Go · npm
step-security/secure-repo
Orchestrate GitHub Actions Security
AGPL-3.0Sep 29, 2026 · metrics 2.10.0
All tags
Catalogue tag
#supply-chain-security
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
88 records
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.0Sep 9, 2026 · metrics 2.10.0
Go
glsec/glsec
Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
PyPI · npm
owasp-dep-scan/dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
MITSep 18, 2026 · metrics 2.10.0
Go
rezmoss/sbomlyze
Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.
Apache-2.0Sep 12, 2026 · metrics 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.0Oct 20, 2026 · metrics 2.10.0
PyPI · npm
PrismorSec/prismor
Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
Apache-2.0Sep 11, 2026 · metrics 2.10.0
Go
liatrio/autogov
Unified CLI for software supply-chain governance / verify GitHub artifact attestations, evaluate OPA/Rego policies, generate SLSA Verification Summary Attestations (VSAs), and manage releases.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
Go
saschagrunert/nri-supply-chain
NRI plugin for supply chain attestation verification of container images.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
PyPI
b7n0de/proofbundle
Offline cryptographic receipts for AI evaluation results — Ed25519 + RFC 6962 Merkle + optional SD-JWT. Integrity, not truth
MITSep 13, 2026 · metrics 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MITSep 16, 2026 · metrics 2.10.0
Go
draugr-dev/draugr
Run Trivy, Semgrep, Gitleaks and more from one file. Consolidates SAST, SCA, secrets, IaC and container findings into one SARIF report and one pass/fail gate for CI — ranked by real risk, and can fail a PR on new findings only.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
PyPI
pezhik/skilltotal
Scan AI components (MCP servers, agent skills, npm/PyPI packages) for malware & risky capabilities. Local, deterministic, evidence-anchored. Free & OSS.
Apache-2.0Oct 9, 2026 · metrics 2.10.0
Go
ben-ranford/lopper
measure dependency waste and attack surface before it ships
MITSep 19, 2026 · metrics 2.10.0
npm
getmcpm/cli
MCP security guard + package manager. Block prompt injection, tool poisoning and rug-pulls in Model Context Protocol servers at runtime; trust-scored installs with Sigstore provenance for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and Gemini CLI. Local, deterministic, no LLM in the loop.
MITSep 8, 2026 · metrics 2.10.0
npm · PyPI
sinewaveai/agent-security-scanner-mcp
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
MITOct 9, 2026 · metrics 2.10.0
Go · npm
araihu/muamba
TOFU vendoring and integrity locks for remote assets
MITOct 16, 2026 · metrics 2.10.0
Go
git-pkgs/pin
Browser asset vendoring without npm.
MITSep 19, 2026 · metrics 2.10.0
Go
github/actions-lockfile
The authoritative definition of the GitHub Actions dependency lockfile format, plus a Go parser for auditing and verifying the action pins in use across a repo's workflows.
MITSep 16, 2026 · metrics 2.10.0
Go
jitpass/jit
Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first.
Custom licenseSep 5, 2026 · metrics 2.10.0
Go
jrjsmrtn/ansible-bom
Inventory installed Ansible content — collections and roles — and emit a lockfile, drift report, and CycloneDX BOM
Apache-2.0Sep 24, 2026 · metrics 2.10.0
PyPI
shcherbak-ai/tethered
tethered - Runtime network egress control for Python. One function call to restrict which hosts your code can connect to.
MITOct 14, 2026 · metrics 2.10.0
PyPI · npm
gautamvarmadatla/mcpsafetywarden
MCP servers expose tools with no information about what they actually do at runtime. mcpsafetywarden sits between your agent and any MCP server, profiling tool behavior, blocking destructive calls, and running active security audits before you trust them in a workflow.
Custom licenseSep 15, 2026 · metrics 2.10.0
Go
TomTonic/extract-sbom
Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.
BSD-3-ClauseSep 12, 2026 · metrics 2.10.0
npm
adamsjack711-ux/pkgxray
Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.
MITSep 10, 2026 · metrics 2.10.0
PyPI
sunglasses-dev/sunglasses
Open source input firewall for AI agents, beta. A local scanner checks text, code, PDFs, images, QR codes, audio and video with 1,583 patterns across 117 categories and reports findings and incomplete scans. A Claude Code hook blocks secret material in tool calls and the paths and hosts your policy lists before tools run.
MITOct 19, 2026 · metrics 2.10.0
Go
git-pkgs/capcheck
Fail CI when Go code or dependencies gain new privileged operations, using google/capslock
MITSep 14, 2026 · metrics 2.10.0
Go · npm
dev-hato/gomod-cooldown
Delay newly available Go module versions during dependency updates with a temporary local GOPROXY.
MITSep 8, 2026 · metrics 2.10.0
npm
noeos/verification-engine
Deterministic offline-first TypeScript engine and CLI for hash-linked integrity evidence and auditable diagnostics.
Apache-2.0Oct 10, 2026 · metrics 2.10.0
Go
optimuslabs-io/grokpatrol
Open-source, offline forensic scanner CLI tool designed to detect evidence of git repo collection or upload by the Grok Build CLI to xAI infrastructure.
Apache-2.0Sep 11, 2026 · metrics 2.10.0