PyPI
CycloneDX/cyclonedx-python-lib
Functionality and DataModels of OWASP CycloneDX for Python
Apache-2.0Sep 9, 2026 · metrics 2.10.0
All tags
Catalogue tag
#sca
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
28 records
PyPI
SocketDev/socket-python-cli
Socket Python CLI to use in integrations
MITSep 12, 2026 · metrics 2.10.0
Maven · npm
oss-review-toolkit/ort
A suite of tools to automate software compliance checks.
Apache-2.0Sep 9, 2026 · metrics 2.10.0
npm
RetireJS/retire.js
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
Apache-2.0Sep 21, 2026 · metrics 2.10.0
npm
OWASP/cve-lite-cli
Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.
MITSep 9, 2026 · metrics 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.0Sep 14, 2026 · metrics 2.10.0
PyPI
cycodehq/cycode-cli
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning
MITSep 14, 2026 · metrics 2.10.0
Maven · npm
eclipse-apoapsis/ort-server
A scalable server implementation of the OSS Review Toolkit.
Apache-2.0Sep 8, 2026 · metrics 2.10.0
RubyGems
pay-rails/pay
Payments for Ruby on Rails apps
MITSep 14, 2026 · metrics 2.10.0
PyPI
SocketDev/socket-sdk-python
Python SDK for the Socket API
MITSep 15, 2026 · metrics 2.10.0
PyPI
aboutcode-org/scancode-toolkit
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!
Custom licenseSep 12, 2026 · metrics 2.10.0
npm · Go · PyPI
bomly-dev/bomly-cli
Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
PyPI · npm
owasp-dep-scan/dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
MITSep 18, 2026 · metrics 2.10.0
Go · npm · PyPI
KKloudTarus/synapse-ce
Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
NuGet
package-url/packageurl-dotnet
.NET parser for Package URLs (ECMA-427)
MITSep 11, 2026 · metrics 2.10.0
Packagist
Sylius/StripePlugin
Sylius ^2.0 plugin to support Stripe Checkout and Stripe Web Elements
MITOct 21, 2026 · metrics 2.10.0
Go
draugr-dev/draugr
Run Trivy, Semgrep, Gitleaks and more from one file. Consolidates SAST, SCA, secrets, IaC and container findings into one SARIF report and one pass/fail gate for CI — ranked by real risk, and can fail a PR on new findings only.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
npm
patchstack/connect
Patchstack connector for JavaScript applications. Scans your lockfile and reports installed packages to Patchstack for vulnerability monitoring.
MITSep 12, 2026 · metrics 2.10.0
PyPI
marshallguillory86/secure-code-agent
Deterministic security gate + bounded AI remediation prompts. NIST SSDF / OWASP ASVS / CWE Top 25 anchored. The security sibling to maintainability-agent.
MITOct 5, 2026 · metrics 2.10.0
Packagist
Sylius/PayumStripePlugin
Sylius Payum Stripe gateway plugin (with SCA support)
MITOct 21, 2026 · metrics 2.10.0
Go
Vulnetix/cli
Automate vulnerability triage which prioritizes remediation over discovery
Custom licenseOct 21, 2026 · metrics 2.10.0
PyPI
toniantunovi/lucidshark
Ship AI-generated code without the fear
Apache-2.0Sep 19, 2026 · metrics 2.10.0
npm
KirtashDev/dephawk
🦅 Catch npm dependencies red-handed at runtime — see & block when one reads your SSH keys, steals secrets, or phones home.
MITSep 18, 2026 · metrics 2.10.0
Go · npm
scagogogo/cwe-skills
AI-native CWE (Common Weakness Enumeration) integration layer — Skills, Go SDK, CLI & MCP. Ship CVE/CWE tooling to SAST/DAST, vuln-management & AI agents.
MITSep 11, 2026 · metrics 2.10.0
—
tonycknight/pkgchk-cli
A dotnet tool for package dependency checks.
MITSep 15, 2026 · metrics 2.10.0
PyPI
PramanKasliwal/MaunPrekshak
The Silent Observer — Fast, local-first security scanner for dependencies (SCA), exposed secrets & git history, SAST, Dockerfiles, and GitHub Actions with multi-provider AI remediation.
Apache-2.0Oct 12, 2026 · metrics 2.10.0
npm
iAMv1/omnisectester
Nation-state grade, defense-in-depth security testing framework. Tests web apps, extensions, desktop, mobile, cloud, AI/LLM, hardware, and supply chain from a single CLI.
MITSep 22, 2026 · metrics 2.10.0
npm
CycloneDX/cdxgen-action
GitHub action for CycloneDX BOM generator (cdxgen). cdxgen produced bom xml file can be uploaded to dependency track, AppThreat and other commercial Software Composition Analysis (SCA) products
MITSep 13, 2026 · metrics 2.10.0