Supply Chain Python Packages

pip-audit

Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them

sigstore

A Sigstore client written in Python

ai-rulez

Standards-compliant lifecycle tool for agent knowledge and capabilities: author, generate, bundle, validate, govern, publish.

in-toto

in-toto is a framework to protect supply chain integrity.

model-signing

Supply chain security for ML

acid-judge

Acid Judge: fail-closed gate for a locked Python-tool body. Catches file swap between lock and judge. Not a sandbox, not an OS.

package-doctor

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS. Runs in CI and as a Claude Code hook.

skjold

Security audit Python project dependencies against security advisory databases.

taintrace

Typosquat detector for AI coding agent dependencies

govp

GOVP Protocol — independently verifiable digital artifacts with Ed25519.

ochrona

A command line tool for detecting vulnerabilities in Python dependencies and doing safe package installs

aetherx-mcp

MCP server for the Aether-X Port Congestion Oracle - predictive port congestion signals for AI agents

mcp-pin

You approve an MCP server. Heldfast records what you approved. Later it tells you what moved, and guard refuses the rest.

stockpyl

Python inventory optimization and simulation tools.

toolprint

What your agent's tool surface costs, and what it can do. Offline MCP assessment: context cost, capability risk, and definition drift.

ghostpkg

Catch AI-hallucinated package names before you install them

dep-rank

Rank a GitHub project's dependents by stars or trust — CLI that scrapes dependents and enriches via GraphQL.

aetherx-oracle

Python SDK for the Aether-X Port Congestion Oracle API - predictive port congestion signals (sync + async)

ospac

OSPAC - Open Source Policy as Code

otterdog

OtterDog is a tool to manage GitHub organizations at scale using a configuration as code approach. It is actively used by the Eclipse Foundation to manage its numerous projects hosted on GitHub.

lockstep-evidence

Does what's actually installed match the lockfile? Runtime dependency drift, not a commit-time CVE scan

jittest

Differential test-execution gate for agent-authored pull requests. Emits Ed25519-signed receipts you can re-verify without trusting the tool.

ossiq

OSS IQ uses MSR-driven analysis tool to track versions lag and dependencies health at scale. Move from reactive CVE-chasing to a planned, predictable maintenance rhythm.

blastradius-mcp

Cross-repo infrastructure memory for coding agents — knows who else depends on an artifact before you change it, and watches your pins for CVEs.