Go
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
Apache-2.0Sep 9, 2026 · metrics 2.10.0
All tags
Catalogue tag
#supply-chain-security
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
88 records
Go
step-security/dev-machine-guard
Scan your dev machine for AI agents, MCP servers, IDE extensions, and suspicious packages - in seconds.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
npm
NodeSecure/js-x-ray
JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.
MITSep 16, 2026 · metrics 2.10.0
Go
guacsec/guac
GUAC aggregates software security metadata into a high fidelity graph database.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go · npm
safedep/vet
Protect against malicious open source packages 🤖
Apache-2.0Sep 19, 2026 · metrics 2.10.0
npm · PyPI
NVIDIA/SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
PyPI · npm
koda-ai-studio/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.0Oct 16, 2026 · metrics 2.10.0
PyPI · npm
msaad00/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.0Sep 8, 2026 · metrics 2.10.0
crates.io
nolabs-ai/nono
secure multiplexed execution paths for agents - zero trust, zero setup, zero latency.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
Go · PyPI
oracle/macaron
Macaron is an extensible supply-chain security analysis framework from Oracle Labs that supports a wide range of build systems and CI/CD services. It can be used to prevent supply chain attacks, detect malicious Python packages, or check conformance to frameworks, such as SLSA. Documentation:
UPL-1.0Sep 18, 2026 · metrics 2.10.0
PyPI · crates.io
duriantaco/skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI · crates.io · npm
hashgraph-online/hol-guard
Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.
Apache-2.0Sep 5, 2026 · metrics 2.10.0
npm · Go · PyPI
sebastienrousseau/dotfiles
Cross-platform developer workstation control plane powered by chezmoi — adaptive terminal themes, AI CLI workflows, read-only MCP, WASM attestations, encrypted secrets, and SLSA-verified releases.
Apache-2.0Sep 29, 2026 · metrics 2.10.0
Go · npm
safedep/pmg
PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
PyPI
spdx/ntia-conformance-checker
Validate SPDX 2 and 3 SBOM against NTIA, CISA, and other minimum element requirements.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
PyPI · npm
sattyamjjain/agent-audit-kit
Static scanner for MCP-connected AI agent pipelines. 348 rules across 14 categories, 14 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
Go
carabiner-dev/ampel
🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)
Apache-2.0Sep 12, 2026 · metrics 2.10.0
npm
lirantal/npq
safely install npm packages by auditing them pre-install stage
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Go · PyPI
IronSecCo/ironclaw
Security-first, self-hosted AI agents - isolation you can prove, not just promise.
AGPL-3.0Oct 20, 2026 · metrics 2.10.0
Go
git-pkgs/proxy
A lightweight caching proxy for package registries.
GPL-3.0Sep 19, 2026 · metrics 2.10.0
PyPI
mcp-hangar/mcp-hangar
MCP policy enforcement plane — deterministic policy on every Model Context Protocol call: identity, RFC 8707 audience binding, tool schema digest pinning, full audit trail. Python, self-hosted, MIT.
MITSep 21, 2026 · metrics 2.10.0
Go · npm
seebom-labs/BOMHort
About standalone, Kubernetes-native Software Bill of Materials (SBOM) visualization and governance platform
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
sisaku-security/sisakulint
CI-Friendly static linter with autofix, SAST, semantic analysis for GitHub Actions
Apache-2.0Sep 11, 2026 · metrics 2.10.0
Go
Nox-HQ/nox
Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go · npm
CodesWhat/portwing
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
AGPL-3.0Sep 9, 2026 · metrics 2.10.0
Go
airomhq/airom
Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
npm · Go · PyPI
bomly-dev/bomly-cli
Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Go
cfgaudit/cfgaudit
Static security auditor for AI-agent configuration: Claude Code, MCP servers, Cursor, Codex, Copilot, Gemini CLI and more. 109 rules, SARIF output, OWASP LLM Top 10 mapping.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
Go · PyPI
klarlabs-studio/mnemos
Self-hosted memory + evidence layer for AI agents (Claude Code, Codex, Hermes, ...) — embeddable Go library, MCP / HTTP / CLI, evidence-backed claims, bitemporal recall, axi-go execution kernel with JSONL audit + token budgets, cosign-signed releases with SLSA L3 provenance. No vendor cloud, no per-call billing.
MITSep 9, 2026 · metrics 2.10.0
PyPI
squid-protocol/gitgalaxy
Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.
Custom licenseOct 20, 2026 · metrics 2.10.0