#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
aikidosec/safe-chainProtect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.
navikt/cpltSandbox for AI coding agents. Runs Copilot CLI, Claude Code, OpenCode, Gemini CLI, Antigravity, Pi, goose or a plain shell inside a kernel-level…
dependencytrack/dependency-trackIntelligent Component Analysis platform that leverages SBOMs to identify and reduce software supply chain risk through continuous vulnerability…
alegrey91/vex8sSuppress vulnerabilities applying Kubernetes context to scans
dependency-check/dependencycheckOWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
hotcakex/harden-windows-securityHarden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build…
nationwide-group-oss/cryptopticCodeQL-based scanner that inventories cryptographic function calls across repositories and GitHub organizations, producing a Cryptographic Bill of…
vpierre/ndaal_public_sbom_auditorOffline single-binary web app that ingests CycloneDX, SPDX and syft SBOMs, runs an ensemble of CVE scanners, enriches findings with EPSS, CISA-KEV…
theupdateframework/python-tufPython reference implementation of The Update Framework (TUF)
secure-systems-lab/securesystemslibCryptographic and general-purpose routines for Secure Systems Lab projects at NYU
google/capslockCLI tool for analyzing Go package capabilities by tracing transitive calls to privileged standard library operations, enabling supply chain risk…
cisco-ai-defense/skill-scannerSecurity Scanner for Agent Skills
cosai-oasis/ws4-secure-design-agentic-systemsRepository for CoSAI Workstream 4, Secure Design Patterns for Agentic Systems
guacsec/guacAggregates software supply chain security metadata (SBOMs, attestations, vulnerabilities) into a queryable graph database for audit, policy, and risk…
trailofbits/skillsTrail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows
zizmorcore/zizmorStatic analysis tool for CI/CD systems that detects and fixes security issues in GitHub Actions, Dependabot, and pre-commit configurations, including…
owasp-dep-scan/dep-scanNext-generation dependency vulnerability scanner with reachability analysis, SBOM generation, license audit, and container image scanning for CI/CD…
knostic/openantOpenAnt from Knostic is the leading open source LLM-based vulnerability discovery product, helping defenders proactively find verified security flaws…
