Go
sigstore/sigstore
Common go library shared across sigstore services and clients
Apache-2.0Aug 29, 2026 · metrics 2.10.0
All tags
Catalogue tag
#supply-chain
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
37 records
Go · npm
mindersec/minder
Software Supply Chain Security Platform
Apache-2.0Jul 20, 2026 · metrics 2.10.0
PyPI
sigstore/sigstore-python
A Sigstore client written in Python
Custom licenseAug 11, 2026 · metrics 2.10.0
Go
Sigstore/rekor
Software Supply Chain Transparency Log
Apache-2.0Jul 18, 2026 · metrics 2.10.0
PyPI
pypa/pip-audit
Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
Apache-2.0Aug 27, 2026 · metrics 2.10.0
PyPI · npm
msaad00/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.0Jul 16, 2026 · metrics 2.10.0
npm
sigstore/sigstore-js
Code-signing for npm packages
Apache-2.0Aug 31, 2026 · metrics 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.0Jul 28, 2026 · metrics 2.10.0
Go
carabiner-dev/ampel
🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)
Apache-2.0Jul 21, 2026 · metrics 2.10.0
Go · npm
seebom-labs/BOMHort
About standalone, Kubernetes-native Software Bill of Materials (SBOM) visualization and governance platform
Apache-2.0Jul 29, 2026 · metrics 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MITSep 6, 2026 · metrics 2.10.0
npm
blamejs/blamejs
The Node framework that owns its stack.
Apache-2.0Aug 22, 2026 · metrics 2.10.0
Go · npm
emoss08/Trenova
An AI-driven asset based Transportation Management System
Custom licenseAug 3, 2026 · metrics 2.10.0
crates.io
rust-secure-code/cargo-auditable
Make production Rust binaries auditable
Apache-2.0Sep 5, 2026 · metrics 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.0Aug 22, 2026 · metrics 2.10.0
npm
blamejs/pki
Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.
Apache-2.0Jul 23, 2026 · metrics 2.10.0
PyPI · npm
PrismorSec/prismor
Runtime Firewall for AI agents which catches the rogue tool call before it runs. Dangerous commands, secret leaks, prompt injection. For Claude Code, Codex and framework SDKs
Apache-2.0Jul 19, 2026 · metrics 2.10.0
PyPI
Ndevu12/stayAwakeBot
A bot for helping you to stay secure and making free hosted services stay a wake
AGPL-3.0Jul 31, 2026 · metrics 2.10.0
npm
abpai/harness-doctor
Framework-agnostic agent-harness doctor: deterministic checks for good agent-harness practices
MITJul 23, 2026 · metrics 2.10.0
Packagist
dgtlss/warden
A Laravel package that proactively monitors your dependencies for security vulnerabilities by running automated composer audits and sending notifications via webhooks and email
MITSep 5, 2026 · metrics 2.10.0
npm
dot-skill/skillerr
Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.
Apache-2.0Jul 27, 2026 · metrics 2.10.0
Go
eitanity/kanonarion
Dependency assurance software for Go. A deterministic, local source of truth about your dependencies - what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON.
Apache-2.0Jul 19, 2026 · metrics 2.10.0
Go
matteo-sung/lockvet
Explain any lockfile change: bumps release-verified against 22 registries, vulns (OSV), ages, deprecations, typosquats, integrity tampering — 61 formats incl. pdm.lock, vcpkg, mise.lock, build.gradle, pom.xml, go.sum, GitHub Actions, GitLab CI, Dockerfiles, Kubernetes, Helm, SBOMs. CLI + CI gate + MCP server + playground. By an AI agent.
MITAug 23, 2026 · metrics 2.10.0
npm · PyPI
HikaruEgashira/pmsec
Zero-config supply-chain hardening.
MITJul 15, 2026 · metrics 2.10.0
Go · npm
cjohnstoniv/wardyn
Open-source governance control plane for coding agents — per-run identity, brokered credentials, layered egress, approvals, and an append-only audit. Apache-2.0, self-hosted.
Apache-2.0Jul 27, 2026 · metrics 2.10.0
Go · npm
daimoniac/suppline
Self-hosted Kubernetes image intake gateway: mirror → Trivy scan → CEL policy → Sigstore attestations. Admit only what passed.
Apache-2.0Jul 30, 2026 · metrics 2.10.0
PyPI
YugantM/hvtracker
AI Agent Trust Registry — independent, evidence-based trust scores for 300+ open-source AI agents. Runtime-trust calibrated (MCP, dependencies, provenance drift), with side-by-side comparison and embeddable live badges. Ranked by verifiable signals, not hype.
MITJul 26, 2026 · metrics 2.10.0
crates.io
cackle-rs/cackle
A code ACL checker for Rust
Custom licenseAug 16, 2026 · metrics 2.10.0
npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.0Jul 31, 2026 · metrics 2.10.0
npm
extensiondev/artifact-integrity
Trust what you ship: download and verify browser extension artifacts (zip structure, manifest, metadata) and emit a deterministic JSON report for CI release gates.
Apache-2.0Jul 25, 2026 · metrics 2.10.0