OpenSecureAI Scanner vs RedAmon

OpenSecureAI Scanner checks untrusted text for patterns that may indicate prompt injection, jailbreaks, system-prompt leaks, or data exfiltration. Its scanPrompt library API returns a 0–100 score, a risk level, and findings for individual rules. Developers can access it as an npm package, CLI, GitHub Action, or REST API; the package targets Node 18+ and has zero runtime dependencies. Authenticated hosted API calls add detections for obfuscation and encoding evasions, indirect injection, tool abuse, multilingual overrides, and de-obfuscation. The LLM Gateway can route prompts to a selected OpenAI, Anthropic, xAI, or Groq provider and scan the response. Documentation says authenticated scans save a summary to the dashboard but do not store raw prompt text; gateway provider keys are not stored or logged. Free access includes in-browser tools and npm packages, while the anonymous API uses the basic engine with IP rate limiting. The Free plan lists 2,000 API requests per month. Pro costs $49 a month, but paid checkout is not self-serve and requires contacting sales.

RedAmon is a free, open-source framework for authorized red-team operations, including reconnaissance, exploitation and post-exploitation. It maps attack surfaces from domains, IP/CIDR targets or batches of domains, then merges findings into a Neo4j graph that its AI agent can query for planning and exploitation. GVM/OpenVAS provides network vulnerability scanning with more than 170,000 NVTs; separate tools detect secrets and scan for vulnerable or malicious packages against a local OSV database. The Secret Multiscanner has 1,060 detectors across 14 sources and optional live API verification. RedAmon supports twelve AI providers and more than 400 language models, and its MCP server lets external agents drive the framework. The Dockerized application runs on Linux, macOS and Windows and supports on-prem deployment. Tools, scanners and agents run in separate containers with per-job ephemeral filesystems and network namespaces. Rules of Engagement, approval gates and scope controls govern operations, with a guardrail blocking government, military and intergovernmental targets. The project warns that configured API keys and credentials are stored unencrypted in PostgreSQL, leaving database security to the user.