47,133 repositories indexed
1–21 of 21 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
Software Supply Chain Transparency Log
Protect against malicious open source packages 🤖
in-toto is a framework to protect supply chain integrity.
Verify that the PowerPoint you are about to deliver is exactly the PPTX that passed QA—locally, offline, and with tamper-evident evidence.
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Catch risky npm dependency changes before they merge.
NPMscan MCP Plugin
Docker Scout CLI
Self-hosted artifact registry and pull-through cache in one binary. 17 formats: Docker/OCI, Maven, npm, PyPI, Cargo, Go, Raw, RubyGems, Terraform, Ansible Galaxy, NuGet, Pub, Conan, CPAN, RPM, Debian/APT, Hugging Face. No database, about 15 MB RAM idle, supply-chain curation built in.
Overlay is a browser extension helping developers evaluate open source packages before picking them
Self-hosted artifact repository manager written in Rust. Hosts, proxies and groups 30+ formats: Docker/OCI, Maven, npm, PyPI, Cargo, Go, Helm, NuGet, Hugging Face, Terraform and more. PostgreSQL for metadata, blob stores on disk or S3. An open-source alternative to Nexus and Artifactory.
Supply Chain Security Research - Living Off The Pipeline tools
Your users download a 4GB AI model, the connection drops at 3.8GB, verifyfetch resumes from 3.8GB and verifies every byte. Drop-in integrity verification for Transformers.js, WebLLM, and any large file in the browser.
A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.
Find which of your direct GitHub dependencies is susceptible to RepoJacking attacks
Security training for the apps you actually ship. Open your browser and start hacking.
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Encrypted .env files with TOTP unsealing for production deploys. Cross-stack (Node + Java). Zero deps. Defends against npm supply-chain attacks.
Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.