Go
saschagrunert/nri-supply-chain
NRI plugin for supply chain attestation verification.
Apache-2.02026年8月9日 · 指标 2.10.0
全部标签
目录标签
#supply-chain-security
公开记录中带有此标签的全部仓库——标签来自其 GitHub 主题或软件包注册表发布的关键词。健康度量遵循与记录其余部分相同的版本化方法论。
51 条记录
PyPI
b7n0de/proofbundle
Offline cryptographic receipts for AI evaluation results — Ed25519 + RFC 6962 Merkle + optional SD-JWT. Integrity, not truth
MIT2026年7月23日 · 指标 2.10.0
Go
github/actions-lockfile
The authoritative definition of the GitHub Actions dependency lockfile format, plus a Go parser for auditing and verifying the action pins in use across a repo's workflows.
MIT2026年8月3日 · 指标 2.10.0
PyPI · npm
PrismorSec/prismor
Runtime Firewall for AI agents which catches the rogue tool call before it runs. Dangerous commands, secret leaks, prompt injection. For Claude Code, Codex and framework SDKs
Apache-2.02026年7月19日 · 指标 2.10.0
Go
optimuslabs-io/grokpatrol
Open-source, offline forensic scanner CLI tool designed to detect evidence of git repo collection or upload by the Grok Build CLI to xAI infrastructure.
Apache-2.02026年7月18日 · 指标 2.10.0
Go · npm
codeswhat/lookout
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
自定义许可证2026年7月16日 · 指标 2.10.0
crates.io
pulseengine/sigil
Sigil — Supply chain security for WebAssembly. Embedded signatures, Sigstore keyless signing, SLSA provenance. Part of the PulseEngine toolchain.
无许可证2026年8月5日 · 指标 2.10.0
npm
starloghq/index
Vet a package before your AI coding agent uses it — authoritative facts (CVEs, license, maintenance) via an MCP server + CLI. Local, no account.
自定义许可证2026年9月6日 · 指标 2.10.0
Go
tiagosilva07/zyrax-guard
Audit your AI agent configs before you run them — prompt injection, rogue MCP servers, credential-exfil. Plus dependency vetting.
MIT2026年8月28日 · 指标 2.10.0
crates.io
sebastienrousseau/dtt
Rust crate for date, time, and timezone manipulation. Parse, format, validate, and convert RFC 3339 / ISO 8601 with guaranteed round-trip safety.
Apache-2.02026年7月25日 · 指标 2.10.0
Go
famclaw/honeybadger
Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.
MIT2026年7月17日 · 指标 2.10.0
PyPI
sunglasses-dev/sunglasses
Sunglasses for AI agents. Protection layer + neighborhood watch.
MIT2026年8月18日 · 指标 2.10.0
npm
calllint/calllint
Pre-flight risk linting for MCP and agent tools — check the blast radius before your agent runs them.
Apache-2.02026年7月31日 · 指标 2.10.0
Go
Goryudyuma/gomod-cooldown
Delay newly available Go module versions during dependency updates with a temporary local GOPROXY.
MIT2026年7月15日 · 指标 2.10.0
Packagist
andreapollastri/checkpoint
Laravel Security Tool
MIT2026年8月22日 · 指标 2.10.0
Go
Conalh/tofulock
Lock & verify Terraform/OpenTofu module sources by commit digest - the integrity providers get from the native lockfile, but modules don't.
MIT2026年7月27日 · 指标 2.10.0
Go
sairintechnologycom/pkgsafe
Supply-chain firewall for AI coding agents and developers — checks npm/PyPI packages against OSV advisories, typosquat & lifecycle-script heuristics, and your policy before install. Local-first, MCP-native.
MIT2026年7月15日 · 指标 2.10.0
Go · npm
undont/supplyscan
scan JavaScript lockfiles to detect supply chain vulnerabilities and known exploits
MIT2026年7月22日 · 指标 2.10.0
PyPI
zrk222/code-factory
Proof-first software factory for AI-assisted code: specs, adversarial gates, deterministic decisions, and reviewable receipts.
自定义许可证2026年7月17日 · 指标 2.10.0
PyPI
meidielo/aes-256-gcm-python-tool
Reviewable AES-256-GCM educational tool with Argon2id, JSON envelopes, and safe-mode streaming.
MIT2026年7月19日 · 指标 2.10.0
Go
wille/gh-actions-cli
Harden and manage your GitHub Actions: SHA-pin every action, enforce allowlist policies, update interactively, and analyze run health
MIT2026年7月17日 · 指标 2.10.0