#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
microsoft/applicationinspectorA source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using…
vercel-labs/fix-react2shell-nextOne command to fix CVE-2025-66478 (React 2 Shell RCE) in your Next.js / React RSC app.
specterops/githoundBloodHound OpenGraph collector for GitHub that maps organization structure, permissions, and cross-cloud attack paths into a navigable graph for…
murphysecurity/murphysecAn open source tool focused on software supply chain security. 墨菲安全专注于软件供应链安全，具备专业的软件成分分析（SCA）、漏洞检测、专业漏洞库。
elastic/supply-chain-monitorAutomated supply chain security monitor that polls PyPI and npm registries, diffs new releases against predecessors, and uses LLM analysis to detect…
xiaoqimikko/jetty-line-checkCVE-2026-2332 and 4 more 2026 Jetty CVEs: which does your Jetty (or Spring Boot) build hit, and does the fixed version Jetty names even exist on…
promptfoo/modelauditSecurity scanner for AI/ML model files. Detects malicious code, backdoors, and vulnerabilities before deployment
george0papasotiriou/cve-2026-1122-iot-firmware-update-signature-bypass-via-low-order-point-injectionDemonstrates CVE-2026-1122 Ed25519 signature bypass via low-order point injection, forging malicious IoT firmware updates with Python and C verifier…
pyupio/safetySafety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.
zizmorcore/zizmorStatic analysis tool for CI/CD systems that detects and fixes security issues in GitHub Actions, Dependabot, and pre-commit configurations, including…
nolabs-ai/nonosecure multiplexed execution paths for agents - zero trust, zero setup, zero latency.
luckypipewrench/pipelockOpen-source AI agent firewall that scans HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, emitting verifiable…
tomjwxf/scopeblind-gatewaySecurity gateway for MCP servers with per-tool policy enforcement, Ed25519-signed audit receipts, and shadow-mode logging. Supports Cedar, OPA, and…
sourcegraph/log4j-cve-code-search-resourcesUsing code search to help fix/mitigate log4j CVE-2021-44228
ohaswin/pyscanpython dependency vulnerability scanner, written in Rust.
thedevappsecguy/log4j-mitigation-cve-2021-44228--cve-2021-45046--cve-2021-45105--cve-2021-44832Log4J CVE-2021-44228 : Mitigation Cheat Sheet
9pings/fad-checkerBuildless dependency auditor that scans 10 ecosystems offline, reporting CVEs prioritized by CISA KEV and EPSS, EOL packages, licenses, committed…
hashgraph-online/hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at…
