npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.0Jul 31, 2026 · metrics 2.10.0
All tags
Catalogue tag
#sarif
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
47 records
Go
rudrendupaul/tenantguard
CLI security scanner for self-hosted multi-tenant AI-agent platforms. 16 fail-closed OPA/Rego rules catch tenant-isolation defects (sandbox scoping, SSRF, cross-tenant cron/auth, secret leakage). SARIF and JSON output for CI.
Apache-2.0Jul 15, 2026 · metrics 2.10.0
Go
skyway-harness-builder/workflow-lint
Standalone open-source linter for Skylence .sky workflow files
Apache-2.0Jul 21, 2026 · metrics 2.10.0
Go
kidoz/vulners-cli
CLI vulnerability scanner powered by Vulners — search, audit, scan, offline mode
MITJul 17, 2026 · metrics 2.10.0
PyPI · crates.io · Maven +2
mattybellx/ansede
Find authorization bugs before attackers do. Free SAST — IDOR detection, 100% CVE recall, 0% false positives. 5 languages. Fully offline.
Custom licenseJul 17, 2026 · metrics 2.10.0
crates.io
tacticaldoll/tianheng
Reactive architectural governance for Rust — declare boundaries in Rust, react to drift in CI and at runtime. The 三儀: 圭表 (static) · 渾儀 (semantic) · 漏刻 (runtime). Govern by reaction, not instruction. On crates.io as the tianheng family.
Apache-2.0Jul 29, 2026 · metrics 2.10.0
PyPI · npm · crates.io
JunHwan-Kwon/deepbom
Local static analysis and evidence generation for deployed AI model artifacts
Apache-2.0Sep 4, 2026 · metrics 2.10.0
npm
nsasoft/nsauditor-ai
NSAuditor AI — Open-source, AI-powered network security scanner. 27 plugins, CVE matching, MITRE ATT&CK mapping, verified vulnerabilities, continuous monitoring, MCP integration. Zero data exfiltration. MIT licensed.
MITSep 6, 2026 · metrics 2.10.0
Go
bunta-expert/git-path-audit
Read-only CLI that finds Git paths that collide, change meaning, or fail to check out across Windows, macOS, and Linux.
MITSep 5, 2026 · metrics 2.10.0
Packagist
phpcpd-next/phpcpd
phpcpd-next is a token-based copy/paste (clone) detector for PHP 8.5+, a modernized, openly-licensed successor to Sebastian Bergmann's phpcpd
BSD-3-ClauseAug 18, 2026 · metrics 2.10.0
npm
BenAHammond/code-auditor-mcp
Architectural invariants and code quality analysis, enforced inside your AI agent's edit loop. MCP server + CLI + Claude Code plugin. TypeScript, JavaScript, Go.
MITJul 26, 2026 · metrics 2.10.0
npm
criticaldeveloper/critical-gate
No repository description published.
MITJul 16, 2026 · metrics 2.10.0
Packagist
jbelien/phpstan-sarif-formatter
SARIF formatter for PHPStan
MITJul 29, 2026 · metrics 2.10.0
Go
safetylab/ShadowSecurityScanner
Free, open-source network vulnerability scanner & penetration testing tool that ranks findings by real-world exploitability (EPSS + CISA KEV). Single desktop app for Windows, macOS, Linux. No cloud, no telemetry. MIT.
MITJul 21, 2026 · metrics 2.10.0
npm
nsasoft/nsauditor-ai-agent-skill
AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows. Works with Claude Code, Cursor, Windsurf, and any MCP-aware agent.
MITSep 6, 2026 · metrics 2.10.0
npm
KaraboGerald/SeamShieldCLI
SeamShield Community CLI: local-first access-lane scanning for AI-built apps
MITAug 4, 2026 · metrics 2.10.0
Go
tamish560/mcprobe
Security scanner and introspection tool for MCP servers. Connect, inspect, detect injection patterns, find tool shadowing, baseline for drift. Single binary, zero dependencies, Go stdlib only.
MITJul 20, 2026 · metrics 2.10.0