#devsecops

Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.

GitLab CI security linter - find misconfigurations and vulnerabilities in .gitlab-ci.yml files

CLI to interact with Kondukto

Runtime Firewall for AI agents which catches the rogue tool call before it runs. Dangerous commands, secret leaks, prompt injection. For Claude Code, Codex and framework SDKs

Audit and fix your Mac's security in one command. No agent, no signup, open source.

Dependency assurance software for Go. A deterministic, local source of truth about your dependencies - what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON.

AI agent configuration security auditor - find misconfigurations in Claude Code, Cursor, and other AI tools

SecURL - passive external security posture scanner. Free hosted scanner, open-source engine, CI integration

Scan your codebase for AI slop. Get a Slop Score. Ship clean. A zero-dependency CLI (85 detectors: security, performance, code-quality, design tells) + a 181-pattern Anti-Slop Protocol for AI coding agents.

Unified DLP scanner for secrets and PII across filesystem, git, stdin, and SaaS sources.

Agent control plane for governed AI coding: validate changes, enforce policy gates, track findings, proofs, and evals based on your habits.

Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.

A command line interface tool designed for efficient management and automation within your internal developer platform.

AI-native CWE (Common Weakness Enumeration) integration layer — Skills, Go SDK, CLI & MCP. Ship CVE/CWE tooling to SAST/DAST, vuln-management & AI agents.

Find authorization bugs before attackers do. Free SAST — IDOR detection, 100% CVE recall, 0% false positives. 5 languages. Fully offline.

CLI security scanner for self-hosted multi-tenant AI-agent platforms. 16 fail-closed OPA/Rego rules catch tenant-isolation defects (sandbox scoping, SSRF, cross-tenant cron/auth, secret leakage). SARIF and JSON output for CI.

🛡️ Unify Trivy, Semgrep, Poutine & Zizmor scans into one AI-enhanced, offline-ready dashboard. Track CI/CD security trends, get LLM-powered analysis, and enforce policies — the open-source DevSecOps command center.

jit is an open-source CLI that finds the plaintext secrets scattered across a Mac and converts them into just-in-time, Touch-ID-gated credentials, without breaking anything that reads them.

Supply-chain firewall for AI coding agents and developers — checks npm/PyPI packages against OSV advisories, typosquat & lifecycle-script heuristics, and your policy before install. Local-first, MCP-native.

local-first security analysis for TypeScript & JavaScript

AI Coding Gatekeeper — Zero-config, real-time guardrails for AI-generated code. 零配置AI编码守门员，实时拦截架构/安全/回归问题。

No repository description published.