Go
saschagrunert/nri-supply-chain
NRI plugin for supply chain attestation verification.
Apache-2.0Aug 9, 2026 · metrics 2.10.0
All tags
Catalogue tag
#supply-chain-security
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
51 records
PyPI
b7n0de/proofbundle
Offline cryptographic receipts for AI evaluation results — Ed25519 + RFC 6962 Merkle + optional SD-JWT. Integrity, not truth
MITJul 23, 2026 · metrics 2.10.0
Go
github/actions-lockfile
The authoritative definition of the GitHub Actions dependency lockfile format, plus a Go parser for auditing and verifying the action pins in use across a repo's workflows.
MITAug 3, 2026 · metrics 2.10.0
PyPI · npm
PrismorSec/prismor
Runtime Firewall for AI agents which catches the rogue tool call before it runs. Dangerous commands, secret leaks, prompt injection. For Claude Code, Codex and framework SDKs
Apache-2.0Jul 19, 2026 · metrics 2.10.0
Go
optimuslabs-io/grokpatrol
Open-source, offline forensic scanner CLI tool designed to detect evidence of git repo collection or upload by the Grok Build CLI to xAI infrastructure.
Apache-2.0Jul 18, 2026 · metrics 2.10.0
Go · npm
codeswhat/lookout
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
Custom licenseJul 16, 2026 · metrics 2.10.0
crates.io
pulseengine/sigil
Sigil — Supply chain security for WebAssembly. Embedded signatures, Sigstore keyless signing, SLSA provenance. Part of the PulseEngine toolchain.
No licenseAug 5, 2026 · metrics 2.10.0
npm
starloghq/index
Vet a package before your AI coding agent uses it — authoritative facts (CVEs, license, maintenance) via an MCP server + CLI. Local, no account.
Custom licenseSep 6, 2026 · metrics 2.10.0
Go
tiagosilva07/zyrax-guard
Audit your AI agent configs before you run them — prompt injection, rogue MCP servers, credential-exfil. Plus dependency vetting.
MITAug 28, 2026 · metrics 2.10.0
crates.io
sebastienrousseau/dtt
Rust crate for date, time, and timezone manipulation. Parse, format, validate, and convert RFC 3339 / ISO 8601 with guaranteed round-trip safety.
Apache-2.0Jul 25, 2026 · metrics 2.10.0
Go
famclaw/honeybadger
Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.
MITJul 17, 2026 · metrics 2.10.0
PyPI
sunglasses-dev/sunglasses
Sunglasses for AI agents. Protection layer + neighborhood watch.
MITAug 18, 2026 · metrics 2.10.0
npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.0Jul 31, 2026 · metrics 2.10.0
Go
Goryudyuma/gomod-cooldown
Delay newly available Go module versions during dependency updates with a temporary local GOPROXY.
MITJul 15, 2026 · metrics 2.10.0
Packagist
andreapollastri/checkpoint
Laravel Security Tool
MITAug 22, 2026 · metrics 2.10.0
Go
Conalh/tofulock
Lock & verify Terraform/OpenTofu module sources by commit digest - the integrity providers get from the native lockfile, but modules don't.
MITJul 27, 2026 · metrics 2.10.0
Go
sairintechnologycom/pkgsafe
Supply-chain firewall for AI coding agents and developers — checks npm/PyPI packages against OSV advisories, typosquat & lifecycle-script heuristics, and your policy before install. Local-first, MCP-native.
MITJul 15, 2026 · metrics 2.10.0
Go · npm
undont/supplyscan
scan JavaScript lockfiles to detect supply chain vulnerabilities and known exploits
MITJul 22, 2026 · metrics 2.10.0
PyPI
zrk222/code-factory
Proof-first software factory for AI-assisted code: specs, adversarial gates, deterministic decisions, and reviewable receipts.
Custom licenseJul 17, 2026 · metrics 2.10.0
PyPI
meidielo/aes-256-gcm-python-tool
Reviewable AES-256-GCM educational tool with Argon2id, JSON envelopes, and safe-mode streaming.
MITJul 19, 2026 · metrics 2.10.0
Go
wille/gh-actions-cli
Harden and manage your GitHub Actions: SHA-pin every action, enforce allowlist policies, update interactively, and analyze run health
MITJul 17, 2026 · metrics 2.10.0