Go
anchore/syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache-2.0Aug 28, 2026 · metrics 2.10.0
All tags
Catalogue tag
#sbom
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
61 records
Go
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
Apache-2.0Jul 16, 2026 · metrics 2.10.0
Go · npm
zarf-dev/zarf
The Airgap Native Package Manager for Kubernetes
Apache-2.0Jul 22, 2026 · metrics 2.10.0
PyPI
CycloneDX/cyclonedx-python
CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments
Apache-2.0Aug 27, 2026 · metrics 2.10.0
Go
kubernetes-sigs/tejolote
A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.
Apache-2.0Jul 24, 2026 · metrics 2.10.0
PyPI · npm
msaad00/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.0Jul 16, 2026 · metrics 2.10.0
Maven · npm
oss-review-toolkit/ort
A suite of tools to automate software compliance checks.
Apache-2.0Jul 17, 2026 · metrics 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.0Jul 28, 2026 · metrics 2.10.0
—
microsoft/component-detection
Scans your project to determine what components you use
MITJul 18, 2026 · metrics 2.10.0
Packagist
CycloneDX/cyclonedx-php-composer
Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects
Apache-2.0Jul 29, 2026 · metrics 2.10.0
PyPI
CycloneDX/cyclonedx-python-lib
Functionality and DataModels of OWASP CycloneDX for Python
Apache-2.0Jul 17, 2026 · metrics 2.10.0
PyPI · npm
NuGuardAI/nuguard
opensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis
Custom licenseJul 18, 2026 · metrics 2.10.0
PyPI
fsfe/reuse-tool
This is a mirror of https://codeberg.org/fsfe/reuse-tool
Custom licenseJul 21, 2026 · metrics 2.10.0
npm
janbiasi/rollup-plugin-sbom
Create SBOMs in CycloneDX format for your Vite, Rollup or Rolldown projects with ease
MITJul 17, 2026 · metrics 2.10.0
PyPI
kdeldycke/meta-package-manager
🎁 wraps all package managers with a unifying CLI
GPL-2.0Jul 20, 2026 · metrics 2.10.0
Go · npm
seebom-labs/BOMHort
About standalone, Kubernetes-native Software Bill of Materials (SBOM) visualization and governance platform
Apache-2.0Jul 29, 2026 · metrics 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MITSep 6, 2026 · metrics 2.10.0
PyPI
jimmy058910/jmo-security-repo
JMo Security Suite - Terminal-first security audit toolkit with many tools, multi-target scanning, & compliance
Custom licenseJul 31, 2026 · metrics 2.10.0
Go
Nox-HQ/nox
Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.
Apache-2.0Jul 24, 2026 · metrics 2.10.0
PyPI
aboutcode-org/scancode-toolkit
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!
Custom licenseJul 21, 2026 · metrics 2.10.0
Go · PyPI
bomly-dev/bomly-cli
Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
Apache-2.0Jul 17, 2026 · metrics 2.10.0
Maven · npm
eclipse-apoapsis/ort-server
A scalable server implementation of the OSS Review Toolkit.
Apache-2.0Jul 15, 2026 · metrics 2.10.0
crates.io
rust-secure-code/cargo-auditable
Make production Rust binaries auditable
Apache-2.0Sep 5, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-node-module
creates CycloneDX Software-Bill-of-Materials (SBOM) from Node.js-based projects
Apache-2.0Sep 5, 2026 · metrics 2.10.0
PyPI · npm
lgtm-hq/py-lintro
Making linters play nice... Mostly.
MITJul 17, 2026 · metrics 2.10.0
PyPI · npm
owasp-dep-scan/dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
MITAug 24, 2026 · metrics 2.10.0
PyPI
squid-protocol/gitgalaxy
Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.
Custom licenseAug 22, 2026 · metrics 2.10.0
Go · npm
CodesWhat/portwing
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
AGPL-3.0Aug 15, 2026 · metrics 2.10.0
—
CycloneDX/cyclonedx-cli
CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.
Apache-2.0Aug 21, 2026 · metrics 2.10.0
NuGet
CycloneDX/cyclonedx-dotnet-library
.NET library to consume and produce CycloneDX Software Bill of Materials (SBOM)
Apache-2.0Jul 22, 2026 · metrics 2.10.0