47,133 repositories indexed
1–15 of 15 · Most stars
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
Software Supply Chain Transparency Log
Protect against malicious open source packages 🤖
in-toto is a framework to protect supply chain integrity.
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Catch risky npm dependency changes before they merge.
Docker Scout CLI
Supply Chain Security Research - Living Off The Pipeline tools
A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.
Find which of your direct GitHub dependencies is susceptible to RepoJacking attacks
Security training for the apps you actually ship. Open your browser and start hacking.
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Encrypted .env files with TOTP unsealing for production deploys. Cross-stack (Node + Java). Zero deps. Defends against npm supply-chain attacks.
Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.