Go
sigstore/sigstore
Common go library shared across sigstore services and clients
Apache-2.029 ago 2026 · métricas 2.10.0
Todas las etiquetas
Etiqueta del catálogo
#supply-chain
Todos los repositorios del registro público que llevan esta etiqueta, procedente de sus topics de GitHub o de las palabras clave que publican sus registros de paquetes. La salud se mide con la misma metodología versionada que el resto del registro.
37 registros
Go · npm
mindersec/minder
Software Supply Chain Security Platform
Apache-2.020 jul 2026 · métricas 2.10.0
PyPI
sigstore/sigstore-python
A Sigstore client written in Python
Licencia propia11 ago 2026 · métricas 2.10.0
Go
Sigstore/rekor
Software Supply Chain Transparency Log
Apache-2.018 jul 2026 · métricas 2.10.0
PyPI
pypa/pip-audit
Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
Apache-2.027 ago 2026 · métricas 2.10.0
PyPI · npm
msaad00/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.016 jul 2026 · métricas 2.10.0
npm
sigstore/sigstore-js
Code-signing for npm packages
Apache-2.031 ago 2026 · métricas 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.028 jul 2026 · métricas 2.10.0
Go
carabiner-dev/ampel
🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)
Apache-2.021 jul 2026 · métricas 2.10.0
Go · npm
seebom-labs/BOMHort
About standalone, Kubernetes-native Software Bill of Materials (SBOM) visualization and governance platform
Apache-2.029 jul 2026 · métricas 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MIT6 sept 2026 · métricas 2.10.0
npm
blamejs/blamejs
The Node framework that owns its stack.
Apache-2.022 ago 2026 · métricas 2.10.0
Go · npm
emoss08/Trenova
An AI-driven asset based Transportation Management System
Licencia propia3 ago 2026 · métricas 2.10.0
crates.io
rust-secure-code/cargo-auditable
Make production Rust binaries auditable
Apache-2.05 sept 2026 · métricas 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.022 ago 2026 · métricas 2.10.0
npm
blamejs/pki
Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.
Apache-2.023 jul 2026 · métricas 2.10.0
PyPI · npm
PrismorSec/prismor
Runtime Firewall for AI agents which catches the rogue tool call before it runs. Dangerous commands, secret leaks, prompt injection. For Claude Code, Codex and framework SDKs
Apache-2.019 jul 2026 · métricas 2.10.0
PyPI
Ndevu12/stayAwakeBot
A bot for helping you to stay secure and making free hosted services stay a wake
AGPL-3.031 jul 2026 · métricas 2.10.0
npm
abpai/harness-doctor
Framework-agnostic agent-harness doctor: deterministic checks for good agent-harness practices
MIT23 jul 2026 · métricas 2.10.0
Packagist
dgtlss/warden
A Laravel package that proactively monitors your dependencies for security vulnerabilities by running automated composer audits and sending notifications via webhooks and email
MIT5 sept 2026 · métricas 2.10.0
npm
dot-skill/skillerr
Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.
Apache-2.027 jul 2026 · métricas 2.10.0
Go
eitanity/kanonarion
Dependency assurance software for Go. A deterministic, local source of truth about your dependencies - what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON.
Apache-2.019 jul 2026 · métricas 2.10.0
Go
matteo-sung/lockvet
Explain any lockfile change: bumps release-verified against 22 registries, vulns (OSV), ages, deprecations, typosquats, integrity tampering — 61 formats incl. pdm.lock, vcpkg, mise.lock, build.gradle, pom.xml, go.sum, GitHub Actions, GitLab CI, Dockerfiles, Kubernetes, Helm, SBOMs. CLI + CI gate + MCP server + playground. By an AI agent.
MIT23 ago 2026 · métricas 2.10.0
npm · PyPI
HikaruEgashira/pmsec
Zero-config supply-chain hardening.
MIT15 jul 2026 · métricas 2.10.0
Go · npm
cjohnstoniv/wardyn
Open-source governance control plane for coding agents — per-run identity, brokered credentials, layered egress, approvals, and an append-only audit. Apache-2.0, self-hosted.
Apache-2.027 jul 2026 · métricas 2.10.0
Go · npm
daimoniac/suppline
Self-hosted Kubernetes image intake gateway: mirror → Trivy scan → CEL policy → Sigstore attestations. Admit only what passed.
Apache-2.030 jul 2026 · métricas 2.10.0
PyPI
YugantM/hvtracker
AI Agent Trust Registry — independent, evidence-based trust scores for 300+ open-source AI agents. Runtime-trust calibrated (MCP, dependencies, provenance drift), with side-by-side comparison and embeddable live badges. Ranked by verifiable signals, not hype.
MIT26 jul 2026 · métricas 2.10.0
crates.io
cackle-rs/cackle
A code ACL checker for Rust
Licencia propia16 ago 2026 · métricas 2.10.0
npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.031 jul 2026 · métricas 2.10.0
npm
extensiondev/artifact-integrity
Trust what you ship: download and verify browser extension artifacts (zip structure, manifest, metadata) and emit a deterministic JSON report for CI release gates.
Apache-2.025 jul 2026 · métricas 2.10.0