Go
saschagrunert/nri-supply-chain
NRI plugin for supply chain attestation verification.
Apache-2.09 ago 2026 · métricas 2.10.0
Todas las etiquetas
Etiqueta del catálogo
#supply-chain-security
Todos los repositorios del registro público que llevan esta etiqueta, procedente de sus topics de GitHub o de las palabras clave que publican sus registros de paquetes. La salud se mide con la misma metodología versionada que el resto del registro.
51 registros
PyPI
b7n0de/proofbundle
Offline cryptographic receipts for AI evaluation results — Ed25519 + RFC 6962 Merkle + optional SD-JWT. Integrity, not truth
MIT23 jul 2026 · métricas 2.10.0
Go
github/actions-lockfile
The authoritative definition of the GitHub Actions dependency lockfile format, plus a Go parser for auditing and verifying the action pins in use across a repo's workflows.
MIT3 ago 2026 · métricas 2.10.0
PyPI · npm
PrismorSec/prismor
Runtime Firewall for AI agents which catches the rogue tool call before it runs. Dangerous commands, secret leaks, prompt injection. For Claude Code, Codex and framework SDKs
Apache-2.019 jul 2026 · métricas 2.10.0
Go
optimuslabs-io/grokpatrol
Open-source, offline forensic scanner CLI tool designed to detect evidence of git repo collection or upload by the Grok Build CLI to xAI infrastructure.
Apache-2.018 jul 2026 · métricas 2.10.0
Go · npm
codeswhat/lookout
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
Licencia propia16 jul 2026 · métricas 2.10.0
crates.io
pulseengine/sigil
Sigil — Supply chain security for WebAssembly. Embedded signatures, Sigstore keyless signing, SLSA provenance. Part of the PulseEngine toolchain.
Sin licencia5 ago 2026 · métricas 2.10.0
npm
starloghq/index
Vet a package before your AI coding agent uses it — authoritative facts (CVEs, license, maintenance) via an MCP server + CLI. Local, no account.
Licencia propia6 sept 2026 · métricas 2.10.0
Go
tiagosilva07/zyrax-guard
Audit your AI agent configs before you run them — prompt injection, rogue MCP servers, credential-exfil. Plus dependency vetting.
MIT28 ago 2026 · métricas 2.10.0
crates.io
sebastienrousseau/dtt
Rust crate for date, time, and timezone manipulation. Parse, format, validate, and convert RFC 3339 / ISO 8601 with guaranteed round-trip safety.
Apache-2.025 jul 2026 · métricas 2.10.0
Go
famclaw/honeybadger
Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.
MIT17 jul 2026 · métricas 2.10.0
PyPI
sunglasses-dev/sunglasses
Sunglasses for AI agents. Protection layer + neighborhood watch.
MIT18 ago 2026 · métricas 2.10.0
npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.031 jul 2026 · métricas 2.10.0
Go
Goryudyuma/gomod-cooldown
Delay newly available Go module versions during dependency updates with a temporary local GOPROXY.
MIT15 jul 2026 · métricas 2.10.0
Packagist
andreapollastri/checkpoint
Laravel Security Tool
MIT22 ago 2026 · métricas 2.10.0
Go
Conalh/tofulock
Lock & verify Terraform/OpenTofu module sources by commit digest - the integrity providers get from the native lockfile, but modules don't.
MIT27 jul 2026 · métricas 2.10.0
Go
sairintechnologycom/pkgsafe
Supply-chain firewall for AI coding agents and developers — checks npm/PyPI packages against OSV advisories, typosquat & lifecycle-script heuristics, and your policy before install. Local-first, MCP-native.
MIT15 jul 2026 · métricas 2.10.0
Go · npm
undont/supplyscan
scan JavaScript lockfiles to detect supply chain vulnerabilities and known exploits
MIT22 jul 2026 · métricas 2.10.0
PyPI
zrk222/code-factory
Proof-first software factory for AI-assisted code: specs, adversarial gates, deterministic decisions, and reviewable receipts.
Licencia propia17 jul 2026 · métricas 2.10.0
PyPI
meidielo/aes-256-gcm-python-tool
Reviewable AES-256-GCM educational tool with Argon2id, JSON envelopes, and safe-mode streaming.
MIT19 jul 2026 · métricas 2.10.0
Go
wille/gh-actions-cli
Harden and manage your GitHub Actions: SHA-pin every action, enforce allowlist policies, update interactively, and analyze run health
MIT17 jul 2026 · métricas 2.10.0