PyPI · npm
msaad00/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.0Jul 16, 2026 · metrics 2.10.0
All tags
Catalogue tag
#sarif
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
47 records
PyPI · npm
sattyamjjain/agent-audit-kit
Static scanner for MCP-connected AI agent pipelines — 271 rules across 12 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.
MITAug 2, 2026 · metrics 2.10.0
npm
Siteimprove/alfa
:wheelchair: Suite of open and standards-based tools for performing reliable accessibility conformance testing at scale
MITJul 31, 2026 · metrics 2.10.0
PyPI
Cranot/roam-code
Local codebase intelligence CLI + MCP server for AI coding agents: SQLite code graph, 28 languages, 238 commands, 224 MCP tools, change-safety gates, audit evidence, zero API keys.
Apache-2.0Jul 15, 2026 · metrics 2.10.0
Go
Nox-HQ/nox
Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.
Apache-2.0Jul 24, 2026 · metrics 2.10.0
Go · PyPI
bomly-dev/bomly-cli
Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
Apache-2.0Jul 17, 2026 · metrics 2.10.0
npm
microsoft/axe-sarif-converter
An axe-core reporter that outputs axe scan results in SARIF format (http://sarifweb.azurewebsites.net/)
MITJul 21, 2026 · metrics 2.10.0
npm
ofri-peretz/eslint
Security & code-quality ESLint plugins — 350+ CWE-mapped rules across 18 domains, ESLint + Oxlint. The lint layer AI-generated code needs.
MITJul 25, 2026 · metrics 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.0Aug 22, 2026 · metrics 2.10.0
PyPI
squid-protocol/gitgalaxy
Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.
Custom licenseAug 22, 2026 · metrics 2.10.0
Go
airomhq/airom
Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.
Apache-2.0Jul 23, 2026 · metrics 2.10.0
npm · crates.io
0sec-labs/foxguard
A fast universal code security scanner, written in Rust. Batteries included: supports 12 languages, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥
MITJul 17, 2026 · metrics 2.10.0
npm
Null-Square/Null-CLi
Open-source AI pentest and compliance-readiness CLI by NullSquare.
Custom licenseAug 4, 2026 · metrics 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.0Jul 17, 2026 · metrics 2.10.0
PyPI
justinchuby/lintrunner-adapters
Adapters and tools for lintrunner
Custom licenseJul 21, 2026 · metrics 2.10.0
Go
draugr-dev/draugr
Developer-first security scanning orchestration — describe your app in one file, run many scanners (SAST, SCA, secrets, IaC, containers, headers), get one SARIF verdict for CI & code scanning.
Apache-2.0Jul 19, 2026 · metrics 2.10.0
npm · PyPI
raccioly/docguard
The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. Zero dependencies.
MITJul 21, 2026 · metrics 2.10.0
npm · Go
HodeTech/Leakwatch
High-performance open-source secret scanner — detect, verify & report leaked API keys, tokens & credentials in code, Git history, container images, and the cloud.
MITJul 27, 2026 · metrics 2.10.0
npm · PyPI
oaslananka/boardreadyops
End-to-end hardware release pipeline for KiCad: generate, validate, sign, and package manufacturer-ready releases as a CLI and GitHub Action.
MITJul 17, 2026 · metrics 2.10.0
npm
stainless-code/codemap
Cut AI-agent token waste ~90% — query a local SQLite structural index of your JS/TS/CSS codebase with SQL in one round-trip instead of 3–5 file reads. Symbols, imports, calls, components, CSS tokens, coverage, markers. CLI, MCP (21 tools), HTTP, GitHub Action, ESM API. 71 recipes; AST+resolver; SARIF/audit/baselines for CI.
MITJul 26, 2026 · metrics 2.10.0
Go
Vulnetix/cli
Automate vulnerability triage which prioritizes remediation over discovery
Custom licenseSep 5, 2026 · metrics 2.10.0
npm
YawLabs/ctxlint
Lint your AI agent context files (CLAUDE.md, AGENTS.md, etc.) against your actual codebase
MITAug 6, 2026 · metrics 2.10.0
npm
goklab/guardvibe
Security infrastructure your AI can't be — deterministic, daily CVE intel past your model's training cutoff, whole-repo-aware, author-independent, and shift-left: secure_prompt secures the prompt before code generation. The security MCP for vibe coding: 450 rules, 39 tools, CLI + doctor for Next.js, Supabase, Clerk, Stripe, Prisma, Hono & MCP.
Apache-2.0Jul 17, 2026 · metrics 2.10.0
PyPI
raccioly/websec-validator
Local-first security recon that briefs your AI coding agent: facts + tailored probes, code-in / artifacts-out. No LLM, no server, no running app.
MITJul 31, 2026 · metrics 2.10.0
Go
tiagosilva07/zyrax-guard
Audit your AI agent configs before you run them — prompt injection, rogue MCP servers, credential-exfil. Plus dependency vetting.
MITAug 28, 2026 · metrics 2.10.0
Packagist · npm
blundergoat/gruff-php
Opinionated PHP code-quality analyzer that scores findings across quality pillars and emits reports for terminals, CI, SARIF, HTML, and a local dashboard.
MITJul 16, 2026 · metrics 2.10.0
Go · npm
LarsArtmann/art-dupl
Professional code clone detection for Go. AST-based structural + semantic detection with suffix tree algorithms, 3 matching modes, 7 output formats, templ support, and CI baseline gating.
Custom licenseAug 31, 2026 · metrics 2.10.0
Go
git-pkgs/sarif
Go library for reading, writing, and validating SARIF 2.1.0 logs
MITJul 15, 2026 · metrics 2.10.0
Go
icearp/disco-cli
Discover, map & secure AWS, Azure, & GCP. Scan resources and their relationships into a local inventory, visualize the graph, and run OPA policy checks with SARIF output.
MITAug 30, 2026 · metrics 2.10.0
Go
kanywst/brtc
Cost calculator for offline password brute-force attacks: time + USD per GPU profile, with a CI gatekeeper.
MITJul 26, 2026 · metrics 2.10.0