Sarif Python Packages

lintrunner-adapters

Adapters and tools for lintrunner

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

skills-orchestrator

Open-source SkillOps / instruction-supply-chain control plane for AI-agent teams: policy packs, registry diff, evidence bundles, SARIF/SBOM, adapters, and MCP runtime.

compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

ai-bom

AI Bill of Materials — discover every AI agent, model, and API in your infrastructure

skilltotal

Scan AI components (MCP servers, agent skills, npm/PyPI packages) for malware & risky capabilities. Local, deterministic, evidence-anchored. Free & OSS.

agent-bom

AI supply-chain & cloud security scanner and self-hosted control plane — agents, MCP, packages, cloud estate, non-human identities, and LLM cost. SBOM/SARIF, graph attack-paths, runtime enforcement, and compliance evidence.

ansible-security-scanner

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

godot-mobile-ui-doctor

Godot CI and release evidence tools for maintainers.

godot-release-dashboard-kit

Godot CI and release evidence tools for maintainers.

godot-export-preset-doctor

Godot CI and release evidence tools for maintainers.

docguard-cli

The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. Zero dependencies.

godot-scenario-report-kit

Godot CI and release evidence tools for maintainers.

ansede-static

Offline SAST that detects IDOR, missing authentication, and ownership bypass. OWASP recall 62%, CVE recall 96.3% across 5 languages. Beats Semgrep OSS on recall.

godot-asset-pipeline-doctor

Godot CI and release evidence tools for maintainers.

glassport

Wire-level observability and enforcement for MCP servers: passive stdio tap, behavioral detectors, drift watch, and static audit — with SARIF for the GitHub Security tab. Zero dependencies, Python 3.10+.

impactguard

ImpactGuard — Lightweight multi-language API impact analyzer

apisec-ai-surface

Find and govern AI attack surfaces in application code at PR time. Free, OSS, runs offline.

godot-mobile-perf-doctor

Godot CI and release evidence tools for maintainers.

agent-audit-kit

Static scanner for MCP-connected AI agent pipelines — 225 rules across 11 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.

redteam-mcp

Active red-teaming for MCP servers. Source analysis + live exploitation + auto-fix. Claude Code plugin.

godot-runtime-telemetry-lab

Godot CI and release evidence tools for maintainers.

godot-pack-mod-doctor

Godot CI and release evidence tools for maintainers.

godot-save-schema-guard

Godot CI and release evidence tools for maintainers.