nist — open-source software health

npm · PyPI

98Exceptionalhealth index

CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 200+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.

Python · Svelte★ 4,380Aug 28, 2026

Custom licenseAug 28, 2026 · metrics 2.10.0

npm

94Exceptionalhealth index

Hack23/cia-compliance-manager

The CIA Compliance Manager is an application that helps organizations assess and manage the availability, integrity, and confidentiality of their systems and data based on customizable security levels, providing real-time cost estimates, business impact assessments, and technical implementation details.

TypeScript · HTML★ 21↓ 3,500/moSep 10, 2026

Apache-2.0Sep 10, 2026 · metrics 2.10.0

PyPI

87Excellenthealth index

MolSSI/QCElemental

Periodic table, physical constants, and molecule parsing for quantum chemistry.

Python★ 201Sep 16, 2026

BSD-3-ClauseSep 16, 2026 · metrics 2.10.0

npm

81Excellenthealth index

MarkAC007/mcp-server-scf

MCP server for SCF Controls Platform — security compliance controls, frameworks, evidence, and risk management for AI agents

TypeScript★ 2↓ 3,180/moSep 13, 2026

MITSep 13, 2026 · metrics 2.10.0

npm

81Excellenthealth index

lua-ai-global/governance

Zero-dependency TypeScript SDK for AI agent governance: policy enforcement, injection detection, tamper-evident audit, and standards mapping (EU AI Act, OWASP, NIST, ISO 42001)

TypeScript★ 26↓ 18.7K/moSep 13, 2026

MITSep 13, 2026 · metrics 2.10.0

npm · Go

81Excellenthealth index

mitre/hdf-libs

Heimdall Data Format (HDF) is a standardized JSON schema for representing security assessment baselines and results across diverse tools and platforms.

Go · TypeScript★ 3↓ 6,373/moSep 5, 2026

Custom licenseSep 5, 2026 · metrics 2.10.0

npm

81Excellenthealth index

quantakrypto/pqc-tools

Open-source post-quantum readiness tooling by quantakrypto

TypeScript★ 11↓ 1,677/moSep 14, 2026

Apache-2.0Sep 14, 2026 · metrics 2.10.0

npm

81Excellenthealth index

willfarrell/sast-json-schema

Meta-schema for the Static Application Security Testing (SAST) of JSON Schemas

JavaScript★ 1↓ 6,592/moSep 20, 2026

MITSep 20, 2026 · metrics 2.10.0

crates.io

80Excellenthealth index

RustCrypto/elliptic-curves

Collection of pure Rust elliptic curve implementations: NIST P-224, P-256, P-384, P-521, secp256k1, SM2

Rust★ 879↓ 46.3M/moOct 20, 2026

No licenseOct 20, 2026 · metrics 2.10.0

npm

80Excellenthealth index

greenarmor/gesf

Compliance-as-Code framework that automatically enforces mostly all engineering standards.

TypeScript★ 36↓ 6,428/moSep 18, 2026

MITSep 18, 2026 · metrics 2.10.0

npm

77Goodhealth index

Null-Square/Null-CLi

Open-source AI pentest and compliance-readiness CLI by NullSquare.

TypeScript · JavaScript★ 57↓ 30/moSep 16, 2026

Custom licenseSep 16, 2026 · metrics 2.10.0

crates.io

77Goodhealth index

RustCrypto/signatures

Cryptographic signature algorithms: DSA, ECDSA, Ed25519

Rust★ 660↓ 58.5M/moSep 17, 2026

No licenseSep 17, 2026 · metrics 2.10.0

PyPI · crates.io

77Goodhealth index

joelee/fpr-ff1

Implementation of FF1, the format-preserving encryption mode from NIST SP 800-38G.

Python · Rust★ 1↓ 2,580/moOct 11, 2026

MITOct 11, 2026 · metrics 2.10.0

PyPI

77Goodhealth index

msaleme/red-team-blue-team-agent-fabric

AI agent security harness, adversarial testing: 623 executable tests in the v4.21.3 release, across MCP, A2A, x402/L402, decision governance, benchmark integrity, human-in-the-loop, skill supply chain. Four target shapes: a verdict must be able to be wrong AND to be right. OWASP Agentic v1.1 T1-T17, AIUC-1 19/20 (2026-Q1/Q2 set), NIST AI 800-2.

