Maven
CycloneDX/cyclonedx-maven-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
Apache-2.0Jul 30, 2026 · metrics 2.10.0
All tags
Catalogue tag
#sbom
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
61 records
Hex
erlef/mix_sbom
Mix task to generate a Software Bill-of-Materials (SBoM) in CycloneDX format
Custom licenseJul 17, 2026 · metrics 2.10.0
Go
liatrio/autogov
Unified CLI for software supply-chain governance / verify GitHub artifact attestations, evaluate OPA/Rego policies, generate SLSA Verification Summary Attestations (VSAs), and manage releases.
Apache-2.0Aug 1, 2026 · metrics 2.10.0
—
microsoft/sbom-tool
The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.
MITJul 17, 2026 · metrics 2.10.0
Go
CycloneDX/sbom-utility
Utility that provides an API platform for validating, querying and managing BOM data
Apache-2.0Sep 3, 2026 · metrics 2.10.0
Go
airomhq/airom
Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.
Apache-2.0Jul 23, 2026 · metrics 2.10.0
crates.io
guacsec/trustify
SBOM analysis platform for storing, correlating, and querying software bill of materials and security advisories (CSAF/VEX, OSV, CVE) at scale.
Apache-2.0Jul 17, 2026 · metrics 2.10.0
NuGet
package-url/packageurl-dotnet
.NET parser for Package URLs (ECMA-427)
MITJul 18, 2026 · metrics 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MITAug 3, 2026 · metrics 2.10.0
npm
quantakrypto/pqc-tools
Open-source post-quantum readiness tooling by quantakrypto
Apache-2.0Jul 27, 2026 · metrics 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.0Jul 17, 2026 · metrics 2.10.0
Go
rezmoss/sbomlyze
git diff for your SBOM ,compare CycloneDX/SPDX/Syft bills of materials, detect tampering, and gate CI
Apache-2.0Jul 20, 2026 · metrics 2.10.0
—
voltone/rebar3_sbom
Rebar3 plugin to generate CycloneDX SBoM
Custom licenseJul 17, 2026 · metrics 2.10.0
Go · npm · PyPI
KKloudTarus/synapse-ce
Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.
Apache-2.0Aug 6, 2026 · metrics 2.10.0
Go
TomTonic/extract-sbom
Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.
BSD-3-ClauseJul 21, 2026 · metrics 2.10.0
PyPI
espressif/esp-idf-sbom
ESP-IDF Software Bill of Materials Generation Tool
Apache-2.0Jul 28, 2026 · metrics 2.10.0
PyPI · npm
aiexponenthq/license-compliance-checker
License Compliance Checker — Multi-ecosystem license + AI model scanner for EU AI Act Article 53 GPAI compliance. SBOM, SARIF, training-data risk. Apache 2.0.
Apache-2.0Jul 27, 2026 · metrics 2.10.0
Go
Vulnetix/cli
Automate vulnerability triage which prioritizes remediation over discovery
Custom licenseSep 5, 2026 · metrics 2.10.0
Maven
MediaMarktSaturn/technolinator
GitHub app for SBOM creation using cdxgen and upload to Dependency-Track
Apache-2.0Jul 27, 2026 · metrics 2.10.0
Go · npm
codeswhat/lookout
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
Custom licenseJul 16, 2026 · metrics 2.10.0
Go
eitanity/kanonarion
Dependency assurance software for Go. A deterministic, local source of truth about your dependencies - what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON.
Apache-2.0Jul 19, 2026 · metrics 2.10.0
Go
matteo-sung/lockvet
Explain any lockfile change: bumps release-verified against 22 registries, vulns (OSV), ages, deprecations, typosquats, integrity tampering — 61 formats incl. pdm.lock, vcpkg, mise.lock, build.gradle, pom.xml, go.sum, GitHub Actions, GitLab CI, Dockerfiles, Kubernetes, Helm, SBOMs. CLI + CI gate + MCP server + playground. By an AI agent.
MITAug 23, 2026 · metrics 2.10.0
crates.io
sebastienrousseau/dtt
Rust crate for date, time, and timezone manipulation. Parse, format, validate, and convert RFC 3339 / ISO 8601 with guaranteed round-trip safety.
Apache-2.0Jul 25, 2026 · metrics 2.10.0
Go
famclaw/honeybadger
Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.
MITJul 17, 2026 · metrics 2.10.0
Go
kidoz/go-vulners
Go client library for the Vulners vulnerability database API — search, audit, SBOM, VScanner, and more
MITAug 22, 2026 · metrics 2.10.0
Go
olelbis/pswg
Small Go password generator CLI with shell-safe mode and signed release artifacts
MITJul 26, 2026 · metrics 2.10.0
Go
kidoz/vulners-cli
CLI vulnerability scanner powered by Vulners — search, audit, scan, offline mode
MITJul 17, 2026 · metrics 2.10.0
Go
gitsocial-org/gitsocial
Cross-forge collaboration platform
MITSep 5, 2026 · metrics 2.10.0
PyPI
meidielo/aes-256-gcm-python-tool
Reviewable AES-256-GCM educational tool with Argon2id, JSON envelopes, and safe-mode streaming.
MITJul 19, 2026 · metrics 2.10.0
npm
absolutejs/vulnerabilities
No repository description published.
Custom licenseAug 5, 2026 · metrics 2.10.0