LegitShow is the trusted source on every launched service — web apps, SaaS, AI tools, MCP servers and developer tools: what each one does, who it’s for, and how it actually holds up, measured by an objective 7-Frame production-readiness benchmark taken deterministically from the public surface. How we measure →

Legit.Show benchmarks every launched service it lists — measured deterministically from the public surface. See the methodology →

Cross-links · Directory · Reports · Insights · What AI reads · Methodology · About

Privacy · Terms · @Legit_Show on X · GitHub · operated by Madeflo Inc., a Delaware corporation. Benchmark engine powered by commit.show.

Ranked by measurement

Best vulnerability scanner

22 tested · top 22 shown

Ordered by a seven-frame production-readiness benchmark measured from each product's public surface — not popularity, pricing or feature count. Nobody pays to appear here and the order is never edited. How it is measured →
How this field scores
low 66median 86best 100
  1. 1
    SkillSpector
    Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks.
    Sec 100
    Std 100
    Disc 100
    3 not assessed
    github.com · measured 2026-08-09
  2. 2
    LaunchLint
    Security preflight scanner for AI-built apps before they go live.
    Perf 99
    Sec 100
    Priv 100
    Rel 100
    Std 92
    Disc 100
    getlaunchlint.com · measured 2026-08-09
  3. 3
    qsa.sh
    Command-line external port and vulnerability scanner for your own public IP.
    Perf 99
    Sec 80
    Priv 100
    Rel 100
    Std 92
    Disc 100
    qsa.sh · measured 2026-08-11
  4. 4
    VibeZero
    Automated security scanner that gives AI-built apps a go/no-go release decision.
    Perf 75
    Sec 100
    Priv 100
    Rel 100
    Std 100
    Disc 100
    vibezero.io · measured 2026-08-09
  5. 5
    Socket
    Socket protects software supply chains by blocking malicious open source packages.
    Perf 80
    Sec 100
    Priv 100
    Rel 100
    Std 100
    Disc 70
    socket.dev · measured 2026-08-09
  6. 6
    Edgewise Lab
    Ship Kit checks AI-built apps for common safety and launch issues before you go live.
    Perf 92
    Sec 80
    Priv 70
    Rel 100
    Std 100
    Disc 100
    edgewiselab.co.uk · measured 2026-08-09
  7. 7
    Puaro
    Puaro is an AI-powered secret scanning platform for code repositories.
    Perf 70
    Sec 80
    Priv 100
    Rel 100
    Std 97
    Disc 100
    puaro.io · measured 2026-08-09
  8. 8
    Veracode
    Veracode is an application risk management platform for securing software across the development lifecycle.
    Perf 80
    Sec 100
    Priv 75
    Rel 90
    Std 100
    Disc 100
    veracode.com · measured 2026-08-09
  9. 9
    bug-hunter
    Adversarial AI bug hunter with auto-fix skill for Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI
    Sec 90
    Std 100
    Disc 65
    3 not assessed
    github.com · measured 2026-08-09
  10. 10
    Perfai Security
    Autonomous application security platform for AI-built apps.
    Perf 66
    Sec 100
    Priv 100
    Rel 75
    Std 76
    Disc 100
    perfai.ai · measured 2026-08-09
  11. 11
    AbyssGuard
    AbyssGuard scans AI-built apps for security risks before launch.
    Perf 88
    Sec 45
    Priv 75
    Rel 100
    Std 92
    Disc 100
    abyssguard.app · measured 2026-08-11
  12. 12
    Darkmoon
    Autonomous AI penetration testing platform using 18 agents and 80+ integrated tools.
    Perf 92
    Sec 100
    Priv 25
    Rel 100
    Std 92
    Disc 100
    dark-moon.org · measured 2026-08-09
  13. 13
    Firewall
    Protect your software supply chain with Hextrap Firewall. Real-time package scanning, allow/deny lists, typosq
    Perf 77
    Sec 80
    Priv 100
    Rel 100
    Std 89
    Disc 35
    hextrap.com · measured 2026-08-09
  14. 14
    MeshaSec
    On-premise AI application security platform with DAST, SAST, SCA, and a unified security copilot.
    Perf 80
    Sec 45
    Priv 100
    Rel 100
    Std 75
    Disc 87
    meshasec.com · measured 2026-08-09
  15. 15
    hexstrike-ai
    HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomousl
    Perf 80
    Sec 100
    Priv 25
    Rel 75
    Std 100
    Disc 70
    hexstrike.com · measured 2026-08-09
  16. 16
    Canopii Trust Index
    Open-source CLI for scanning MCP servers against the Canopii Trust Index.
    Perf 96
    Sec 25
    Priv 25
    Rel 100
    Std 92
    Disc 87
    index.canopii.dev · measured 2026-08-09
  17. 17
    GitGuardian
    GitGuardian detects and helps remediate exposed secrets across code and developer tools.
    Perf 39
    Sec 80
    Priv 55
    Rel 100
    Std 79
    Disc 70
    gitguardian.com · measured 2026-08-08
  18. 18
    Sonar
    Sonar provides code quality and security verification tools for development teams.
    Perf 80
    Sec 85
    Priv 0
    Rel 100
    Std 75
    Disc 100
    sonarsource.com · measured 2026-08-09
  19. 19
    k8scan
    Kubernetes security scanner that detects misconfigurations, secrets, and RBAC flaws in Helm charts and manifes
    Perf 74
    Sec 25
    Priv 25
    Rel 100
    Std 92
    Disc 100
    k8scan.com · measured 2026-08-09
  20. 20
    Semgrep
    Semgrep is a code security platform offering SAST, SCA, and secrets detection.
    Perf 32
    Sec 45
    Priv 100
    Rel 75
    Std 76
    Disc 85
    semgrep.dev · measured 2026-08-11
  21. 21
    BestDefense.io
    Automated security platform that finds, fixes, and verifies vulnerabilities on every deploy.
    Perf 62
    Sec 45
    Priv 0
    Rel 100
    Std 76
    Disc 100
    bestdefense.io · measured 2026-08-11
  22. 22
    VulnClaw
    VulnClaw is an open-source, AI-driven penetration testing CLI tool for Python 3.10+.
    Perf 62
    Sec 45
    Priv 25
    Rel 80
    Std 92
    Disc 75
    unclecheng-li.github.io · measured 2026-08-09
What this does not say
Products whose sites block automated readers are left out rather than ranked last — we did not measure them, and bottom placement would claim something we never observed. Scores are floors: anything set at a CDN, a proxy or behind a login is invisible from the public surface.

All measured categories → · Browse the directory →