Sarif Python Packages

csp-toolkit

Content Security Policy analysis, bypass detection, and CI gating. 21 weakness checks with A+ to F grading, 79 known bypass domains, SARIF output, and a GitHub Action.

1.6M 11 0

lintrunner-adapters

Adapters and tools for lintrunner

772K 6 6

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

69K 9 1

agent-audit-kit

Static scanner for MCP-connected AI agent pipelines. 388 rules across 14 categories, 14 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to-rule ledger.

22K 12 0

jscpd

Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.

17K 6K 267

mcp-migrate

Find and fix what the MCP 2026-07-28 spec revision breaks in your server. 21 rules, 19 of them with fixers, and a readiness board.

16K 12 45

docguard-cli

Audit and enforce canonical project documentation for AI-assisted development. Detect drift, validate specs, and brief agents. Part of the Guard family with TestGuard and WebSec Validator.

15K 32 1

skilltotal

Claude Code plugin that scans a package before the agent runs npx, npm install, pip install, uvx or claude mcp add. Malicious indicators block the install. High-risk packages need your approval. The scan runs on your machine and never executes the code or calls an LLM. Every finding cites a file and line. Also a CLI, GitHub Action and MCP server.

14K 11 0

compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

13K 60 6

thailint

Catch the mistakes AI coding assistants keep making. A multi-language linter for AI-generated code: duplicate code, deep nesting, magic numbers, SRP violations and more, across Python, TypeScript, JavaScript and Rust.

12K 24 3

airom

Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.

10K 16 4

package-doctor

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS. Runs in CI and as a Claude Code hook.

9K 24 0