Software Supply Chain Python Packages

dependency-check

:closed_lock_with_key: Shim to easily install OWASP dependency-check-cli into Python projects

factoryline-code-factory

Evidence-first audits for AI-generated code: prove tests can fail, catch security and release gaps, and ship reviewable receipts across VS Code, JetBrains, CI, MCP, and App Store workflows.

trustsight

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then produces a deterministic evidence report.

zft

ZFT (Zero-Friction Traceability) — contract-grounded verification and trace matrix gates for multi-agent work

matrixscroll

Open protocol and MCP server for signed machine-action records, offline verification, sealed evidence packs, and device-agnostic custody.

pmsec

Zero-config supply-chain hardening.

knowing

Permanent code intelligence layer. Learns what matters, expires what changed, proves what existed. Content-addressed graph with Merkle proofs, 25 extractors, 23 MCP tools. Gets smarter with use.

importspy

Policy-as-code admission for Python modules and dependencies. Inspect before execution, enforce runtime and supply-chain policies, and produce evidence-backed ADMIT/DENY decisions.

extuno

Assess a Python package for supply-chain risk before pip installs it. Pre-install gate for pip with sandbox-backed verdicts, SARIF output and CI exit codes.

opentrustbench

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero telemetry.

scopeledger

Evidence-backed command scope gates and independently verifiable PASS/HOLD/STOP receipts for coding-agent workflows.

ladex

A bill of lading for AI: shift-left AI governance and ML-BOM generation for developers.

gateshield

Policy-driven security orchestration for hardened CI/CD pipelines

scrollcase-consumer

Pack entire environments as self-contained boxes (eg. an AI Model). Pinned, validated, signed and air-gappable, for macOS Metal, Linux and Windows (CPU and CUDA).

i18n-security-lint

Closing the localization gap in open source: evidence on how Indic and other under-served locales get reviewed upstream, plus i18n tooling — including i18n-security-lint, a CI scanner for defects in translated strings.

spira-trust

Offline local trust gate for Python wheel artifacts

csaf-check

Python API and CLI for CSAF 2.0 and VEX validation using Secvisogram's validator, with CI-friendly unavailable-validator handling.

scpe-protocol

Verifiable provenance for digital artifacts. Prove who made a contribution and that nothing was tampered with - offline, no server, no accounts.

agent-engineering-toolkit

Proof-carrying workflows for coding agents: bind tests to exact code, detect stale evidence, review scope, and hand proof across agents.

sorb

Dependency analysis and SBOM generation for code, containers and binaries

belgi

Bounded Python reference distribution for replaying finite software-change review records and checking conformance.

repro-evidence-kit

Reproducible artifact manifests, sandbox-output verification, and evidence-bundle validation for artifact-heavy workflows.

sbom-evidence-fusion

Evidence-backed SBOM dependency graph repair and uncertainty-aware reachability