Python★ 30↓ 1,542/moSep 11, 2026

Apache-2.0Sep 11, 2026 · metrics 2.10.0

npm

71Goodhealth index

KnightsbridgeAIQ/kxco-pq-attest

ML-DSA-65 signed deploy attestations for the KXCO stack (NIST FIPS 204).

JavaScript★ 0↓ 1,306/moSep 18, 2026

Apache-2.0Sep 18, 2026 · metrics 2.10.0

crates.io · PyPI

71Goodhealth index

dp-web4/web4

Web4: an open standard for verifiable AI presence — LCT identity, T3/V3 trust tensors, MRH context, ATP/ADP. Rust + Python SDKs on crates.io/PyPI. AGPL-3.0-or-later.

Python★ 12↓ 70/moSep 19, 2026

AGPL-3.0Sep 19, 2026 · metrics 2.10.0

PyPI

69Goodhealth index

veldtlabs/veldt-kya

Runtime control, security, and governance for AI agents — decide what an agent may do at the moment it acts, revoke that authority instantly, and keep tamper-evident evidence of every decision.

Python★ 3↓ 5,683/moSep 8, 2026

Custom licenseSep 8, 2026 · metrics 2.10.0

npm

62Moderatehealth index

subodhkc/llmverify-npm

AI model health monitor for LLM apps – runtime checks for drift, hallucination risk, latency, and JSON/format quality on any OpenAI, Anthropic, or local client.

TypeScript · JavaScript★ 18↓ 23.2K/moSep 20, 2026

Custom licenseSep 20, 2026 · metrics 2.10.0

59Moderatehealth index

Deeptiman/forgelattice

An independent open-source research project on Lattice Cryptography and Post-Quantum Cryptography (PQC).

Go★ 2Sep 20, 2026

MITSep 20, 2026 · metrics 2.10.0

npm

53Moderatehealth index

iAMv1/omnisectester

Nation-state grade, defense-in-depth security testing framework. Tests web apps, extensions, desktop, mobile, cloud, AI/LLM, hardware, and supply chain from a single CLI.

JavaScript★ 0↓ 2,133/moSep 22, 2026

MITSep 22, 2026 · metrics 2.10.0

crates.io

51Moderatehealth index

jedisct1/rust-xoodyak

Xoodyak, a lightweight and versatile cryptographic scheme implemented in Rust.

Rust★ 30↓ 8,923/moSep 25, 2026

MITSep 25, 2026 · metrics 2.10.0

NuGet

51Moderatehealth index

prjseal/PasswordGenerator

A library which generates random passwords with different settings to meet the OWASP requirements

C#★ 187Sep 11, 2026

MITSep 11, 2026 · metrics 2.10.0

Packagist

42Weakhealth index

langleyfoxall/laravel-nist-password-rules

🔒 Laravel validation rules that follow the password related recommendations found in NIST Special Publication 800-63B section 5.

PHP★ 211↓ 4,501/moSep 16, 2026

LGPL-3.0Sep 16, 2026 · metrics 2.10.0

crates.io

34At Riskhealth index

RustCrypto/KDFs

Collection of Key Derivation Functions written in pure Rust

Rust★ 106↓ 23.8M/moSep 17, 2026

No licenseSep 17, 2026 · metrics 2.10.0

Packagist

34At Riskhealth index

spiral/security

[READ ONLY] RBAC security layer based on NIST definition, role/rule/permission associations, bulletproof. Subtree split of the Spiral Security component (see spiral/framework)

PHP★ 6↓ 698.3K/moOct 20, 2026

MITOct 20, 2026 · metrics 2.10.0

—

33At Riskhealth index

PxG-Studio/Lapaki

🏥 Audit-ready healthcare data architecture framework — HIPAA, COBIT 2019, NIST SP 800-53, ISO 27001. Generic, PHI-free, shareable. 10/10 compliance score.

HTML · Python★ 0Sep 16, 2026

Custom licenseSep 16, 2026 · metrics 2.10.0

PyPI

27At Riskhealth index