PyPI
squid-protocol/gitgalaxy
Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.
Власна ліцензія20 жовт. 2026 р. · метрики 2.10.0
Усі теги
Тег каталогу
#supply-chain-security
Усі репозиторії публічного реєстру з цим тегом — із тем GitHub або ключових слів, які публікують їхні реєстри пакетів. Здоров'я вимірюється за тією ж версіонованою методологією, що й решта реєстру.
92 записи
Go · npm
step-security/secure-repo
Orchestrate GitHub Actions Security
AGPL-3.029 вер. 2026 р. · метрики 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.09 вер. 2026 р. · метрики 2.10.0
Go
glsec/glsec
Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.
Apache-2.010 вер. 2026 р. · метрики 2.10.0
PyPI · npm
owasp-dep-scan/dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
MIT18 вер. 2026 р. · метрики 2.10.0
Go
rezmoss/sbomlyze
Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.
Apache-2.012 вер. 2026 р. · метрики 2.10.0
npm · crates.io
sheeki03/tirith
Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.
AGPL-3.021 жовт. 2026 р. · метрики 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.020 жовт. 2026 р. · метрики 2.10.0
PyPI · npm
PrismorSec/prismor
Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
Apache-2.011 вер. 2026 р. · метрики 2.10.0
Go
liatrio/autogov
Unified CLI for software supply-chain governance / verify GitHub artifact attestations, evaluate OPA/Rego policies, generate SLSA Verification Summary Attestations (VSAs), and manage releases.
Apache-2.015 вер. 2026 р. · метрики 2.10.0
Go
saschagrunert/nri-supply-chain
NRI plugin for supply chain attestation verification of container images.
Apache-2.017 вер. 2026 р. · метрики 2.10.0
PyPI
b7n0de/proofbundle
Offline cryptographic receipts for AI evaluation results — Ed25519 + RFC 6962 Merkle + optional SD-JWT. Integrity, not truth
MIT13 вер. 2026 р. · метрики 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MIT16 вер. 2026 р. · метрики 2.10.0
Go
draugr-dev/draugr
Run Trivy, Semgrep, Gitleaks and more from one file. Consolidates SAST, SCA, secrets, IaC and container findings into one SARIF report and one pass/fail gate for CI — ranked by real risk, and can fail a PR on new findings only.
Apache-2.011 вер. 2026 р. · метрики 2.10.0
PyPI
pezhik/skilltotal
Scan AI components (MCP servers, agent skills, npm/PyPI packages) for malware & risky capabilities. Local, deterministic, evidence-anchored. Free & OSS.
Apache-2.09 жовт. 2026 р. · метрики 2.10.0
Go
ben-ranford/lopper
measure dependency waste and attack surface before it ships
MIT19 вер. 2026 р. · метрики 2.10.0
npm
getmcpm/cli
MCP security guard + package manager. Block prompt injection, tool poisoning and rug-pulls in Model Context Protocol servers at runtime; trust-scored installs with Sigstore provenance for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and Gemini CLI. Local, deterministic, no LLM in the loop.
MIT8 вер. 2026 р. · метрики 2.10.0
npm · PyPI
sinewaveai/agent-security-scanner-mcp
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
MIT9 жовт. 2026 р. · метрики 2.10.0
Go · npm
araihu/muamba
TOFU vendoring and integrity locks for remote assets
MIT16 жовт. 2026 р. · метрики 2.10.0
Go
git-pkgs/pin
Browser asset vendoring without npm.
MIT19 вер. 2026 р. · метрики 2.10.0
Go
github/actions-lockfile
The authoritative definition of the GitHub Actions dependency lockfile format, plus a Go parser for auditing and verifying the action pins in use across a repo's workflows.
MIT16 вер. 2026 р. · метрики 2.10.0
Go
jitpass/jit
Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first.
Власна ліцензія22 жовт. 2026 р. · метрики 2.10.0
Go
jrjsmrtn/ansible-bom
Inventory installed Ansible content — collections and roles — and emit a lockfile, drift report, and CycloneDX BOM
Apache-2.024 вер. 2026 р. · метрики 2.10.0
PyPI
shcherbak-ai/tethered
tethered - Runtime network egress control for Python. One function call to restrict which hosts your code can connect to.
MIT14 жовт. 2026 р. · метрики 2.10.0
PyPI · npm
gautamvarmadatla/mcpsafetywarden
MCP servers expose tools with no information about what they actually do at runtime. mcpsafetywarden sits between your agent and any MCP server, profiling tool behavior, blocking destructive calls, and running active security audits before you trust them in a workflow.
Власна ліцензія15 вер. 2026 р. · метрики 2.10.0
Go
TomTonic/extract-sbom
Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.
BSD-3-Clause12 вер. 2026 р. · метрики 2.10.0
npm
adamsjack711-ux/pkgxray
Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.
MIT10 вер. 2026 р. · метрики 2.10.0
PyPI
sunglasses-dev/sunglasses
Open source input firewall for AI agents, beta. A local scanner checks text, code, PDFs, images, QR codes, audio and video with 1,583 patterns across 117 categories and reports findings and incomplete scans. A Claude Code hook blocks secret material in tool calls and the paths and hosts your policy lists before tools run.
MIT19 жовт. 2026 р. · метрики 2.10.0
Go
git-pkgs/capcheck
Fail CI when Go code or dependencies gain new privileged operations, using google/capslock
MIT14 вер. 2026 р. · метрики 2.10.0
Go · npm
dev-hato/gomod-cooldown
Delay newly available Go module versions during dependency updates with a temporary local GOPROXY.
MIT8 вер. 2026 р. · метрики 2.10.0