syft
anchore/syftCLI tool and library for generating a Software Bill of Materials from container images and filesystems
container-escapecontainer-securitydevsecops+3
9.5k
anchore/syftCLI tool and library for generating a Software Bill of Materials from container images and filesystems
anchore/grypeA vulnerability scanner for container images and filesystems
jedisct1/minisignA dead simple tool to sign files and verify digital signatures.
iqtlabs/auraborealisappDo You Know What's In Your Python Packages? A Tool for Visualizing Python Package Registry Security Audit Data
gitleaks/gitleaksFast, open-source static analysis tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repositories, files, and stdin…
bridgecrewio/checkovStatic analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…
zizmorcore/zizmorStatic analysis tool for CI/CD systems that detects and fixes security issues in GitHub Actions, Dependabot, and pre-commit configurations, including…
asamassekou10/ship-safeCLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and…
datadog/guarddog🐍 🔍 GuardDog is a CLI tool to Identify malicious PyPI and npm packages
murphysecurity/murphysecAn open source tool focused on software supply chain security. 墨菲安全专注于软件供应链安全，具备专业的软件成分分析（SCA）、漏洞检测、专业漏洞库。
google/capslockCLI tool for analyzing Go package capabilities by tracing transitive calls to privileged standard library operations, enabling supply chain risk…
visma-prodsec/confusedTool to check for dependency confusion vulnerabilities in multiple package management systems
prismorsec/prismorSelf-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt…
ossillate-inc/packjStatic and dynamic analysis tool that audits open-source packages for malicious, vulnerable, and risky attributes, with sandboxed installation to…
backbay-labs/clawdstrikePolicy engine and EDR for AI agent fleets and developer workstations. Monitors tool calls, file access, network flows, and process execution with…
getagentseal/agentsealSecurity toolkit for AI agents. Scan your machine for dangerous skills and MCP configs, monitor for supply chain attacks, test prompt injection…
heroku/terrierTerrier is a Image and Container analysis tool that can be used to scan Images and Containers to identify and verify the presence of specific files…
praetorian-inc/trajanA multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.