Supply Chain Python Packages

pip-audit

Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them

sigstore

A Sigstore client written in Python

in-toto

in-toto is a framework to protect supply chain integrity.

ochrona

A command line tool for detecting vulnerabilities in Python dependencies and doing safe package installs

model-signing

Supply chain security for ML

repo-proofer

Find out if a repo will steal your keys before you run it. Zero-network sandbox + strace exfil detection. 100% deterministic, no AI. `uvx repo-proofer <url>

skjold

Security audit Python project dependencies against security advisory databases.

stillrunning

Enterprise security and monitoring for developers. pip install stillrunning

stockpyl

Python inventory optimization and simulation tools.

ospac

OSPAC - Open Source Policy as Code

pinlint

Static linter that checks a requirements file is fully version-pinned and hash-pinned, for CI and pre-commit.

otterdog

OtterDog is a tool to manage GitHub organizations at scale using a configuration as code approach. It is actively used by the Eclipse Foundation to manage its numerous projects hosted on GitHub.

actionscope

Map the AWS blast radius of GitHub Actions workflows. Detects compromised actions, OIDC misconfigurations, script injection, and privilege escalation paths.

sbom-cyclonedx-mcp

SBOM CycloneDX 1.6 + SPDX 2.3. EO 14028 / NIS2 / CRA. Part of the CSOAI Layer-0: 8 protocols · 100/100 A+++++ · world-leading.

dep-rank

Rank a GitHub project's dependents by stars or trust — CLI that scrapes dependents and enriches via GraphQL.

hvtracker-mcp

MCP server for HVTracker trust checks.

openclaw-skill-vetter-mcp

MCP server for security-vetting third-party AI agent extensions before installation — Claude skills, plugins, tool packs. 41 detection rules across prompt-injection, exfiltration, dynamic execution, typosquats. 0-100 risk score.

dfx-mcp-scanner

Security scanner for MCP (Model Context Protocol) servers - detects malicious tools, data exfiltration, and supply chain risks before connecting to your AI agent.

ossguard

OSSGuard Python implementation — reference CLI with Rich UI (pip install ossguard)

tridentchain-mcp

Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.

oss-red-flag-checker

Check remote repositories for typical red flags like CLAs and risks due to low development activity

gitxray

A multifaceted security tool which leverages Public GitHub REST APIs for OSINT, Forensics, Pentesting and more.

tridentchain-security

Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.

openpartslibrary

Build machines faster with cheap standard components and ready-to-use CAD files.