#compliance

MCP server for SCF Controls Platform — security compliance controls, frameworks, evidence, and risk management for AI agents

Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.

Wilma - AWS Bedrock Security Configuration Checker

A Symfony bundle for teams where audit is infrastructure, not just history.

git diff for your SBOM ,compare CycloneDX/SPDX/Syft bills of materials, detect tampering, and gate CI

Risk-based release gate for CRA (Article 14), NIS2 and DORA compliance with SBOM, KEV correlation, and auditable evidence.

Heimdall Data Format (HDF) is a standardized JSON schema for representing security assessment baselines and results across diverse tools and platforms.

Open-source evidence layer for AI governance. Gates every AI agent tool call against your policy and writes a hash-chained execution record an auditor verifies offline, without trusting the operator. Root-agnostic, and binds to a TPM 2.0 or SEV-SNP hardware root when present. Your environment, no SaaS, no telemetry. AGPL-3.0.

Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.

Network dependent Sudo session logger and logplayback GUI

Tool to check licensing of Composer depdencies against a set of rules to ensure compliance

Analyze dependency licenses and get actionable licensing guidance for Python projects.

An open source TRISA node for use in Travel Rule information transfers