Go · npm
CycloneDX/sbom-utility
Utility that provides an API platform for validating, querying and managing BOM data
Apache-2.0Oct 21, 2026 · metrics 2.10.0
All tags
Catalogue tag
#sbom
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
97 records
Maven
MediaMarktSaturn/technolinator
GitHub app for SBOM creation using cdxgen and upload to Dependency-Track
Apache-2.0Sep 14, 2026 · metrics 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MITSep 16, 2026 · metrics 2.10.0
npm
CycloneDX/cyclonedx-node-module
creates CycloneDX Software-Bill-of-Materials (SBOM) from Node.js-based projects
Apache-2.0Oct 21, 2026 · metrics 2.10.0
PyPI
espressif/esp-idf-sbom
ESP-IDF Software Bill of Materials Generation Tool
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
git-pkgs/pin
Browser asset vendoring without npm.
MITSep 19, 2026 · metrics 2.10.0
Go
jrjsmrtn/ansible-bom
Inventory installed Ansible content — collections and roles — and emit a lockfile, drift report, and CycloneDX BOM
Apache-2.0Sep 24, 2026 · metrics 2.10.0
Go
Vulnetix/cli
Automate vulnerability triage which prioritizes remediation over discovery
Custom licenseOct 21, 2026 · metrics 2.10.0
PyPI
bact/licenseid
A Python CLI and library to get the SPDX License ID from license text
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go
TomTonic/extract-sbom
Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.
BSD-3-ClauseSep 12, 2026 · metrics 2.10.0
crates.io
scm-rs/csaf-walker
A library and CLI to work with CSAF and SBOM data
Apache-2.0Sep 18, 2026 · metrics 2.10.0
Go
eitanity/kanonarion
Dependency assurance software for Go. A deterministic, local source of truth about your dependencies - what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
npm · PyPI
aiexponent/license-compliance-checker
License Compliance Checker — Multi-ecosystem license + AI model scanner for EU AI Act Article 53 GPAI compliance. SBOM, SARIF, training-data risk. Apache 2.0.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
blairham/stevedore
Release Docker/OCI images the way GoReleaser releases binaries — build, scan, sign, SBOM, provenance, per-image versioning, and monorepo change detection.
MITSep 10, 2026 · metrics 2.10.0
Go
csnp/cryptodeps
Cryptographic Dependency Scanner - Identify quantum-vulnerable cryptographic algorithms in your software dependencies. Part of the QRAMM Toolkit.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
crates.io
sebastienrousseau/dtt
Rust crate for date, time, and timezone manipulation. Parse, format, validate, and convert RFC 3339 / ISO 8601 with guaranteed round-trip safety.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
matteo-sung/lockvet
Explain any lockfile change: bumps release-verified against 22 registries, vulns (OSV), ages, deprecations, typosquats, integrity tampering — 61 formats incl. pdm.lock, vcpkg, mise.lock, build.gradle, pom.xml, go.sum, GitHub Actions, GitLab CI, Dockerfiles, Kubernetes, Helm, SBOMs. CLI + CI gate + MCP server + playground. By an AI agent.
MITAug 23, 2026 · metrics 2.10.0
npm
cdxgen/cdxgen-plugins-bin
Binary plugins for @cyclonedx/cdxgen npm package
MITSep 19, 2026 · metrics 2.10.0
PyPI
i-ops-hq/assurance
Point it at a folder and find out what is missing, and what silently changed. Coverage over dated or numbered series, plus a baseline anyone can keep. No model decides any of it.
Apache-2.0Sep 18, 2026 · metrics 2.10.0
PyPI
Innomatica-GmbH/embtrace-sbom
Open-source SBOM generator for embedded builds — CMake, Yocto, Buildroot, Zephyr. GPL, fully local by default. Optional: free EU CRA readiness report.
GPL-3.0Sep 18, 2026 · metrics 2.10.0
Go
famclaw/honeybadger
Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.
MITSep 9, 2026 · metrics 2.10.0
npm
cdxgen/cdx-proto
Runtime library to serialize/deserialize CycloneDX BOM with protocol buffers
MITSep 15, 2026 · metrics 2.10.0
NuGet
patriksvensson/covenant
A tool to generate SBOM (Software Bill of Material) from source code artifacts.
MITSep 15, 2026 · metrics 2.10.0
Go
kidoz/go-vulners
Go client library for the Vulners vulnerability database API — search, audit, SBOM, VScanner, and more
MITOct 20, 2026 · metrics 2.10.0
Go
gitsocial-org/gitsocial
Git-native collaboration platform
MITOct 21, 2026 · metrics 2.10.0
PyPI · npm
DevInder1/supply-chain-scanner-public
Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.
MITSep 30, 2026 · metrics 2.10.0
PyPI · npm · crates.io
JunHwan-Kwon/deepbom
Local static analysis and evidence generation for deployed AI model artifacts
Apache-2.0Oct 21, 2026 · metrics 2.10.0
PyPI
PramanKasliwal/MaunPrekshak
The Silent Observer — Fast, local-first security scanner for dependencies (SCA), exposed secrets & git history, SAST, Dockerfiles, and GitHub Actions with multi-provider AI remediation.
Apache-2.0Oct 12, 2026 · metrics 2.10.0
Go
olelbis/pswg
Small Go password generator CLI with shell-safe mode and signed release artifacts
MITSep 13, 2026 · metrics 2.10.0
Go
kidoz/vulners-cli
CLI vulnerability scanner powered by Vulners — search, audit, scan, offline mode
MITSep 9, 2026 · metrics 2.10.0