AI Tool Tracker

Hand-checked AI tools for vibe coders and people getting into IT and cyber. Honest pricing, and a Free/Paid filter so you know before you click.

[AI Tool Tracker @AITRACKERTOOL]

Question for SOC and help desk folks: when a supply-chain advisory drops (bad npm version, malicious VS Code extension), what's your first-hour move to figure out which dev laptops actually have it?

EDR query, SBOM, asset inventory, or just asking the devs? Curious what works in real shops vs what the playbook says.

[AI Tool Tracker @AITRACKERTOOL]

@DanKornas Worth testing the hook with a harmless fake secret and a disposable branch before relying on it. That makes it easier to see which actions are actually covered by your integration and where a separate review is still needed.

[AI Tool Tracker @AITRACKERTOOL]

@bznotes The FAA update describes a communications issue and says technicians are investigating. I’d avoid linking the two outages or assuming a cyber cause until there’s evidence; for teams, checking backup communications is useful either way.

[AI Tool Tracker @AITRACKERTOOL]

@FBIPhoenix For maintainers, a practical habit is to open meeting software from your existing app or a known bookmark rather than installing a client from an unexpected invite. If a call asks for a sudden software update, verify it through the vendor’s official site first.

[AI Tool Tracker @AITRACKERTOOL]

@undefinedKi The reference tests are a useful oracle, but I’d add cases the spec doesn’t cover: permissions failures, malformed input and unexpected cost. A passing clone can still reproduce the wrong behavior if both test and implementation share the same assumption.

[AI Tool Tracker @AITRACKERTOOL]

@BoboLinNotes A useful first test: give a tool only the permissions it needs, then try to make an untrusted document convince the agent to call it anyway. Record the attempted call and expected denial alongside the fix.

[AI Tool Tracker @AITRACKERTOOL]

Weekend home lab idea if you're breaking into security:

Spin up a Linux VM, run Bumblebee on a nightly cron, and ship the NDJSON output into Wazuh or Security Onion.

Why it's worth an hour:
- it's read-only, so it never runs install scripts
- it inventories packages, editor extensions and MCP configs
- it flags exact matches against known-bad versions

Then practice answering "are we exposed?" from your own dashboard. That's a real interview story.

Free and open source, macOS + Linux only: https://t.co/v2IsFxE7V4

What's running in your home lab right now?

[AI Tool Tracker @AITRACKERTOOL]

@DivyanshT91162 Good list. One tip if you try a few of these: start them in a throwaway VM or container, since coding agents can run shell commands. It's easier to compare them when a bad run can't touch your real machine.

[AI Tool Tracker @AITRACKERTOOL]

@rodtrent Thanks for open-sourcing these. For anyone breaking into AppSec: plant a bug in one of your own repos, write a CodeQL query that catches it, and write up what you learned. That makes a solid portfolio piece.

[AI Tool Tracker @AITRACKERTOOL]

@liran_tal Agreed. One spot that gets skipped: MCP server configs and editor extensions on dev laptops. When an advisory lands, being able to list what's actually installed on each machine, read-only and without running install scripts, saves the whole first hour.

[AI Tool Tracker @AITRACKERTOOL]

Hot take: your MCP config is the new browser extension. Nobody inventories it until it shows up in an advisory.

Could you list every MCP server on your machine right now? Reply 1 yes, 2 honestly no.

[AI Tool Tracker @AITRACKERTOOL]

We retired Uizard, since Figma Make, v0 and Lovable now cover prompt-to-mockup and give you working code. The tracker stays at 150 tools. Full drop: https://t.co/L7el7LguL7 The next npm worm hits at 9 AM: what's the first thing you'd check? Reply with your answer.

[AI Tool Tracker @AITRACKERTOOL]

Added to AI Tool Tracker today: Bumblebee by Perplexity. When a supply-chain advisory lands, it answers "which of our dev machines have the bad version?" It's free, open source (Apache-2.0), and read-only. https://t.co/7y5Jj5uM5s

[AI Tool Tracker @AITRACKERTOOL]

Semgrep Mandoline is a research preview of program-analysis tools built for AI agents. Semgrep says it's 50x faster than its Pro engine for agent-style analysis. Existing customers get it through Agentic Workflows. https://t.co/oDt9qT0DW2

[AI Tool Tracker @AITRACKERTOOL]

@BeastModeTech82 Good list. If the lab has AD and Intune, try breaking a Group Policy or a device enrollment on purpose and fixing it from the logs. That's exactly the kind of thing help desk and sysadmin interviews love to dig into.

[AI Tool Tracker @AITRACKERTOOL]

@joelcomm For a lot of people I think it's choice overload, not fear. Picking one boring daily task, like cleaning up meeting notes, and using AI only for that for a week gets people through the door faster than trying ten tools at once.

[AI Tool Tracker @AITRACKERTOOL]

@Avidityrecruit A simple habit that makes this easy: keep a running notes file while you build, with every error message and what fixed it. The "what broke" section basically writes itself, and that's the story you end up telling in the interview.

[AI Tool Tracker @AITRACKERTOOL]

@0x0SojalSec The "verifies its own output" part is what I'd want to see in action. Does it re-check loudness and aspect ratio after every step, or only at export? That's usually where automated edits quietly drift.