Staff Picks — October 2026
Eight background-checked security tools for October 2026, chosen across agent-security, identity, detection, vulnerability management and purple-team work.
The short version: a crowded shelf of AI-agent security tooling. The standout is runtime control at the tool-call boundary — prismor (a self-hosted gate that can block before a tool runs) and agent-beacon (a memory layer that follows you across harnesses). Also notable: a clean, no-cloud endpoint detector (rustinel), NVIDIA’s SkillSpector for scanning agent skills before load, two identity picks for agent-friendly auth (better-auth, casdoor), DataDog’s stratus-red-team for testing cloud detection, and OpenAI’s codex-security as a released security CLI. The honest read: agent-governance tooling is moving from research into shipping, and most of the shelf’s picks are small, well-maintained projects you can stand up without a vendor.
1. SkillSpector — a scanner for the skills your agent loads
What it is. A security scanner for AI agent skills: it looks for vulnerabilities, malicious patterns, prompt injection, data exfiltration and supply-chain risk in the skills an agent can load.
Why now. Agent skills are the newest place people install code from strangers; this went from a release candidate to a released product on the check day, with 1,020 commits in 30 days behind it.
Before you adopt.
- Licence — Apache-2.0, as of 2026-10-16.
- Maintenance — last push the day checked; 1,020 commits in 30 days; latest release the same day.
- Adoption depth — 94 contributors, 1,790 forks, 78 watchers, 139 open issues.
- Dependency and secret hygiene — Trivy found 2 CRITICAL and 17 HIGH in its dependency tree (plus 14 MEDIUM), 3 Semgrep findings, 4 gitleaks secrets. A tool that scans others should be scanned itself: pin it, do not inherit its transitive dependencies blindly.
- You would run it if — your agents load third-party skills and you cannot name every one of them.
Where it fits. Vulnerability management. It answers “is this skill safe to load”, which is a different question from what your agent is allowed to reach once it has.
2. prismor — a runtime gate that can block, not just observe
What it is. A self-hosted runtime control plane for AI agents: it observes, requires human approval for, or blocks tool calls before they execute — aimed at secret leaks and prompt injection.
Why now. Agent observability is becoming common; enforcement at the tool-call boundary is not. This moves from observation to a blocking gate in the runtime.
Before you adopt.
- Licence — Apache-2.0, as of 2026-10-16.
- Maintenance — last push the day checked; 138 commits in 30 days; latest release the day before.
- Adoption depth — 23 contributors, 55 forks, 5 watchers, 72 open issues.
- Dependency and secret hygiene — Trivy clean, 0 secrets, 11 Semgrep findings, 14 Gitleaks hits. The clean dependency tree is the more important half.
- You would run it if — you want a human gate in front of irreversible agent actions without building one, or a record of what each agent actually tried to do.
Where it fits. Agent & AI security. The runtime half of the same problem the governance work addresses at design time: an agent’s blast radius is its tools.
3. rustinel — endpoint detection without a cloud account
What it is. Endpoint detection for Windows, Linux and macOS, running Sigma, YARA and IOC rules against native telemetry. Written in Rust; no cloud account required.
Why now. The activity is the point: 155 commits in the last 30 days from a small team, what a detection engine looks like when it is actively tested against real rules.
Before you adopt.
- Licence — Apache-2.0, as of 2026-10-16.
- Maintenance — last push the day checked; 155 commits in 30 days; latest release the same day.
- Adoption depth — 9 contributors, 64 forks, 8 watchers, 67 open issues.
- Dependency and secret hygiene — Trivy, Semgrep and Gitleaks all clean: 0 findings, 0 secrets. The cleanest candidate in the sweep.
- You would run it if — you want Sigma-based detection on endpoints you control without shipping telemetry to a vendor, or you want to test your existing rules against a second engine.
Where it fits. Detection & response. It competes with vendor agents on the telemetry it already has rather than on a hosted platform.
4. agent-beacon — a memory layer that follows you across harnesses
What it is. The cross-harness, self-improving memory layer for AI agents.
Why now. Actively driven at scale: 1,175 commits in 30 days, a release on the check day, and a community Discord surfacing this fast.
Before you adopt.
- Licence — MIT, as of 2026-10-16.
- Maintenance — last push the day checked; 1,175 commits in 30 days; latest release the same day.
- Adoption depth — 9 contributors, 171 forks, 3 watchers, 12 open issues.
- Dependency and secret hygiene — 73 Semgrep findings, 20 Gitleaks secrets. Active but not scan-clean, so read the findings before relying on it.
- You would run it if — you run more than one agent harness and want a shared memory layer that follows you across them.
Where it fits. Agent & AI security. A memory layer rather than a gate — complements a control-plane pick’s angle on the same boundary.
5. better-auth — the comprehensive authentication framework
What it is. The most comprehensive authentication framework, with built-in support for OAuth, OIDC, SAML, LDAP, SCIM, WebAuthn and more.
