anchore/syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
A star delta has been computed for 62,678 of 63,382 tracked repositories in this period, and only those can be ranked in it.
A repository missing here has not been measured far enough back yet. That does not mean it did not move.
Star counts measured between 02:16 and 21:49 (BKK).
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Author, generate, validate and govern AI agent rules, skills, plugins and MCP configuration across 52 coding assistants. Review with verified model evidence, evaluate skills, lock and sign dependencies, and publish bundles. CLI, MCP server and Go API.
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
GUAC aggregates software security metadata into a high fidelity graph database.
Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.
Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects
📜 Cargo plugin to generate list of all licenses for a crate 🦀
A utility to generate SPDX-compliant Bill of Materials manifests
A suite of tools to automate software compliance checks.
🎁 snapshot every package on your machine to one file, restore it on a new one
The System Package Data Exchange (SPDX) specification in Markdown and HTML formats.
Automate copyright headers and license files at scale
Ruby gem & CLI to detect a project's open source license (SPDX) from LICENSE files, package manifests, and READMEs
CycloneDX SBOM Model and Utils for Creating and Validating BOMs
Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects
Semantic SBOM/CBOM/AI-BOM diff, quality scoring, and compliance validation for CycloneDX/SPDX — component, license, and vulnerability change analysis, cryptographic inventory grading, PQC readiness (CNSA 2.0, NIST IR 8547), and regulatory gates for NTIA, FDA, EU CRA, BSI TR-03183, EUCC, SSDF, EO 14028, and the EU AI Act.
sbomqs: The Comprehensive SBOM Quality & Compliance Tool
Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects
ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!
That's all 20 repositories in this period.