Tools
guac
guacsec/guac
GUAC aggregates software supply chain security metadata such as SBOMs, attestations, and vulnerabilities into a unified graph, giving security teams a queryable platform for auditing, policy, and risk analysis.
Topics
Related projects
murphysec1.8kA software supply-chain security CLI that analyzes direct and transitive project dependencies and detects known vulnerabilities, with CI/CD integration.
pip-audit1.4kpip-audit scans Python environments and requirements files for dependencies with known vulnerabilities, with automatic fixes, SBOM output and CI integration.
rekor1.2kRekor is Sigstore's tamper-resistant transparency log for software supply-chain metadata, offering a REST API and CLI to record, query, and verify signed artifacts.
OpenSCA-cli1.1kOpenSCA-cli is a software composition analysis tool that parses dependency manifests across languages to detect vulnerabilities and license issues, generating SBOMs and reports in many formats.
vet1.1kSafeDep vet scans dependencies, GitHub Actions workflows, and AI agent configs for malicious packages, vulnerabilities, and risky patterns. It is a policy-as-code security CLI for supply-chain protection.
nono4.8kA zero-setup sandbox for AI agents that enforces least-privilege filesystem, network and credential policies per profile.