Tools we build and use ourselves

Daily scanning of npm packages — download the same tool for your own repos.

PlayCISO scans the top npm packages daily against 50 risk policies (install scripts, ownership changes, typosquats, obfuscation). Paid users run the same CLI via npx @playciso-scanner/npm-scanner --token <token> against their own packages, repos, or file lists.

Static detection for prompt-injection and jailbreaks.

Matches text against known injection patterns and maps each hit to its OWASP LLM risk — fully local, nothing sent to a model.

A static audit of your MCP server config.

Paste your MCP config; it flags plaintext secrets, unpinned installs, shell pipes, and over-broad filesystem roots.

Red-team a model endpoint you control.

Runs an adversarial suite — jailbreak, injection, secret-leak — against your own model endpoint and hands you the replies.

Score a Chrome extension by what it can actually do.

Give it an extension ID; it pulls the live Web Store manifest and scores the permission combinations nobody reads.

A bill of materials for your AI stack.

Turns a package.json or models/datasets manifest into a CycloneDX-style inventory with a license-risk read per component.

A resume critique tuned to security roles and your market.

Grades your resume for a specific role and market, rewrites the flat bullets, and finds the ATS keywords you’re missing.

A verification standard for AI systems — in development.

An ASVS-style verification standard for AI systems, still being written — the one thing here you can't run yet.

Gamified practice for CSA, IAPP, ISACA, and ISO/IEC 42001.

600+ questions across four AI security/governance certifications — CSA AI Security, IAPP AIGP, ISACA AAIA, and ISO/IEC 42001 Lead Auditor. XP-gated levels keep the grind honest.

Survive a 10% budget cut, get a CISO Score, challenge a colleague.

One shared board per week, a server-graded CISO Score out of 1000, a live leaderboard, and challenge links that make a colleague play your exact scenario. Free, no account.

Six-phase acquisition scenario with ransomware incident, dual roles, and NPC advisors.

6 phases · 2 roles · ~3h · cyber incident · 7 NPC advisors

Upload your resume, get a 60-second cinematic video with AI voiceover.

Extracts your career story, writes a narrative script, records motion graphics with professional AI voiceover, and delivers a shareable MP4. First video free.

Check a host for IOCs from the March 2026 LiteLLM supply chain attack.

A free, local, single-file Python script — no network calls, no telemetry. Checks installed version, lockfiles, dropped files, systemd persistence, and Kubernetes lateral-movement pods against the known IOCs.