#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
hashgraph-online/hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at…
9pings/fad-checkerBuildless dependency auditor that scans 10 ecosystems offline, reporting CVEs prioritized by CISA KEV and EPSS, EOL packages, licenses, committed…
santhreal/keyhogOpen-source secret scanner in Rust
xiaoqimikko/async-http-client-checkSelf-hosted AI workspace with agents, skills, and tools (Gmail, Calendar) that runs entirely on your own provider API keys (BYOK). Bring your own…
akanthed/secureai-scanSecureAI-Scan is a CLI tool that scans TypeScript and JavaScript codebases for security issues specific to AI-powered apps — prompt injection, MCP…
ossf/allstarGitHub App to set and enforce security policies
adibirzu/openclaw-security-monitorProactive security monitoring for OpenClaw deployments. Detects ClawHavoc, AMOS stealer, CVE-2026-25253, memory poisoning, and supply chain attacks.
qubesos/qubes-secpackCurated repository of Qubes OS security bulletins, canaries, PGP keys, and ISO digests, with authenticated verification via git tags and detached…
safedep/pmgPMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
trailofbits/ficklingA Python pickling decompiler and static analyzer
sigstore/cosignCode signing and transparency for containers and binaries
rxb06/credactorScan. Redact. Commit clean.
anchore/grypeA vulnerability scanner for container images and filesystems
xiaoqimikko/jetty-line-checkCVE-2026-2332 and 4 more 2026 Jetty CVEs: which does your Jetty (or Spring Boot) build hit, and does the fixed version Jetty names even exist on…
mogenius/renovate-operatorOperator to streamline renovate executions in Kubernetes
platanor/hardware-compliance-handbookAI-ready knowledge base of security & compliance regulations for hardware and connected-device manufacturers - structured, indexed, and…
fabriziosalmi/tanstack-compromise-checkerShell script to detect TanStack npm supply chain attack indicators (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx)
moltis-org/moltisA secure persistent personal agent server in Rust. One binary, sandboxed execution, multi-provider LLMs, voice, memory, Telegram, WhatsApp, Discord,…
