47,133 repositories indexed
1–6 of 6 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Protect against malicious open source packages 🤖
Self-hosted artifact registry and pull-through cache in one binary. 17 formats: Docker/OCI, Maven, npm, PyPI, Cargo, Go, Raw, RubyGems, Terraform, Ansible Galaxy, NuGet, Pub, Conan, CPAN, RPM, Debian/APT, Hugging Face. No database, about 15 MB RAM idle, supply-chain curation built in.
Self-hosted artifact repository manager written in Rust. Hosts, proxies and groups 30+ formats: Docker/OCI, Maven, npm, PyPI, Cargo, Go, Helm, NuGet, Hugging Face, Terraform and more. PostgreSQL for metadata, blob stores on disk or S3. An open-source alternative to Nexus and Artifactory.
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Encrypted .env files with TOTP unsealing for production deploys. Cross-stack (Node + Java). Zero deps. Defends against npm supply-chain attacks.