PyPI
squid-protocol/gitgalaxy
Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.
Eigene Lizenz20. Okt. 2026 · Metriken 2.10.0
Alle Tags
Katalog-Tag
#supply-chain-security
Alle Repositories im öffentlichen Register, die dieses Tag tragen — aus ihren GitHub-Topics oder den von ihren Paket-Registries veröffentlichten Schlagwörtern. Die Gesundheit wird nach derselben versionierten Methodik gemessen wie im übrigen Register.
92 Einträge
Go · npm
step-security/secure-repo
Orchestrate GitHub Actions Security
AGPL-3.029. Sept. 2026 · Metriken 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.09. Sept. 2026 · Metriken 2.10.0
Go
glsec/glsec
Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.
Apache-2.010. Sept. 2026 · Metriken 2.10.0
PyPI · npm
owasp-dep-scan/dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
MIT18. Sept. 2026 · Metriken 2.10.0
Go
rezmoss/sbomlyze
Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.
Apache-2.012. Sept. 2026 · Metriken 2.10.0
npm · crates.io
sheeki03/tirith
Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.
AGPL-3.021. Okt. 2026 · Metriken 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.020. Okt. 2026 · Metriken 2.10.0
PyPI · npm
PrismorSec/prismor
Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
Apache-2.011. Sept. 2026 · Metriken 2.10.0
Go
liatrio/autogov
Unified CLI for software supply-chain governance / verify GitHub artifact attestations, evaluate OPA/Rego policies, generate SLSA Verification Summary Attestations (VSAs), and manage releases.
Apache-2.015. Sept. 2026 · Metriken 2.10.0
Go
saschagrunert/nri-supply-chain
NRI plugin for supply chain attestation verification of container images.
Apache-2.017. Sept. 2026 · Metriken 2.10.0
PyPI
b7n0de/proofbundle
Offline cryptographic receipts for AI evaluation results — Ed25519 + RFC 6962 Merkle + optional SD-JWT. Integrity, not truth
MIT13. Sept. 2026 · Metriken 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MIT16. Sept. 2026 · Metriken 2.10.0
Go
draugr-dev/draugr
Run Trivy, Semgrep, Gitleaks and more from one file. Consolidates SAST, SCA, secrets, IaC and container findings into one SARIF report and one pass/fail gate for CI — ranked by real risk, and can fail a PR on new findings only.
Apache-2.011. Sept. 2026 · Metriken 2.10.0
PyPI
pezhik/skilltotal
Scan AI components (MCP servers, agent skills, npm/PyPI packages) for malware & risky capabilities. Local, deterministic, evidence-anchored. Free & OSS.
Apache-2.09. Okt. 2026 · Metriken 2.10.0
Go
ben-ranford/lopper
measure dependency waste and attack surface before it ships
MIT19. Sept. 2026 · Metriken 2.10.0
npm
getmcpm/cli
MCP security guard + package manager. Block prompt injection, tool poisoning and rug-pulls in Model Context Protocol servers at runtime; trust-scored installs with Sigstore provenance for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and Gemini CLI. Local, deterministic, no LLM in the loop.
MIT8. Sept. 2026 · Metriken 2.10.0
npm · PyPI
sinewaveai/agent-security-scanner-mcp
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
MIT9. Okt. 2026 · Metriken 2.10.0
Go · npm
araihu/muamba
TOFU vendoring and integrity locks for remote assets
MIT16. Okt. 2026 · Metriken 2.10.0
Go
git-pkgs/pin
Browser asset vendoring without npm.
MIT19. Sept. 2026 · Metriken 2.10.0
Go
github/actions-lockfile
The authoritative definition of the GitHub Actions dependency lockfile format, plus a Go parser for auditing and verifying the action pins in use across a repo's workflows.
MIT16. Sept. 2026 · Metriken 2.10.0
Go
jitpass/jit
Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first.
Eigene Lizenz22. Okt. 2026 · Metriken 2.10.0
Go
jrjsmrtn/ansible-bom
Inventory installed Ansible content — collections and roles — and emit a lockfile, drift report, and CycloneDX BOM
Apache-2.024. Sept. 2026 · Metriken 2.10.0
PyPI
shcherbak-ai/tethered
tethered - Runtime network egress control for Python. One function call to restrict which hosts your code can connect to.
MIT14. Okt. 2026 · Metriken 2.10.0
PyPI · npm
gautamvarmadatla/mcpsafetywarden
MCP servers expose tools with no information about what they actually do at runtime. mcpsafetywarden sits between your agent and any MCP server, profiling tool behavior, blocking destructive calls, and running active security audits before you trust them in a workflow.
Eigene Lizenz15. Sept. 2026 · Metriken 2.10.0
Go
TomTonic/extract-sbom
Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.
BSD-3-Clause12. Sept. 2026 · Metriken 2.10.0
npm
adamsjack711-ux/pkgxray
Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.
MIT10. Sept. 2026 · Metriken 2.10.0
PyPI
sunglasses-dev/sunglasses
Open source input firewall for AI agents, beta. A local scanner checks text, code, PDFs, images, QR codes, audio and video with 1,583 patterns across 117 categories and reports findings and incomplete scans. A Claude Code hook blocks secret material in tool calls and the paths and hosts your policy lists before tools run.
MIT19. Okt. 2026 · Metriken 2.10.0
Go
git-pkgs/capcheck
Fail CI when Go code or dependencies gain new privileged operations, using google/capslock
MIT14. Sept. 2026 · Metriken 2.10.0
Go · npm
dev-hato/gomod-cooldown
Delay newly available Go module versions during dependency updates with a temporary local GOPROXY.
MIT8. Sept. 2026 · Metriken 2.10.0