crates.io
jdx/packslip
A signed release manifest for vendor binaries
MIT18 sept 2026 · métricas 2.10.0
Todas las etiquetas
Etiqueta del catálogo
#supply-chain
Todos los repositorios del registro público que llevan esta etiqueta, procedente de sus topics de GitHub o de las palabras clave que publican sus registros de paquetes. La salud se mide con la misma metodología versionada que el resto del registro.
64 registros
npm
AppThreat/atom
atom is a novel intermediate representation for applications and a standalone tool that is powered by chen.
MIT15 sept 2026 · métricas 2.10.0
npm
abpai/harness-doctor
Framework-agnostic agent-harness doctor: deterministic checks for good agent-harness practices
MIT13 sept 2026 · métricas 2.10.0
Go
cplieger/pinstall
Install and update a pinned, digest-verified package into versioned directories
Apache-2.019 sept 2026 · métricas 2.10.0
npm
vaultcompasshq/conductor
Umbrella installer and combined report over the independently installable guardrail gates
MIT14 sept 2026 · métricas 2.10.0
Go
eitanity/kanonarion
Dependency assurance software for Go. A deterministic, local source of truth about your dependencies - what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON.
Apache-2.011 sept 2026 · métricas 2.10.0
PyPI
yunaremaia/taintrace
Typosquat detector for AI coding agent dependencies
MIT4 oct 2026 · métricas 2.10.0
PyPI · npm
HikaruEgashira/pmsec
Zero-config supply-chain hardening.
MIT8 sept 2026 · métricas 2.10.0
npm · crates.io
quality-sh/provenance
El repositorio no publica descripción.
Licencia propia20 oct 2026 · métricas 2.10.0
PyPI
YugantM/hvtracker
AI agent & MCP trust registry — independent, evidence-based trust scores for 1.3K+ open-source AI agents and MCP servers. Runtime-trust calibrated (MCP, dependencies, provenance drift), with side-by-side comparison and embeddable live badges. Ranked by verifiable signals, not hype.
MIT13 sept 2026 · métricas 2.10.0
Go · npm
cjohnstoniv/wardyn
Open-source governed-sandbox control plane for any workload — per-run identity, brokered credentials, layered egress, approvals, and an append-only audit. Coding agents are the flagship use. Apache-2.0, self-hosted.
Apache-2.014 sept 2026 · métricas 2.10.0
PyPI · Go
jmelahman/pkglint
Linter for Arch Linux PKGBUILDs
GPL-3.09 oct 2026 · métricas 2.10.0
Packagist
k2gl/dsse
Sign and verify DSSE (Dead Simple Signing Envelope) payloads in PHP.
MIT13 sept 2026 · métricas 2.10.0
Go
matteo-sung/lockvet
Explain any lockfile change: bumps release-verified against 22 registries, vulns (OSV), ages, deprecations, typosquats, integrity tampering — 61 formats incl. pdm.lock, vcpkg, mise.lock, build.gradle, pom.xml, go.sum, GitHub Actions, GitLab CI, Dockerfiles, Kubernetes, Helm, SBOMs. CLI + CI gate + MCP server + playground. By an AI agent.
MIT23 ago 2026 · métricas 2.10.0
npm
KirtashDev/dephawk
🦅 Catch npm dependencies red-handed at runtime — see & block when one reads your SSH keys, steals secrets, or phones home.
MIT18 sept 2026 · métricas 2.10.0
npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.015 sept 2026 · métricas 2.10.0
PyPI
i-ops-hq/assurance
Point it at a folder and find out what is missing, and what silently changed. Coverage over dated or numbered series, plus a baseline anyone can keep. No model decides any of it.
Apache-2.018 sept 2026 · métricas 2.10.0
npm
lloyal-ai/hdk
Harness Development Kit for Vertical Inference
Licencia propia8 sept 2026 · métricas 2.10.0
Go · npm
daimoniac/suppline
Self-hosted Kubernetes image intake gateway: mirror → Trivy scan → CEL policy → Sigstore attestations. Admit only what passed.
Apache-2.014 sept 2026 · métricas 2.10.0
Packagist
laravel/vet
Laravel Vet is a dependency audit for PHP.
MIT23 sept 2026 · métricas 2.10.0
npm
dot-skill/skillerr
Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.
Apache-2.014 sept 2026 · métricas 2.10.0
crates.io
cackle-rs/cackle
A code ACL checker for Rust
Licencia propia18 sept 2026 · métricas 2.10.0
npm
cdxgen/cdx-proto
Runtime library to serialize/deserialize CycloneDX BOM with protocol buffers
MIT15 sept 2026 · métricas 2.10.0
npm
extensiondev/artifact-integrity
Trust what you ship: download and verify browser extension artifacts (zip structure, manifest, metadata) and emit a deterministic JSON report for CI release gates.
Apache-2.013 sept 2026 · métricas 2.10.0
npm
nkratk/llm-trust-guard
El repositorio no publica descripción.
MIT11 sept 2026 · métricas 2.10.0
PyPI · npm
DevInder1/supply-chain-scanner-public
Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.
MIT30 sept 2026 · métricas 2.10.0
npm · PyPI
YugantM/hvtracker-mcp
MCP server for HVTracker trust checks.
MIT13 sept 2026 · métricas 2.10.0
npm
davidnichols-ops/trustcard
Cryptographic trust infrastructure for MCP servers — signed manifests, TOFU pinning, two-gate enforcement, and the "npm audit" scanner.
MIT13 sept 2026 · métricas 2.10.0
npm
nabheet/pcbway-mcp-server
MCP server for PCBWay Partner API — PCB quotes, SMT assembly, order management, shipping
MIT18 sept 2026 · métricas 2.10.0
npm
iAMv1/omnisectester
Nation-state grade, defense-in-depth security testing framework. Tests web apps, extensions, desktop, mobile, cloud, AI/LLM, hardware, and supply chain from a single CLI.
MIT22 sept 2026 · métricas 2.10.0