crates.io
jdx/packslip
A signed release manifest for vendor binaries
MITSep 18, 2026 · metrics 2.10.0
All tags
Catalogue tag
#supply-chain
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
64 records
npm
AppThreat/atom
atom is a novel intermediate representation for applications and a standalone tool that is powered by chen.
MITSep 15, 2026 · metrics 2.10.0
npm
abpai/harness-doctor
Framework-agnostic agent-harness doctor: deterministic checks for good agent-harness practices
MITSep 13, 2026 · metrics 2.10.0
Go
cplieger/pinstall
Install and update a pinned, digest-verified package into versioned directories
Apache-2.0Sep 19, 2026 · metrics 2.10.0
npm
vaultcompasshq/conductor
Umbrella installer and combined report over the independently installable guardrail gates
MITSep 14, 2026 · metrics 2.10.0
Go
eitanity/kanonarion
Dependency assurance software for Go. A deterministic, local source of truth about your dependencies - what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
PyPI
yunaremaia/taintrace
Typosquat detector for AI coding agent dependencies
MITOct 4, 2026 · metrics 2.10.0
PyPI · npm
HikaruEgashira/pmsec
Zero-config supply-chain hardening.
MITSep 8, 2026 · metrics 2.10.0
npm · crates.io
quality-sh/provenance
No repository description published.
Custom licenseOct 20, 2026 · metrics 2.10.0
PyPI
YugantM/hvtracker
AI agent & MCP trust registry — independent, evidence-based trust scores for 1.3K+ open-source AI agents and MCP servers. Runtime-trust calibrated (MCP, dependencies, provenance drift), with side-by-side comparison and embeddable live badges. Ranked by verifiable signals, not hype.
MITSep 13, 2026 · metrics 2.10.0
Go · npm
cjohnstoniv/wardyn
Open-source governed-sandbox control plane for any workload — per-run identity, brokered credentials, layered egress, approvals, and an append-only audit. Coding agents are the flagship use. Apache-2.0, self-hosted.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
PyPI · Go
jmelahman/pkglint
Linter for Arch Linux PKGBUILDs
GPL-3.0Oct 9, 2026 · metrics 2.10.0
Packagist
k2gl/dsse
Sign and verify DSSE (Dead Simple Signing Envelope) payloads in PHP.
MITSep 13, 2026 · metrics 2.10.0
Go
matteo-sung/lockvet
Explain any lockfile change: bumps release-verified against 22 registries, vulns (OSV), ages, deprecations, typosquats, integrity tampering — 61 formats incl. pdm.lock, vcpkg, mise.lock, build.gradle, pom.xml, go.sum, GitHub Actions, GitLab CI, Dockerfiles, Kubernetes, Helm, SBOMs. CLI + CI gate + MCP server + playground. By an AI agent.
MITAug 23, 2026 · metrics 2.10.0
npm
KirtashDev/dephawk
🦅 Catch npm dependencies red-handed at runtime — see & block when one reads your SSH keys, steals secrets, or phones home.
MITSep 18, 2026 · metrics 2.10.0
npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
i-ops-hq/assurance
Point it at a folder and find out what is missing, and what silently changed. Coverage over dated or numbered series, plus a baseline anyone can keep. No model decides any of it.
Apache-2.0Sep 18, 2026 · metrics 2.10.0
npm
lloyal-ai/hdk
Harness Development Kit for Vertical Inference
Custom licenseSep 8, 2026 · metrics 2.10.0
Go · npm
daimoniac/suppline
Self-hosted Kubernetes image intake gateway: mirror → Trivy scan → CEL policy → Sigstore attestations. Admit only what passed.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Packagist
laravel/vet
Laravel Vet is a dependency audit for PHP.
MITSep 23, 2026 · metrics 2.10.0
npm
dot-skill/skillerr
Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
crates.io
cackle-rs/cackle
A code ACL checker for Rust
Custom licenseSep 18, 2026 · metrics 2.10.0
npm
cdxgen/cdx-proto
Runtime library to serialize/deserialize CycloneDX BOM with protocol buffers
MITSep 15, 2026 · metrics 2.10.0
npm
extensiondev/artifact-integrity
Trust what you ship: download and verify browser extension artifacts (zip structure, manifest, metadata) and emit a deterministic JSON report for CI release gates.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
npm
nkratk/llm-trust-guard
No repository description published.
MITSep 11, 2026 · metrics 2.10.0
PyPI · npm
DevInder1/supply-chain-scanner-public
Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.
MITSep 30, 2026 · metrics 2.10.0
npm · PyPI
YugantM/hvtracker-mcp
MCP server for HVTracker trust checks.
MITSep 13, 2026 · metrics 2.10.0
npm
davidnichols-ops/trustcard
Cryptographic trust infrastructure for MCP servers — signed manifests, TOFU pinning, two-gate enforcement, and the "npm audit" scanner.
MITSep 13, 2026 · metrics 2.10.0
npm
nabheet/pcbway-mcp-server
MCP server for PCBWay Partner API — PCB quotes, SMT assembly, order management, shipping
MITSep 18, 2026 · metrics 2.10.0
npm
iAMv1/omnisectester
Nation-state grade, defense-in-depth security testing framework. Tests web apps, extensions, desktop, mobile, cloud, AI/LLM, hardware, and supply chain from a single CLI.
MITSep 22, 2026 · metrics 2.10.0