anchore/syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
A star delta has been computed for 62,252 of 63,106 tracked repositories in this period, and only those can be ranked in it.
A repository missing here has not been measured far enough back yet. That does not mean it did not move.
Star counts measured between 00:48 and 16:49 (BKK).
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
The Airgap Native Package Manager for Kubernetes
Make production Rust binaries auditable
GUAC aggregates software security metadata into a high fidelity graph database.
IoT firmware identification and extraction
Author, generate, validate and govern AI agent rules, skills, plugins and MCP configuration across 52 coding assistants. Review with verified model evidence, evaluate skills, lock and sign dependencies, and publish bundles. CLI, MCP server and Go API.
IoT static scanner for secrets, SBOM, CVEs and more.
ReARM - Release Governance Platform
A suite of tools to automate software compliance checks.
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
A utility to generate SPDX-compliant Bill of Materials manifests
Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
A secure, high-performance, multi-tenant platform for remote App ”Hosting“ and ”Computing“
🎁 snapshot every package on your machine to one file, restore it on a new one
The System Package Data Exchange (SPDX) specification in Markdown and HTML formats.
Git-native collaboration platform
Trusted builds made easy! A cloud-native software factory for building, testing, and releasing trusted software artifacts
Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.
A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.
A license scanner for container images and filesystems.
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
Scans your project to determine what components you use
Catalogue all images of a Kubernetes cluster to multiple targets with Syft
blint is a Binary Linter that checks the security properties and capabilities of your executables. It can also generate a Software Bill-of-Materials (SBOM) for supported binaries.
CycloneDX SBOM Model and Utils for Creating and Validating BOMs
Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects
Semantic SBOM/CBOM/AI-BOM diff, quality scoring, and compliance validation for CycloneDX/SPDX — component, license, and vulnerability change analysis, cryptographic inventory grading, PQC readiness (CNSA 2.0, NIST IR 8547), and regulatory gates for NTIA, FDA, EU CRA, BSI TR-03183, EUCC, SSDF, EO 14028, and the EU AI Act.
Showing 30 of 36 repositories