I built and open-sourced 21 professional tools — security scanners, an AI-search analytics CLI, a private messenger, and more

I'm Tahir Younas, a penetration tester and application security engineer. Alongside client security work, I run Tytechlabs — and over the past weeks I built and open-sourced 21 professional tools, every one of them tested (726 automated tests in total) and GPL-3.0 licensed.

Why open-source them? Because the tools I wanted either cost per-seat enterprise money, or didn't exist in the form I needed. So I built them, tested them properly, and published them with their honest limits written in the READMEs.

Here are the highlights.

Security tools

• AgentScope — an offline auditor for AI agent & MCP permissions. It scans Claude/Cursor/VS Code MCP configs for wildcard tool permissions (Bash(*)), unpinned npx packages, hardcoded secrets and destructive tools, and scores the risk. With AI agents getting shell access on developer machines, nobody was checking the config files. (57 tests)
• MailSentry — audits hidden email forwarding and inbox-rule exfiltration (MITRE ATT&CK T1114.003) in Google Workspace and Microsoft 365 rule exports. This is the exact technique used in BEC attacks after a mailbox compromise. (42 tests)
• VoiceProof — payment approval moved onto a signed channel: HMAC one-time approval links, dual approval above a threshold, full audit log. A cloned CEO voice on a phone call can't authorize a payment anymore. (26 tests)
• CanaryData — data-leak attribution. Seed every partner's copy of your data with unique canary records; when a dataset leaks, scan it and learn exactly whose copy it was. (16 tests)
• PrivChat — a private messenger with no phone number and no email: username + password only, end-to-end encrypted chat (X25519 + AES-256-GCM), WebRTC audio/video calls. The server relays ciphertext only. (20 tests)
• Plus bug-bounty-recon, api-security-scanner, web-vuln-scanner, ai-code-reviewer (rule-based, SARIF output, GitHub Action) and uptime-security-monitor (Go).

AI & automation

• AEO Radar — measures whether AI search engines (ChatGPT, Perplexity, AI Overviews) can find and cite your brand: visibility score, share of voice vs competitors, query-level wins/losses. (30 tests)
• ClipMachine — long video in, vertical shorts out (ffmpeg, loudness + cut detection). (25 tests)
• YouTube Automation, Social Automation, Auto Trading Bot (backtester + paper trading + an MQL5 EA), SupportPilot (self-hosted support chatbot over your own docs).

Business & web

• ClientHunter — finds local businesses with no or weak websites from OpenStreetMap data and scores the opportunity. I built it because I needed clients myself. (39 tests)
• NoTrain — AI-crawler control for your website: per-crawler robots.txt verdicts for 22 AI crawlers, a policy generator, and change monitoring. (47 tests)
• UsageMeter, OTT Starter Kit (Roku / Android TV / Apple TV), Self-Hosted Video.

The rules I followed

1. Test first, publish second. Nothing went public until its full test suite passed and I re-ran it myself.
2. Honest READMEs. Every repo states what it does not do yet. No fake claims.
3. Free forever. GPL-3.0 — use them, fork them, ship them.

All 21 live under github.com/tahiryounas604. Try them, break them, and tell me what to improve — issues and PRs are genuinely welcome.

Which one should I build out next?