging. Offline by default, your model when you want it.

Accountable AI Engineering — an open suite for running AI agents you can prove are under control, on infrastructure you own.

A tiny, dependency-free engine for iterative refinement loops: propose, check, revise, repeat.

An open governance doctrine (the SENTINEL seven rules) and a file-backed policy-gate engine for AI agents.

A headless, config-as-code DAST runner that crawls an authenticated web/mobile-API surface and fires a curated active-scan ruleset, emitting deduplicated SARIF.

Military convoy routing w/ escort, dwell, threat-cost overlays

OSCAL compliance-as-code — validate, convert & diff control coverage for catalogs, profiles, component definitions & SSPs

Multi-cloud cost report, anomaly detection, and FOCUS export

M&A/VC due-diligence assistant: generate a dataroom checklist, track items, and flag risks in local documents — fully local, no network needed.

GitOps drift detection — diff declared Kubernetes manifests against live cluster state and emit a reconcile plan

DNS posture & misconfiguration scanner — SPF/DKIM/DMARC/DNSSEC/CAA

Detect permissive/misconfigured CORS from headers or a config

SEC EDGAR intelligence: 13F institutional holdings, Form 4 insider trades, 8-K material events by ticker/CIK

Config-first scaffolding and orchestration for multi-agent workflows

Investor-update and KPI one-pager generator from your metrics

Map ASN/CIDR ownership & neighbors from whois/RIR exports

Test an access-control matrix (role x endpoint) for IDOR/authz gaps

Cloud security posture from a config export (public buckets, open SGs, weak IAM)

Plan + track secret rotation across providers from an inventory

Chainable encode/decode/transform pipeline (base64/hex/rot/xor/url/gzip)

Bidirectional, idempotent sync of contacts/deals between a local SQLite source-of-truth and CRM APIs (HubSpot/Pipedrive/Salesforce) via one config.

Incident runbook and SOP generator from templates

Analyze Certificate-Transparency exports for subdomains & rogue issuance

Local model router / proxy across Ollama, vLLM, and cloud with fallback

Analyze an NTFS $MFT CSV for timestomping and suspicious file activity

Synthetic test-data generator with referential integrity

FPV Strike Drone — first-person drone flight & strike sim.

Dockerfile linter with image-size and CVE advisories

Embedding / vector-store drift and poisoning audit

Generates a CycloneDX SBOM for mobile apps by unpacking native libs and bundled SDKs, then matches components against known-vuln and tracker/privacy databases.

OSS license compliance auditor — AGPL contamination + NOTICE generation

Vulnerability disclosure timeline builder with patch-window metrics

Audit a domain's DMARC, SPF, and DKIM posture and report spoofability with prioritized fixes.

Continuous SBOM diff & vulnerability watch with maintainer-change tracking

CIS-style DB/SQL hardening checker with pass/fail evidence

Carve and recover files from raw disk images and memory dumps by signature — fast, dependency-light forensics triage.

Scan files and binaries for high-entropy regions to flag packing, encryption, and embedded secrets.

Post-quantum migration readiness scanner — find quantum-vulnerable crypto and map to NIST PQC (FIPS 203/204/205)

Measure your WAF/detection coverage against a labeled test corpus

SQL-injection safety linter + trainer (defensive)

CVE prioritization: correlate CVSS + CISA KEV + EPSS into an explained ranking

Detect DNS/HTTP exfiltration patterns (entropy, beaconing) in logs

Open crypto market/reserve/seizure intelligence tracker (CEX reserves, ETF/treasury flows, seizures, strategic reserves, whales)

Crosswalk controls across NIST, ISO 27001, SOC 2, CMMC, PCI

Find leaked cloud keys (AWS/GCP/Azure) + classify blast radius

Build entire organizations of AI agents (roles, personalities, experience, skills, tools); run them, export to CrewAI/AutoGen/LangGraph/OpenHands/TaskWeaver/MetaGPT, sync to PM suites. Interoperable with the Cognis 300+ suite.

Air-gapped cluster bootstrap planner — turn a node inventory + artifacts into the ordered plan to seed a disconnected k3s/RKE2 cluster

Generate branded sales proposals and SOWs from a YAML scope file + pricing table into PDF/HTML, with a deterministic line-item math check.

Turn any command-line tool into an MCP server — one line, zero boilerplate

Self-contained installer for airgapped (SIPR/JWICS-style) environments

Lint email sequences and drip campaigns for deliverability: SPF/DKIM/DMARC, link health, unsubscribe presence, and CAN-SPAM/GDPR compliance.

OCI registry mirror & artifact copy — move container images and their signatures, SBOMs & attestations across an air-gap

Infer where a photo was taken using a local uncensored vision + reasoning model (OSINT/geoint, 100% local)

Web-page snapshot + change monitor with significance diffing

Turn any Python codebase into a queryable knowledge graph you can search, diagram, and ask questions about — grounded via a local LLM fleet

LLM red-team harness — OWASP LLM Top 10 + MITRE ATLAS attack packs

Full-text archive indexer & search for public-record collections

Statically map task structures, stack usage, and ISR call graphs in FreeRTOS/Zephyr firmware to flag stack overflows and priority-inversion risks.

Lint documents against MIL-STD / DoD formatting and classification-marking rules.

Validate classification banner markings (CUI/CONFIDENTIAL/SECRET) in documents per portion-marking rules.

ATS field-schema mapper & exporter for candidate-data portability

NIST AI RMF / EU AI Act / ISO 42001 self-assessment & SSP generator

Alert dedup, correlation, and routing in front of Grafana / PagerDuty

Auto-generated NIST AI RMF / EU AI Act Annex IV model & system cards

Periodic user-access-review (UAR) campaign runner

Config/compliance drift detector against a signed baseline

ATT&CK-mapped incident-response playbook generator + linter

Parse and classify signal metadata (freq, modulation, bandwidth) into a normalized catalog.

Analyze exported browser history/downloads for IOCs and exfil signs

Independent open-source LOCAL reimplementation of core Firebase developer primitives (Firestore-style docs, realtime JSON tree, local auth, static hosting, function triggers) for local development & testing. Std-lib Python, not affiliated with the vendor.

openazure - an independent, open-source LOCAL reimplementation of core Azure primitives (Blob, Table, Queue, Functions) for local development and testing. Not affiliated with Microsoft.

Wazuh stack deployment scaffolder + healthcheck

Config-as-code deployment scaffolder for a self-hosted GRC stack

Printable security quick-reference card generator

Token-contract rug/honeypot risk scanner (defensive)

Security-interview question bank + spaced-repetition trainer

Auditable bookmarklet manager: lint, hash & export browser bookmarks

Registry, launcher & health dashboard for local MCP servers

Author, lint, validate & package AI-agent skills

EVM/Arbitrum event watcher with rule-based alerting

Telemetry dashboard kit: summaries, threshold alerts & inline-SVG charts

CAPCO-shape classification banner + portion marking library — placeholders only

SCIF/SAPF compliance helpers: badge audit, TPI, escort tracker

Auto-generate SSP / POAM / SAR (eMASS / Xacta import format)