#supply-chain-security

🦅 Catch npm dependencies red-handed at runtime — see & block when one reads your SSH keys, steals secrets, or phones home.

Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.

Open-source SBOM generator for embedded builds — CMake, Yocto, Buildroot, Zephyr. GPL, fully local by default. Optional: free EU CRA readiness report.

Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.

Laravel Security Tool

One gateway in front of every MCP server your agents can reach. A server that changes after you approved it is caught, the call is blocked before it runs, and nothing leaves your machine.

Lock & verify Terraform/OpenTofu module sources by commit digest - the integrity providers get from the native lockfile, but modules don't.

CI/CD pipeline security analyzer — scans GitHub Actions workflows for attack vectors and maps findings to MITRE ATT&CK

Docker Scout CLI

Conformance vector suite and reference verifier for the adversarial-execution-evidence in-toto predicate

Know what you're letting in — scans, signs and verifies what an agent loads. Agent Skills vs the OWASP Agentic Skills Top 10, with SARIF output and a load-time gate.

Your AI finds the open-source tool it needs on GitHub. Legwork installs it in a sandbox.

Supply-chain firewall for AI coding agents and developers — checks npm/PyPI packages against OSV advisories, typosquat & lifecycle-script heuristics, and your policy before install. Local-first, MCP-native.

Cage untrusted MCP servers in containers, compose them into agents, and share them over any OCI registry. Signed, sandboxed, no Docker required.

scan JavaScript lockfiles to detect supply chain vulnerabilities and known exploits