PyPI
squid-protocol/gitgalaxy
Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.
Licencia propia20 oct 2026 · métricas 2.10.0
Todas las etiquetas
Etiqueta del catálogo
#supply-chain-security
Todos los repositorios del registro público que llevan esta etiqueta, procedente de sus topics de GitHub o de las palabras clave que publican sus registros de paquetes. La salud se mide con la misma metodología versionada que el resto del registro.
92 registros
Go · npm
step-security/secure-repo
Orchestrate GitHub Actions Security
AGPL-3.029 sept 2026 · métricas 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.09 sept 2026 · métricas 2.10.0
Go
glsec/glsec
Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.
Apache-2.010 sept 2026 · métricas 2.10.0
PyPI · npm
owasp-dep-scan/dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
MIT18 sept 2026 · métricas 2.10.0
Go
rezmoss/sbomlyze
Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.
Apache-2.012 sept 2026 · métricas 2.10.0
npm · crates.io
sheeki03/tirith
Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.
AGPL-3.021 oct 2026 · métricas 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.020 oct 2026 · métricas 2.10.0
PyPI · npm
PrismorSec/prismor
Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
Apache-2.011 sept 2026 · métricas 2.10.0
Go
liatrio/autogov
Unified CLI for software supply-chain governance / verify GitHub artifact attestations, evaluate OPA/Rego policies, generate SLSA Verification Summary Attestations (VSAs), and manage releases.
Apache-2.015 sept 2026 · métricas 2.10.0
Go
saschagrunert/nri-supply-chain
NRI plugin for supply chain attestation verification of container images.
Apache-2.017 sept 2026 · métricas 2.10.0
PyPI
b7n0de/proofbundle
Offline cryptographic receipts for AI evaluation results — Ed25519 + RFC 6962 Merkle + optional SD-JWT. Integrity, not truth
MIT13 sept 2026 · métricas 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MIT16 sept 2026 · métricas 2.10.0
Go
draugr-dev/draugr
Run Trivy, Semgrep, Gitleaks and more from one file. Consolidates SAST, SCA, secrets, IaC and container findings into one SARIF report and one pass/fail gate for CI — ranked by real risk, and can fail a PR on new findings only.
Apache-2.011 sept 2026 · métricas 2.10.0
PyPI
pezhik/skilltotal
Scan AI components (MCP servers, agent skills, npm/PyPI packages) for malware & risky capabilities. Local, deterministic, evidence-anchored. Free & OSS.
Apache-2.09 oct 2026 · métricas 2.10.0
Go
ben-ranford/lopper
measure dependency waste and attack surface before it ships
MIT19 sept 2026 · métricas 2.10.0
npm
getmcpm/cli
MCP security guard + package manager. Block prompt injection, tool poisoning and rug-pulls in Model Context Protocol servers at runtime; trust-scored installs with Sigstore provenance for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and Gemini CLI. Local, deterministic, no LLM in the loop.
MIT8 sept 2026 · métricas 2.10.0
npm · PyPI
sinewaveai/agent-security-scanner-mcp
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
MIT9 oct 2026 · métricas 2.10.0
Go · npm
araihu/muamba
TOFU vendoring and integrity locks for remote assets
MIT16 oct 2026 · métricas 2.10.0
Go
git-pkgs/pin
Browser asset vendoring without npm.
MIT19 sept 2026 · métricas 2.10.0
Go
github/actions-lockfile
The authoritative definition of the GitHub Actions dependency lockfile format, plus a Go parser for auditing and verifying the action pins in use across a repo's workflows.
MIT16 sept 2026 · métricas 2.10.0
Go
jitpass/jit
Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first.
Licencia propia22 oct 2026 · métricas 2.10.0
Go
jrjsmrtn/ansible-bom
Inventory installed Ansible content — collections and roles — and emit a lockfile, drift report, and CycloneDX BOM
Apache-2.024 sept 2026 · métricas 2.10.0
PyPI
shcherbak-ai/tethered
tethered - Runtime network egress control for Python. One function call to restrict which hosts your code can connect to.
MIT14 oct 2026 · métricas 2.10.0
PyPI · npm
gautamvarmadatla/mcpsafetywarden
MCP servers expose tools with no information about what they actually do at runtime. mcpsafetywarden sits between your agent and any MCP server, profiling tool behavior, blocking destructive calls, and running active security audits before you trust them in a workflow.
Licencia propia15 sept 2026 · métricas 2.10.0
Go
TomTonic/extract-sbom
Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.
BSD-3-Clause12 sept 2026 · métricas 2.10.0
npm
adamsjack711-ux/pkgxray
Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.
MIT10 sept 2026 · métricas 2.10.0
PyPI
sunglasses-dev/sunglasses
Open source input firewall for AI agents, beta. A local scanner checks text, code, PDFs, images, QR codes, audio and video with 1,583 patterns across 117 categories and reports findings and incomplete scans. A Claude Code hook blocks secret material in tool calls and the paths and hosts your policy lists before tools run.
MIT19 oct 2026 · métricas 2.10.0
Go
git-pkgs/capcheck
Fail CI when Go code or dependencies gain new privileged operations, using google/capslock
MIT14 sept 2026 · métricas 2.10.0
Go · npm
dev-hato/gomod-cooldown
Delay newly available Go module versions during dependency updates with a temporary local GOPROXY.
MIT8 sept 2026 · métricas 2.10.0