Go
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
Apache-2.02026年7月16日 · 指标 2.10.0
全部标签
目录标签
#supply-chain-security
公开记录中带有此标签的全部仓库——标签来自其 GitHub 主题或软件包注册表发布的关键词。健康度量遵循与记录其余部分相同的版本化方法论。
51 条记录
npm
NodeSecure/js-x-ray
JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.
MIT2026年8月4日 · 指标 2.10.0
PyPI · npm
msaad00/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.02026年7月16日 · 指标 2.10.0
PyPI · npm
sattyamjjain/agent-audit-kit
Static scanner for MCP-connected AI agent pipelines — 271 rules across 12 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.
MIT2026年8月2日 · 指标 2.10.0
PyPI · crates.io · npm
hashgraph-online/hol-guard
Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.
Apache-2.02026年9月5日 · 指标 2.10.0
Go · npm
safedep/pmg
PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
Apache-2.02026年7月17日 · 指标 2.10.0
Go
carabiner-dev/ampel
🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)
Apache-2.02026年7月21日 · 指标 2.10.0
npm
lirantal/npq
safely install npm packages by auditing them pre-install stage
Apache-2.02026年7月17日 · 指标 2.10.0
crates.io
nolabs-ai/nono
Sandbox any AI agent in seconds - zero setup, zero latency.
Apache-2.02026年7月16日 · 指标 2.10.0
crates.io
always-further/nono
Sandbox any AI agent in seconds - zero setup, zero latency.
Apache-2.02026年7月17日 · 指标 2.10.0
crates.io
lukehinds/nono
Sandbox any AI agent in seconds - zero setup, zero latency.
Apache-2.02026年7月19日 · 指标 2.10.0
Go · npm
seebom-labs/BOMHort
About standalone, Kubernetes-native Software Bill of Materials (SBOM) visualization and governance platform
Apache-2.02026年7月29日 · 指标 2.10.0
Go · PyPI
IronSecCo/ironclaw
Security-first, self-hosted AI agents - isolation you can prove, not just promise.
AGPL-3.02026年8月29日 · 指标 2.10.0
Go
Nox-HQ/nox
Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.
Apache-2.02026年7月24日 · 指标 2.10.0
Go · PyPI
bomly-dev/bomly-cli
Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
Apache-2.02026年7月17日 · 指标 2.10.0
Go · PyPI
felixgeelhaar/mnemos
Self-hosted memory + evidence layer for AI agents (Claude Code, Codex, Hermes, ...) — embeddable Go library, MCP / HTTP / CLI, evidence-backed claims, bitemporal recall, axi-go execution kernel with JSONL audit + token budgets, cosign-signed releases with SLSA L3 provenance. No vendor cloud, no per-call billing.
MIT2026年7月16日 · 指标 2.10.0
Go
sisaku-security/sisakulint
CI-Friendly static linter with autofix, SAST, semantic analysis for GitHub Actions
Apache-2.02026年7月19日 · 指标 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.02026年8月22日 · 指标 2.10.0
PyPI · npm
owasp-dep-scan/dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
MIT2026年8月24日 · 指标 2.10.0
PyPI
squid-protocol/gitgalaxy
Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.
自定义许可证2026年8月22日 · 指标 2.10.0
Go · npm
CodesWhat/portwing
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
AGPL-3.02026年8月15日 · 指标 2.10.0
Go
liatrio/autogov
Unified CLI for software supply-chain governance / verify GitHub artifact attestations, evaluate OPA/Rego policies, generate SLSA Verification Summary Attestations (VSAs), and manage releases.
Apache-2.02026年8月1日 · 指标 2.10.0
Go
airomhq/airom
Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.
Apache-2.02026年7月23日 · 指标 2.10.0
npm · PyPI
delimit-ai/delimit-mcp-server
The merge gate for AI-written code, with signed, replayable attestation. Works across Claude Code, Codex, Cursor, and Gemini CLI.
MIT2026年8月3日 · 指标 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.02026年7月17日 · 指标 2.10.0
Go
rezmoss/sbomlyze
git diff for your SBOM ,compare CycloneDX/SPDX/Syft bills of materials, detect tampering, and gate CI
Apache-2.02026年7月20日 · 指标 2.10.0
Go
draugr-dev/draugr
Developer-first security scanning orchestration — describe your app in one file, run many scanners (SAST, SCA, secrets, IaC, containers, headers), get one SARIF verdict for CI & code scanning.
Apache-2.02026年7月19日 · 指标 2.10.0
Go
jitpass/jit
Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first.
自定义许可证2026年9月5日 · 指标 2.10.0
Go
TomTonic/extract-sbom
Sandboxed SBOM extraction from arbitrary artifacts. Outputs traceability records and CycloneDX JSON for automation, auditability, and supply chain security.
BSD-3-Clause2026年7月21日 · 指标 2.10.0
PyPI · npm
gautamvarmadatla/mcpsafetywarden
MCP servers expose tools with no information about what they actually do at runtime. mcpsafetywarden sits between your agent and any MCP server, profiling tool behavior, blocking destructive calls, and running active security audits before you trust them in a workflow.
自定义许可证2026年8月1日 · 指标 2.10.0