Zero-dependency CVSS v3.1 and v4.0 calculator. Parse and score vulnerability vectors as a library or web component.

Analyze HTTP security headers for your web application. A-F grading, per-header findings, and remediation steps — as a library or CLI.

Diff two CycloneDX or SPDX SBOMs and produce human-readable change reports. Highlights added, removed, upgraded dependencies and new CVEs.

Lints GoPhish-format email templates for deliverability, tracking, merge tags, and spam triggers.

Opinionated TypeScript scaffold for production MCP servers with built-in auth, rate limiting, audit logging, and observability.

Scans MCP server configurations for common security issues: overprivileged tools, missing auth, prompt injection surface, unsafe defaults.

Zero-dependency web component for scoping and estimating penetration testing engagements. Works in Hugo, React, Vue, or plain HTML.

Zero-dependency web component for password strength analysis. Works in Hugo, React, Vue, or plain HTML.

Programmatic schema and validator for the CSA CAIQ-Lite vendor security questionnaire. Author, validate, and diff CAIQ responses as code.

Zero-dependency web component for sizing vulnerability scanning infrastructure. Estimates VM sizing, cloud costs, and timing across AWS/Azure.

Parses and normalizes attack surface scope definitions: IP ranges, CIDR, domains, wildcards, and exclusions. Framework-agnostic, zero-dependency.

Zero-dependency web component for calculating security awareness training ROI. Works in Hugo, React, Vue, or plain HTML.