Go
anchore/syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache-2.02026年8月28日 · 指标 2.10.0
全部标签
目录标签
#sbom
公开记录中带有此标签的全部仓库——标签来自其 GitHub 主题或软件包注册表发布的关键词。健康度量遵循与记录其余部分相同的版本化方法论。
61 条记录
Go
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
Apache-2.02026年7月16日 · 指标 2.10.0
Go · npm
zarf-dev/zarf
The Airgap Native Package Manager for Kubernetes
Apache-2.02026年7月22日 · 指标 2.10.0
PyPI
CycloneDX/cyclonedx-python
CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments
Apache-2.02026年8月27日 · 指标 2.10.0
Go
kubernetes-sigs/tejolote
A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.
Apache-2.02026年7月24日 · 指标 2.10.0
PyPI · npm
msaad00/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.02026年7月16日 · 指标 2.10.0
Maven · npm
oss-review-toolkit/ort
A suite of tools to automate software compliance checks.
Apache-2.02026年7月17日 · 指标 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.02026年7月28日 · 指标 2.10.0
—
microsoft/component-detection
Scans your project to determine what components you use
MIT2026年7月18日 · 指标 2.10.0
Packagist
CycloneDX/cyclonedx-php-composer
Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects
Apache-2.02026年7月29日 · 指标 2.10.0
PyPI
CycloneDX/cyclonedx-python-lib
Functionality and DataModels of OWASP CycloneDX for Python
Apache-2.02026年7月17日 · 指标 2.10.0
PyPI · npm
NuGuardAI/nuguard
opensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis
自定义许可证2026年7月18日 · 指标 2.10.0
PyPI
fsfe/reuse-tool
This is a mirror of https://codeberg.org/fsfe/reuse-tool
自定义许可证2026年7月21日 · 指标 2.10.0
npm
janbiasi/rollup-plugin-sbom
Create SBOMs in CycloneDX format for your Vite, Rollup or Rolldown projects with ease
MIT2026年7月17日 · 指标 2.10.0
PyPI
kdeldycke/meta-package-manager
🎁 wraps all package managers with a unifying CLI
GPL-2.02026年7月20日 · 指标 2.10.0
Go · npm
seebom-labs/BOMHort
About standalone, Kubernetes-native Software Bill of Materials (SBOM) visualization and governance platform
Apache-2.02026年7月29日 · 指标 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MIT2026年9月6日 · 指标 2.10.0
PyPI
jimmy058910/jmo-security-repo
JMo Security Suite - Terminal-first security audit toolkit with many tools, multi-target scanning, & compliance
自定义许可证2026年7月31日 · 指标 2.10.0
Go
Nox-HQ/nox
Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.
Apache-2.02026年7月24日 · 指标 2.10.0
PyPI
aboutcode-org/scancode-toolkit
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!
自定义许可证2026年7月21日 · 指标 2.10.0
Go · PyPI
bomly-dev/bomly-cli
Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
Apache-2.02026年7月17日 · 指标 2.10.0
Maven · npm
eclipse-apoapsis/ort-server
A scalable server implementation of the OSS Review Toolkit.
Apache-2.02026年7月15日 · 指标 2.10.0
crates.io
rust-secure-code/cargo-auditable
Make production Rust binaries auditable
Apache-2.02026年9月5日 · 指标 2.10.0
npm
CycloneDX/cyclonedx-node-module
creates CycloneDX Software-Bill-of-Materials (SBOM) from Node.js-based projects
Apache-2.02026年9月5日 · 指标 2.10.0
PyPI · npm
lgtm-hq/py-lintro
Making linters play nice... Mostly.
MIT2026年7月17日 · 指标 2.10.0
PyPI · npm
owasp-dep-scan/dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
MIT2026年8月24日 · 指标 2.10.0
PyPI
squid-protocol/gitgalaxy
Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.
自定义许可证2026年8月22日 · 指标 2.10.0
Go · npm
CodesWhat/portwing
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
AGPL-3.02026年8月15日 · 指标 2.10.0
—
CycloneDX/cyclonedx-cli
CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.
Apache-2.02026年8月21日 · 指标 2.10.0
NuGet
CycloneDX/cyclonedx-dotnet-library
.NET library to consume and produce CycloneDX Software Bill of Materials (SBOM)
Apache-2.02026年7月22日 · 指标 2.10.0