#supply-chain-security

Sentinel shows what a file would make your AI coding agent do. Static analyzer, merge gate and signed lockfile for CLAUDE.md, AGENTS.md, .cursorrules, hooks and MCP configs.

Open-source server that refuses vulnerable package installs. The backend the refuse CLI shim calls.

Always-on compatibility testing for DeepSeek Harness plugins: exact releases, isolated runners, and fixable upstream issues.

Runtime infrastructure for AI agents — lifecycle, supervision, secrets, and deterministic time-travel replay. Built in Rust.

Offline repo inspection and change review for AI coding agents. Scan instructions, compare saved scans, explain findings, and export local reports.

A Claude Code skill that finds the engineering controls your repository does not have — CI that never runs on pull requests, a check target that quietly rewrites files, a migration with nothing in front of it — and hands back a numbered plan. It changes nothing until you pick.

Claude Code scaffold for building AI platforms securely — agent/LLM security, Kubernetes, SRE, observability, identity, and supply chain, grounded in published framework canon (OWASP, NIST, CIS, SLSA). Data-science lanes included.

The complete security auditor for Claude Code — web, API, mobile, cloud, wireless, code, secrets, dependencies, IaC, containers and LLM apps. Token-optimised, exploitation-ranked, self-updating.

Claude Code plugin marketplace for mlab.sh - threat intelligence & supply-chain security workflows for SOC/DFIR teams

Claude skill to generate Software Bill of Materials (SBOM) with license tracking and supply chain security. Generate SPDX or CycloneDX documents, check dependencies for vulnerabilities and track licenses

Policy-as-code admission controller for AI agent skills and MCP tools. SkillBOM, lockfiles, and supply-chain baselines.

Diff AGENTS.md, CLAUDE.md, Cursor rules and MCP server configs between git refs; flag new MCP servers, widened permissions, removed guardrails and hidden Unicode. TypeScript CLI + GitHub Action.

Audit what your npm dependency tree can execute — lifecycle scripts, binding.gyp, AI-agent hooks, IDE tasks — and answer "am I hit?" in seconds during supply-chain incidents. Local-first, zero telemetry.

My Claude Code toolkit. Currently guard: hooks that scan agent-driven package installs before they run.

Third-party and software supply chain risk assessment of the 2026 open-source compromise wave (Trivy, Bitwarden, Checkmarx → OpenAI/Vercel downstream). Full GRC workflow: methodology, risk register, NIST CSF 2.0 / ISO 27001 / SP 800-161 control mapping, TPRM program response, KRIs, and board briefing. OSFI B-10/B-13 context.

Measuring how often, and how reproducibly, LLMs hallucinate package names that don't exist — the slopsquatting supply-chain attack surface. Phase 1: detection and measurement only, read-only against PyPI/npm.

Integrity monitoring for the files your AI coding agent obeys — detects drift, invisible characters, bidi controls, and homoglyphs in CLAUDE.md, .cursorrules, settings.json and friends.

Chrome extension: checks pip, npm and cargo install commands in AI chat answers and flags packages that are missing, brand new, or look-alikes.

Audit AI-agent GitHub Actions workflows for prompt-injection, token, and secret-exposure risks

GitHub Action + CLI for replayable CI/PR/release gate decisions - zero-config Self-Test turning checks, scanners, and AI-agent signals into deterministic, tamper-evident PASS/WARN/BLOCK records. Read-only, zero dependencies, Apache-2.0.

GitHub Action: Verify CCS evidence receipts in CI/CD. Agent Runtime Reliability guardrail.

🛡️ Zero-trust security gate & vulnerability scanner for AI agent skills (Claude Code, Antigravity, OpenCode, Codex). Powered by NVIDIA SkillSpector.

AgentGate — scan, lock, and gate your MCP servers. npm-audit + lockfile + CI drift gate for the MCP era.