osv-scanner

Hands-off supply-chain watchdog for dev machines: orchestrates multiple security scanners (Perplexity bumblebee + osv-scanner, govulncheck, NVIDIA SkillSpector) into one daily verdict — via Claude/Slack, desktop notification, or plain CLI.

Deterministic code quality gate for AI coding agents (Claude Code, Codex, pi): git hooks that block test tampering, hold the CRAP bar on changed functions, check diff coverage, secrets and dependencies. 12 languages, one config file. Optional Jev classifier for test hunks.

A beautiful, zero-config visual CVE dashboard for npm & Python. One command: npx osv-ui. 100% Local & Secure.

Fork of Google's OSV-Scanner with my fix for a stack-overflow DoS in the SPDX license parser (issue #2993, PR #3032): unbounded recursion on untrusted license expressions, now bounded with a depth limit.

Automação DevSecOps e qualidade de código não invasiva para Java e Angular via Git Hooks assíncronos. Validações SAST, SCA e linters sem alterar arquivos do projeto.

A 5-second morning supply-chain safety check for npm/PyPI/Docker/Go/Rust: known-malicious packages, CVEs, zero-hour deps, release-cooldown & digest pinning, plus build-manifest and AI-agent-config auto-exec checks (Shai-Hulud/Miasma). Zero-dependency CLI + Claude Code plugin.

Defensive, read-only security assessment skill for Claude Code (Semgrep + osv-scanner + gitleaks) with a reproducible reliability grade (0-100, A-F).

Reusable GitHub Actions workflow that scans your repo (or any external repo) with Semgrep, Gitleaks, OSV, Checkov, Trivy and SBOM, then emails a graded security report enriched with CISA KEV, FIRST EPSS and OpenSSF Scorecard.

DevSec Scanner — local-first security scanner: SAST, SCA, IaC, DAST, secret, container-image & supply-chain scans from one CLI or desktop app, unified into one report.

Approval-gated security audit plugin for Hermes Agent using Gitleaks, OSV-Scanner, and Semgrep CE.

Tiny security gate for CI/CD. Wraps Semgrep, Gitleaks, osv-scanner, Trivy, and npm audit. One command, one report, one exit code.

Reusable GitHub Actions workflow: typos + gitleaks + trufflehog + osv-scanner for public OSS repos.

Simple discord bot that polls CVE databases and alerts on keyword matches

Code Auditor

Deterministic security gate for AI-assisted repositories: orchestrates pinned scanners, normalizes findings, enforces allowlist policy, and avoids leaking secrets.

Agent skills for running security scans — secret scanning (gitleaks), dependency CVE audit (npm/cargo/osv), SAST (semgrep), and a composed pre-release gate. Grounded SKILL.md runbooks for Vanta / Claude Code / any skill-aware agent. MIT.

Open-source CVE vulnerability management platform for SOC teams. Centralize scanner results, enrich vulnerabilities with threat intelligence (KEV, EPSS, NVD), track remediation and automate response workflows.

Deterministic broker that drives Claude Code and Grok through a detect, analyze, fix, verify loop against a target repo. Detectors find the bugs, the agents reason and patch, and no fix counts until the broker re-runs the repro itself.

Vulnfy is a lightweight, cross-platform dependency and container vulnerability scanner written in Python. It automatically detects project configuration/lock files across multiple languages and ecosystems, queries the OSV API, and generates a structured JSON vulnerability report.

An MCP server that wraps Google's OSV-Scanner.