Go · npm
CycloneDX/sbom-utility
Utility that provides an API platform for validating, querying and managing BOM data
Apache-2.02026年10月21日 · 指标 2.10.0
全部标签
目录标签
#sbom
公开记录中带有此标签的全部仓库——标签来自其 GitHub 主题或软件包注册表发布的关键词。健康度量遵循与记录其余部分相同的版本化方法论。
97 条记录
Maven
MediaMarktSaturn/technolinator
GitHub app for SBOM creation using cdxgen and upload to Dependency-Track
Apache-2.02026年9月14日 · 指标 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MIT2026年9月16日 · 指标 2.10.0
npm
CycloneDX/cyclonedx-node-module
creates CycloneDX Software-Bill-of-Materials (SBOM) from Node.js-based projects
Apache-2.02026年10月21日 · 指标 2.10.0
PyPI
espressif/esp-idf-sbom
ESP-IDF Software Bill of Materials Generation Tool
Apache-2.02026年9月14日 · 指标 2.10.0
Go
git-pkgs/pin
Browser asset vendoring without npm.
MIT2026年9月19日 · 指标 2.10.0
Go
jrjsmrtn/ansible-bom
Inventory installed Ansible content — collections and roles — and emit a lockfile, drift report, and CycloneDX BOM
Apache-2.02026年9月24日 · 指标 2.10.0
Go
Vulnetix/cli
Automate vulnerability triage which prioritizes remediation over discovery
自定义许可证2026年10月21日 · 指标 2.10.0
PyPI
bact/licenseid
A Python CLI and library to get the SPDX License ID from license text
Apache-2.02026年10月19日 · 指标 2.10.0
Go
TomTonic/extract-sbom
Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.
BSD-3-Clause2026年9月12日 · 指标 2.10.0
crates.io
scm-rs/csaf-walker
A library and CLI to work with CSAF and SBOM data
Apache-2.02026年9月18日 · 指标 2.10.0
Go
eitanity/kanonarion
Dependency assurance software for Go. A deterministic, local source of truth about your dependencies - what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON.
Apache-2.02026年9月11日 · 指标 2.10.0
npm · PyPI
aiexponent/license-compliance-checker
License Compliance Checker — Multi-ecosystem license + AI model scanner for EU AI Act Article 53 GPAI compliance. SBOM, SARIF, training-data risk. Apache 2.0.
Apache-2.02026年9月14日 · 指标 2.10.0
Go
blairham/stevedore
Release Docker/OCI images the way GoReleaser releases binaries — build, scan, sign, SBOM, provenance, per-image versioning, and monorepo change detection.
MIT2026年9月10日 · 指标 2.10.0
Go
csnp/cryptodeps
Cryptographic Dependency Scanner - Identify quantum-vulnerable cryptographic algorithms in your software dependencies. Part of the QRAMM Toolkit.
Apache-2.02026年9月19日 · 指标 2.10.0
crates.io
sebastienrousseau/dtt
Rust crate for date, time, and timezone manipulation. Parse, format, validate, and convert RFC 3339 / ISO 8601 with guaranteed round-trip safety.
Apache-2.02026年9月13日 · 指标 2.10.0
Go
matteo-sung/lockvet
Explain any lockfile change: bumps release-verified against 22 registries, vulns (OSV), ages, deprecations, typosquats, integrity tampering — 61 formats incl. pdm.lock, vcpkg, mise.lock, build.gradle, pom.xml, go.sum, GitHub Actions, GitLab CI, Dockerfiles, Kubernetes, Helm, SBOMs. CLI + CI gate + MCP server + playground. By an AI agent.
MIT2026年8月23日 · 指标 2.10.0
npm
cdxgen/cdxgen-plugins-bin
Binary plugins for @cyclonedx/cdxgen npm package
MIT2026年9月19日 · 指标 2.10.0
PyPI
i-ops-hq/assurance
Point it at a folder and find out what is missing, and what silently changed. Coverage over dated or numbered series, plus a baseline anyone can keep. No model decides any of it.
Apache-2.02026年9月18日 · 指标 2.10.0
PyPI
Innomatica-GmbH/embtrace-sbom
Open-source SBOM generator for embedded builds — CMake, Yocto, Buildroot, Zephyr. GPL, fully local by default. Optional: free EU CRA readiness report.
GPL-3.02026年9月18日 · 指标 2.10.0
Go
famclaw/honeybadger
Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.
MIT2026年9月9日 · 指标 2.10.0
npm
cdxgen/cdx-proto
Runtime library to serialize/deserialize CycloneDX BOM with protocol buffers
MIT2026年9月15日 · 指标 2.10.0
NuGet
patriksvensson/covenant
A tool to generate SBOM (Software Bill of Material) from source code artifacts.
MIT2026年9月15日 · 指标 2.10.0
Go
kidoz/go-vulners
Go client library for the Vulners vulnerability database API — search, audit, SBOM, VScanner, and more
MIT2026年10月20日 · 指标 2.10.0
Go
gitsocial-org/gitsocial
Git-native collaboration platform
MIT2026年10月21日 · 指标 2.10.0
PyPI · npm
DevInder1/supply-chain-scanner-public
Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.
MIT2026年9月30日 · 指标 2.10.0
PyPI · npm · crates.io
JunHwan-Kwon/deepbom
Local static analysis and evidence generation for deployed AI model artifacts
Apache-2.02026年10月21日 · 指标 2.10.0
PyPI
PramanKasliwal/MaunPrekshak
The Silent Observer — Fast, local-first security scanner for dependencies (SCA), exposed secrets & git history, SAST, Dockerfiles, and GitHub Actions with multi-provider AI remediation.
Apache-2.02026年10月12日 · 指标 2.10.0
Go
olelbis/pswg
Small Go password generator CLI with shell-safe mode and signed release artifacts
MIT2026年9月13日 · 指标 2.10.0
Go
kidoz/vulners-cli
CLI vulnerability scanner powered by Vulners — search, audit, scan, offline mode
MIT2026年9月9日 · 指标 2.10.0