Go
sigstore/sigstore
Common go library shared across sigstore services and clients
Apache-2.02026年8月29日 · 指标 2.10.0
全部标签
目录标签
#supply-chain
公开记录中带有此标签的全部仓库——标签来自其 GitHub 主题或软件包注册表发布的关键词。健康度量遵循与记录其余部分相同的版本化方法论。
37 条记录
Go · npm
mindersec/minder
Software Supply Chain Security Platform
Apache-2.02026年7月20日 · 指标 2.10.0
PyPI
sigstore/sigstore-python
A Sigstore client written in Python
自定义许可证2026年8月11日 · 指标 2.10.0
Go
Sigstore/rekor
Software Supply Chain Transparency Log
Apache-2.02026年7月18日 · 指标 2.10.0
PyPI
pypa/pip-audit
Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
Apache-2.02026年8月27日 · 指标 2.10.0
PyPI · npm
msaad00/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.02026年7月16日 · 指标 2.10.0
npm
sigstore/sigstore-js
Code-signing for npm packages
Apache-2.02026年8月31日 · 指标 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.02026年7月28日 · 指标 2.10.0
Go
carabiner-dev/ampel
🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)
Apache-2.02026年7月21日 · 指标 2.10.0
Go · npm
seebom-labs/BOMHort
About standalone, Kubernetes-native Software Bill of Materials (SBOM) visualization and governance platform
Apache-2.02026年7月29日 · 指标 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MIT2026年9月6日 · 指标 2.10.0
npm
blamejs/blamejs
The Node framework that owns its stack.
Apache-2.02026年8月22日 · 指标 2.10.0
Go · npm
emoss08/Trenova
An AI-driven asset based Transportation Management System
自定义许可证2026年8月3日 · 指标 2.10.0
crates.io
rust-secure-code/cargo-auditable
Make production Rust binaries auditable
Apache-2.02026年9月5日 · 指标 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.02026年8月22日 · 指标 2.10.0
npm
blamejs/pki
Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.
Apache-2.02026年7月23日 · 指标 2.10.0
PyPI · npm
PrismorSec/prismor
Runtime Firewall for AI agents which catches the rogue tool call before it runs. Dangerous commands, secret leaks, prompt injection. For Claude Code, Codex and framework SDKs
Apache-2.02026年7月19日 · 指标 2.10.0
PyPI
Ndevu12/stayAwakeBot
A bot for helping you to stay secure and making free hosted services stay a wake
AGPL-3.02026年7月31日 · 指标 2.10.0
npm
abpai/harness-doctor
Framework-agnostic agent-harness doctor: deterministic checks for good agent-harness practices
MIT2026年7月23日 · 指标 2.10.0
Packagist
dgtlss/warden
A Laravel package that proactively monitors your dependencies for security vulnerabilities by running automated composer audits and sending notifications via webhooks and email
MIT2026年9月5日 · 指标 2.10.0
npm
dot-skill/skillerr
Open .skill Protocol - a sealed, inspectable package format for AI agent skills. Reference implementation: skillerr.
Apache-2.02026年7月27日 · 指标 2.10.0
Go
eitanity/kanonarion
Dependency assurance software for Go. A deterministic, local source of truth about your dependencies - what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON.
Apache-2.02026年7月19日 · 指标 2.10.0
Go
matteo-sung/lockvet
Explain any lockfile change: bumps release-verified against 22 registries, vulns (OSV), ages, deprecations, typosquats, integrity tampering — 61 formats incl. pdm.lock, vcpkg, mise.lock, build.gradle, pom.xml, go.sum, GitHub Actions, GitLab CI, Dockerfiles, Kubernetes, Helm, SBOMs. CLI + CI gate + MCP server + playground. By an AI agent.
MIT2026年8月23日 · 指标 2.10.0
npm · PyPI
HikaruEgashira/pmsec
Zero-config supply-chain hardening.
MIT2026年7月15日 · 指标 2.10.0
Go · npm
cjohnstoniv/wardyn
Open-source governance control plane for coding agents — per-run identity, brokered credentials, layered egress, approvals, and an append-only audit. Apache-2.0, self-hosted.
Apache-2.02026年7月27日 · 指标 2.10.0
Go · npm
daimoniac/suppline
Self-hosted Kubernetes image intake gateway: mirror → Trivy scan → CEL policy → Sigstore attestations. Admit only what passed.
Apache-2.02026年7月30日 · 指标 2.10.0
PyPI
YugantM/hvtracker
AI Agent Trust Registry — independent, evidence-based trust scores for 300+ open-source AI agents. Runtime-trust calibrated (MCP, dependencies, provenance drift), with side-by-side comparison and embeddable live badges. Ranked by verifiable signals, not hype.
MIT2026年7月26日 · 指标 2.10.0
crates.io
cackle-rs/cackle
A code ACL checker for Rust
自定义许可证2026年8月16日 · 指标 2.10.0
npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.02026年7月31日 · 指标 2.10.0
npm
extensiondev/artifact-integrity
Trust what you ship: download and verify browser extension artifacts (zip structure, manifest, metadata) and emit a deterministic JSON report for CI release gates.
Apache-2.02026年7月25日 · 指标 2.10.0