Supply chain security

Nono is a zero-latency, zero-setup sandbox for running AI agents securely across macOS, Linux, and Windows. It enforces least-privilege isolation by...

Bumblebee is a read-only inventory scanner for developer machine metadata across package managers, extensions, and MCP configs on macOS and Linux,...

Tirith is a terminal security tool written in Rust that intercepts and blocks malicious commands before execution, protecting against homograph...

VET is a supply chain security tool that detects malicious open source packages through static and dynamic analysis, with policy-as-code enforcement...

Harden-Runner is a runtime security monitoring agent for GitHub Actions CI/CD runners that detects threats in real-time by monitoring network egress,...

npq is a command-line tool that audits npm packages before installation by checking against CVE databases, analyzing package metadata (age,...

GUAC aggregates software security metadata (SBOMs, attestations, vulnerability data) into a queryable graph database to enable supply chain...