Slsa Python Packages

ozi

Python project packaging for Meson.

49K 4 2

agtmls

Signed, audited registry of agent skills (SKILL.md) for Claude Code, OpenAI Codex, Aider and Antigravity: verified installs, a prompt-injection and supply-chain audit with SARIF, a signed index, signed in-toto attestations, and with/without evals that measure whether a skill helps. Stdlib-only Python CLI, agtmls-spec L5.

6K 1 0

polaris-oid4vp

Polaris ID: identity infrastructure built to be checked, not trusted. polaris-oid4vp 1.0.0rc7 is OpenID Certified (OpenID4VP 1.0 + HAIP 1.0 Verifier), tested against 14 outside implementations. ML-DSA-65 under an audited algorithm-migration path; issuer-unlinkable, duress-aware. Pre-pilot.

5K 5 0

polaris-verify

4K 5 0

polaris-sdk-python

3K 5 0

ansible-security-scanner

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

2K 10 1

aga-governance

Signed decision records for agent vendors facing customer evidence reviews. Public reference gateway and static verifier; pre-pilot, with documented limits.

1K 0 0

pwned-deps

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed, --min-age cooling-off gate, exit 4 when a scan is incomplete. SLSA L3, Sigstore-signed feed.

878 164 154

inclusio

Accessibility-first publishing engine — PDF/UA-2 + WTPDF + PDF/A-4f, C2PA + PAdES + SLSA provenance, multi-format emission, MCP server.

712 0 0

capa-language

A capability-typed language that emits machine-verifiable supply-chain SBOMs by construction: per-function CycloneDX, SPDX, VEX and SLSA artefacts that match the code, not a scanner's guess.

676 3 0

legal-text-mcp-de

MCP server, HTTP API & CLI for German federal/state legal texts (BGB, DSGVO, …) with canonical IDs and cite-grade source provenance.

541 2 1

kinegrant-protocol

Reference implementation of KineGrant, an authorization and accountability layer for physical AI

429 100 1

rung-ai

Did your AI agent run what it says it verified, or only claim it did?

388 0 0

polaris-id-cli

Polaris ID: identity infrastructure built to be checked, not trusted. polaris-oid4vp 1.0.0rc7 is OpenID Certified (OpenID4VP 1.0 + HAIP 1.0 Verifier); tested against 15 outside implementations, and one wallet project runs its verifier in CI daily. ML-DSA-65 under an audited algorithm-migration path; issuer-unlinkable, duress-aware. Pre-pilot.

369 5 0

umbra-core

Agent-agnostic change-control plane for coding agents. Govern Claude Code, Codex, Cursor, or any agent behind one admission pipeline — prove every change with a signed receipt.

359 1 5

ossguard

OSSGuard Python implementation — reference CLI with Rich UI (pip install ossguard)

260 2 0

squash-ai

🛡️ Automated EU AI Act compliance for AI/ML teams — Annex IV docs, SBOMs, policy checks, and signed audit records inside your CI/CD pipeline. August 2, 2026 enforcement deadline. ⏰

167 2 0

proofx

ProofX v0.4 — Execution proof protocol: claim → evidence → proof → verification. 102-case conformance, Go/WASM/Rust CLI + GitHub Action. Protocol frozen.

137 1 0

opentemplate

All-in-one Python template. One click. Everything included.

101 42 1

secretgenerator-py

Auditable CSPRNG-backed credential generator for AI agents and machine-readable pipelines. Stable JSON schema, NIST entropy floors, SLSA 3 + cosign signed releases. CLI, Go/Python/Rust libs, MCP server.

98 9 2

mechlab-sdk

Mechanistic interpretability that ships: MAIR-backed evidence bundles, receipts, and comparison packets.

43 0 1