NVIDIA / SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
graygnatconsole / mcp-audit-tool
🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI ready.
nolabs-ai / nono
agent runtime security - zero trust, zero setup, zero latency agent sandboxing
threathunterX / underground-slang-lexicon
A continuously updated lexicon of underground slang in the online fraud and gray-market economy: definitions, supply-chain roles, sanitized real-world usage and false-positive warnings. Chinese-dominant, with Brazilian Portuguese, English, Indonesian, Tagalog and Vietnamese entries. Maintained by the Threat Hunter research team.
MaxHu-xuan / artifactproof
Verify that the PowerPoint you are about to deliver is exactly the PPTX that passed QA—locally, offline, and with tamper-evident evidence.
fleetbase / fleetbase
Modular logistics and supply chain operating system (LSOS)
step-security / harden-runner
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
hashgraph-online / hol-guard
Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.
scadastrangelove / awesome-ai-security-tools
A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.
nominal-io / instro
An open-source library for hardware test instrumentation
DependencyTrack / dependency-track
Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
muxuuu / serenity-skill
Serenity-inspired Agent Skill for supply-chain bottleneck stock research
frePPLe / frepple
frePPLe - open source supply chain planning
boostsecurityio / poutine
poutine, a supply chain vulnerability scanner for build pipelines
AnmuProtocol / docs
**Anmu** (安幕) is a funding protocol on BNB Smart Chain. A reviewed creator registers a public campaign and a fixed-supply token. The campaign record stores three commitments. Donations, trades, allocations, and proof checks are public.
Noob-stupid / dsh-plugin-gating-hub
DSH plugin - framework upgrade safety & plugin gating: contract pre-check, rollback point, auto-rollback on failure, evidence-based auto-disable; plus a multi-source plugin market. Unofficial. | DSH 插件：框架升级安全 + 插件门控——升级前契约预检、回滚点、失败自动回滚、有确证证据才自动禁用；另带多源插件市场。非官方社区项目。
wivi514 / Dead_Rising_2_Case_Zero_Xenon_Recomp
Native PC port of the Xbox 360 XBLA game Dead Rising 2: Case Zero, by static recompilation. Windows and Linux, Vulkan, keyboard/mouse and controller. You supply your own copy of the game.
wivi514 / Dead_Rising_2_Case_West_Xenon_Recomp
Native PC port of the Xbox 360 XBLA game Dead Rising 2: Case West, by static recompilation. Windows and Linux, Vulkan, keyboard/mouse and controller. You supply your own copy of the game.
irpina / elekloader
A mod loader for Elektron firmware. You pick mods and supply the stock OS file Elektron publishes for your device. elekloader builds a custom OS file on your own machine, and you flash it the way you flash any OS update.
perplexityai / bumblebee
Read-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.
GreaterWMS / GreaterWMS
This Inventory management system is the currently Ford Asia Pacific after-sales logistics warehousing supply chain process . After I leave Ford , I start this project . You can share your vacant warehouse space, use it for those in need, and generate income
sheeki03 / tirith
Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.
slsa-framework / slsa
Supply-chain Levels for Software Artifacts
lirantal / npq
safely install npm packages by auditing them pre-install stage
guacsec / guac
GUAC aggregates software security metadata into a high fidelity graph database.
jealous / stockstats
Supply a wrapper ``StockDataFrame`` based on the ``pandas.DataFrame`` with inline stock statistics/indicators support.
pypa / pip-audit
Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
ossf / best-practices-badge
🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)
owasp-dep-scan / dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
thieu1995 / mealpy
A Collection Of The State-of-the-art Metaheuristic Algorithms In Python (Metaheuristic/Optimizer/Nature-inspired/Biology)
DataDog / guarddog
:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
sigstore / rekor
Software Supply Chain Transparency Log
apache / ofbiz-framework
Apache OFBiz is an open source product for the automation of enterprise processes. It includes framework components and business applications for ERP, CRM, E-Business/E-Commerce, Supply Chain Management and Manufacturing Resource Planning. OFBiz provides a foundation and starting point for reliable, secure and scalable enterprise solutions.
safedep / vet
Protect against malicious open source packages 🤖
cdxgen / cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
endojs / endo
Endo is a distributed secure JavaScript sandbox, based on SES
mozilla / cargo-vet
supply-chain security for Rust
openpubkey / openpubkey
Reference implementation of OpenPubkey
toby-bridges / api-relay-audit
Local security audit for AI API relays and LLM proxies: detects prompt injection, model substitution, tool-call rewriting, SSE anomalies, error leakage, and Web3 wallet risks.
asamassekou10 / ship-safe
The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.
bodadotsh / npm-security-best-practices
[Updated for AI 🤖] Continuous updates on how to stay safe from NPM supply chain attacks
theupdateframework / go-tuf
Go implementation of The Update Framework (TUF)
chainguard-dev / malcontent
#supply #chain #attack #detection
chainloop-dev / chainloop
Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.
rubyforgood / human-essentials
Human Essentials is an inventory management system for diaper, incontinence, and period-supply banks. It supports them in distributing to partners, tracking inventory, and reporting stats and analytics.
CycloneDX / specification
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX
safedep / pmg
PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
in-toto / witness
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
sigstore / sigstore
Common go library shared across sigstore services and clients
elastic / supply-chain-monitor
—
Hoylon / peerbridge-mcp
Local-first, auditable multi-agent control room for coding, review, evidence, and private remote work.
atomdrift-project / scan
0-day malware detection for binaries, source & scripts (that doesn't suck)
AnmuProtocol / landing-page
Public site for **Anmu** (安幕). This package is a single page. It explains the protocol to someone who has not opened a campaign record: a fixed-supply token, a zero-knowledge authorization, a public payment, and two launch products. English and Chinese.
liyuqin606-del / packrehearsal
Turn npm, Python, and Rust release evidence into bounded Codex maintenance tasks.
Mah3Sec / ForgeGuardian
Local-first, AI-native Software Supply Chain Security Platform
NocodeMrLi / mini-program-engineering-skill-suite
Mini Program Engineering Skill Suite is an Agent Skill suite for evidence‑first mini‑program development. It helps agents bring WeChat or other mini‑program projects from vague intent to reliable engineering work: project intake, product specification, architecture, implementation, UI & device adaptation, debugging, verification, release readiness.
ciceroyang / agentgate
Control plane for the tools agents run: inventory, evidence, policy, enforcement. Clean is only emitted when every check ran. · agent 工具层的控制面：清单、证据、策略、执行；只有每个检查都跑完，才会给出 clean。
Whispergate / SCADAVER
SCADAver: a Rust-powered, multi-protocol OT/ICS security framework for authorized labs featuring asset discovery, enumeration, controlled validation, simulators, and CLI, TUI, and web interfaces. Discover validate, and try not to cut off the water supply.
Yutong0711 / PARAPET
Turn a security or performance exposure into a reviewable decision
limingrui679-design / CascadeLens
Python-first systemic-risk research software for evidence-graded, bitemporal dependency graphs. Import JSON, CSV, GraphML, or NetworkX; run bounded shocks, compare constrained interventions and sensitivity surfaces, and export recomputation-verifiable RiskPacks. Includes 16 scenario-only cases and 11 connector contracts.