Go
tiagosilva07/zyrax-guard
Audit your AI agent configs before you run them — prompt injection, rogue MCP servers, credential-exfil. Plus dependency vetting.
MITOct 20, 2026 · metrics 2.10.0
All tags
Catalogue tag
#supply-chain-security
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
88 records
PyPI
yunaremaia/taintrace
Typosquat detector for AI coding agent dependencies
MITOct 4, 2026 · metrics 2.10.0
Go
blairham/stevedore
Release Docker/OCI images the way GoReleaser releases binaries — build, scan, sign, SBOM, provenance, per-image versioning, and monorepo change detection.
MITSep 10, 2026 · metrics 2.10.0
Go
csnp/cryptodeps
Cryptographic Dependency Scanner - Identify quantum-vulnerable cryptographic algorithms in your software dependencies. Part of the QRAMM Toolkit.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
crates.io
pulseengine/sigil
Sigil — Supply chain security for WebAssembly. Embedded signatures, Sigstore keyless signing, SLSA provenance. Part of the PulseEngine toolchain.
No licenseSep 17, 2026 · metrics 2.10.0
crates.io
sebastienrousseau/dtt
Rust crate for date, time, and timezone manipulation. Parse, format, validate, and convert RFC 3339 / ISO 8601 with guaranteed round-trip safety.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
npm
starloghq/index
Vet a package before your AI coding agent uses it — authoritative facts (CVEs, license, maintenance) via an MCP server + CLI. Local, no account.
Custom licenseSep 6, 2026 · metrics 2.10.0
Packagist
k2gl/dsse
Sign and verify DSSE (Dead Simple Signing Envelope) payloads in PHP.
MITSep 13, 2026 · metrics 2.10.0
Go
skilltrust/skill-detector
CLI to spot risky AI skill packages before you use them. Scans for injection, exfiltration, supply chain, and other threats.
MITOct 19, 2026 · metrics 2.10.0
npm
KirtashDev/dephawk
🦅 Catch npm dependencies red-handed at runtime — see & block when one reads your SSH keys, steals secrets, or phones home.
MITSep 18, 2026 · metrics 2.10.0
npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
Innomatica-GmbH/embtrace-sbom
Open-source SBOM generator for embedded builds — CMake, Yocto, Buildroot, Zephyr. GPL, fully local by default. Optional: free EU CRA readiness report.
GPL-3.0Sep 18, 2026 · metrics 2.10.0
Go
famclaw/honeybadger
Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.
MITSep 9, 2026 · metrics 2.10.0
Packagist
andreapollastri/checkpoint
Laravel Security Tool
MITOct 20, 2026 · metrics 2.10.0
PyPI
gawk-dev/mcpgawk
One gateway in front of every MCP server your agents can reach. A server that changes after you approved it is caught, the call is blocked before it runs, and nothing leaves your machine.
Apache-2.0Sep 26, 2026 · metrics 2.10.0
Go
Conalh/tofulock
Lock & verify Terraform/OpenTofu module sources by commit digest - the integrity providers get from the native lockfile, but modules don't.
MITSep 14, 2026 · metrics 2.10.0
PyPI
VanshBhardwaj1945/FlowSec
CI/CD pipeline security analyzer — scans GitHub Actions workflows for attack vectors and maps findings to MITRE ATT&CK
MITSep 18, 2026 · metrics 2.10.0
—
docker/scout-cli
Docker Scout CLI
Custom licenseSep 20, 2026 · metrics 2.10.0
Go · PyPI
probityai/agent-evidence-vectors
Conformance vector suite and reference verifier for the adversarial-execution-evidence in-toto predicate
Apache-2.0Sep 20, 2026 · metrics 2.10.0
Go
SVGreg/surfaceguard
Know what you're letting in — scans, signs and verifies what an agent loads. Agent Skills vs the OWASP Agentic Skills Top 10, with SARIF output and a load-time gate.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
PyPI
kumarganduri/legwork
Your AI finds the open-source tool it needs on GitHub. Legwork installs it in a sandbox.
MITOct 12, 2026 · metrics 2.10.0
Go
sairintechnologycom/pkgsafe
Supply-chain firewall for AI coding agents and developers — checks npm/PyPI packages against OSV advisories, typosquat & lifecycle-script heuristics, and your policy before install. Local-first, MCP-native.
MITSep 8, 2026 · metrics 2.10.0
Go
okedeji/mcpvessel
Cage untrusted MCP servers in containers, compose them into agents, and share them over any OCI registry. Signed, sandboxed, no Docker required.
Apache-2.0Sep 20, 2026 · metrics 2.10.0
Go · npm
undont/supplyscan
scan JavaScript lockfiles to detect supply chain vulnerabilities and known exploits
MITSep 12, 2026 · metrics 2.10.0
Go · PyPI
kordloom/loomseal
An open format for evidence someone else can check. One signed, chained, anchored file, verified offline by a free Apache-2.0 tool with no account and no server.
Apache-2.0Sep 20, 2026 · metrics 2.10.0
Go
wille/gh-actions-cli
Harden and manage your GitHub Actions: SHA-pin every action, enforce allowlist policies, update interactively, and analyze run health
MITSep 10, 2026 · metrics 2.10.0
PyPI
MDP-Studio/AES-256-GCM-Python-Tool
Reviewable AES-256-GCM educational tool with Argon2id, JSON envelopes, and safe-mode streaming.
MITSep 11, 2026 · metrics 2.10.0
Go
SpiderCob/spidercob-go
Go SDK for Spidercob — DLP secret scanning and OSV.dev CVE scanning. Zero dependencies.
No licenseSep 19, 2026 · metrics 2.10.0