Why now. Still being pushed the day checked (157 commits in 30 days) with a release the day before.
Before you adopt.
- Licence — MIT, as of 2026-10-16.
- Maintenance — last push the day checked; 157 commits in 30 days; latest release the day before.
- Adoption depth — 30 contributors, 2,975 forks, 51 watchers, 866 open issues.
- Dependency and secret hygiene — Trivy found 11 CRITICAL and 106 HIGH in its dependency tree (plus 63 MEDIUM, 22 LOW), 115 Semgrep findings, 56 gitleaks secrets. The CVE load is real and should be reviewed before you build on it.
- You would run it if — you are building a product that needs login, registration and session handling and you want a well-built auth base rather than rolling your own tokens.
Where it fits. Cloud & identity. Auth is security infrastructure: the layer every other tool in this shelf ultimately sits on.
6. casdoor — an agent-first identity and access management server
What it is. An open-source agent-first IAM / LLM MCP and agent gateway with a web UI: OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA and more for humans and agents.
Why now. Still being pushed the day checked (210 commits in 30 days) with a release 5 days prior — an existing project turning its gear toward AI agents.
Before you adopt.
- Licence — Apache-2.0, as of 2026-10-16.
- Maintenance — last push the day checked; 210 commits in 30 days; latest release 5 days prior.
- Adoption depth — 318 contributors, 1,876 forks, 81 watchers, 114 open issues.
- Dependency and secret hygiene — Trivy found 101 HIGH and 99 MEDIUM (plus 29 LOW, 9 UNKNOWN, 1 CRITICAL), 18 Semgrep findings, 15 gitleaks secrets. Read the findings before you depend on it.
- You would run it if — you need an auth server that treats AI agents as first-class identities, not just human users.
Where it fits. Cloud & identity. The gateway that lets an agent authenticate and get scoped access, which is the prerequisite for the controls in the other picks.
7. stratus-red-team — adversary emulation you can point at your own cloud
What it is. Granular, actionable adversary emulation for cloud environments — the tool for asking “would we have caught that?” instead of assuming.
Why now. Newly released the day before the check and still being pushed (45 commits in 30 days) — a fresh playbook for testing your own cloud detection coverage.
Before you adopt.
- Licence — Apache-2.0, as of 2026-10-16.
- Maintenance — last push the day before checked; 45 commits in 30 days; latest release the same day as the check.
- Adoption depth — 59 contributors, 327 forks, 38 watchers, 76 open issues.
- Dependency and secret hygiene — Trivy found 1 HIGH and 6 MEDIUM in dependencies, and 568 secret-shaped strings in the tree; 0 Semgrep findings, 42 Gitleaks secrets. A credential-shaped fixture count like this is expected in an attack-simulation tool — it is the human reading that matters.
- You would run it if — you have cloud detections you have never actually tested, or you want to prove coverage to someone who will ask how you know.
Where it fits. Purple team & adversary emulation. The honest counterpart to any detection claim in your own environment.
8. codex-security — a CLI and SDK for finding and fixing security vulnerabilities
What it is. A CLI and TypeScript SDK for finding, validating and fixing security vulnerabilities in code.
Why now. Now a released CLI with an SDK rather than an announcement, with 549 commits in 30 days of active development.
Before you adopt.
- Licence — Apache-2.0, as of 2026-10-16.
- Maintenance — last push the day checked; 549 commits in 30 days; latest release the day before.
- Adoption depth — 59 contributors, 893 forks, 38 watchers, 211 open issues.
- Dependency and secret hygiene — Trivy found 1 HIGH in dependencies, 1 gitleaks secret, 25 Semgrep findings, 33 Gitleaks hits. Not clean, and none of it disqualifying — but this reads your source, so its findings deserve a skim.
- You would run it if — you want a scanner that proposes the fix rather than only reporting the flaw, and you will review its output rather than accept it.
Where it fits. DevSecOps & pipeline. It sits alongside your existing SAST rather than replacing it; the SDK is the more interesting half if you want it inside a pipeline.
What we passed over, and why
The most useful thing a curated list can say is what it rejected. This month:
- uber/ADR — enterprise-grade agent observability, security benchmarking and threat detection, deployed at Uber. Passed over because it is an enterprise-platform answer to a problem the shelf’s picks cover at the tool level; its 2 CRITICAL and 61 HIGH findings also mean a heavier review burden than the shelf’s picks. Worth knowing it exists.
- BigBodyCobain/Shadowbroker (AGPL-3.0) — open-source intelligence about the global theater. Useful, but general OSINT/geospatial rather than security tooling, so it does not belong on a security-picks shelf.
- koala73/worldmonitor (AGPL-3.0) — a real-time global intelligence dashboard with news aggregation. Not a security tool, so not a pick.
- mthcht/awesome-lists — a curated list of security references for SOC/CERT/CTI, not a tool, and too large for the scanners (unknown). It belongs on the shelf as reading, not as an entry.
Background check run 2026-10-16. Raw evidence: candidates/2026-10.md.