Data / Repositories / Supply chain security
Supply chain security repositories on GitHub: 8 ranked by stars
8 public repositories tagged Supply chain security are on GitHub, with 24,608 stars between them; 8 had a push in the last 30 days. Most are written in Python (6), Rust (1), Astro (1). The most starred: NVIDIA/SkillSpector (20,177), sheeki03/tirith (2,751), hashgraph-online/hol-guard (892).
SpecStream is the live web data engine for teams and agents. It reads open-source repositories on GitHub and keeps what it reads, and this page groups that reading by topic. Ask for the repositories you track by topic, language, license or activity, and new ones and changes arrive in your sheet, CRM, Slack or agent.
Every repository, most starred first
| Repository | What it is | Language | Stars | Forks | License | Last push | Read |
|---|---|---|---|---|---|---|---|
| NVIDIA/SkillSpector | Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code… | Python | 20,177 | 1,776 | Apache-2.0 | Oct 14 | Oct 14 |
| sheeki03/tirith | Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs… | Rust | 2,751 | 97 | AGPL-3.0 | Oct 10 | Oct 11 |
| hashgraph-online/hol-guard | Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime. | Python | 892 | 158 | Apache-2.0 | Oct 14 | Oct 14 |
| RiccardoBiosas/awesome-MLSecOps | A curated list of MLSecOps tools and resources for securing machine learning and AI systems - adversarial ML defense, LLM security, AI red teaming, model scanning, supply-chain… | Astro | 477 | 121 | MIT | Oct 12 | Oct 14 |
| graygnatconsole/mcp-audit-tool | Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure… | Python | 306 | 5 | MIT | Sep 26 | Oct 15 |
| eltociear/skill-audit-mcp | Static security scanner for MCP servers, agent skills & plugins: 17 attack patterns / 60 regex signatures, calibrated to a 1% false-positive rate over 196 public MCP servers. In… | Python | 5 | 1 | MIT | Sep 30 | Oct 14 |
| basitalisandhu/agent-skills-state-2026 | Study of 2,999 public agent skill, plugin and MCP repositories (October 2026): missing security policies, unpinned MCP servers, unrestricted shell in skills, front matter that… | Python | 0 | 0 | MIT | Oct 13 | Oct 14 |
| tomelias10/mcp-drift-check | Static MCP package-reference mutability checker: Python CLI and GitHub Action. No discovered server execution. Broader config/baseline tools: Orynval Labs. | Python | 0 | 5 | MIT | Oct 11 | Oct 14 |
By language
- Python 6
Related topics
- AI security 6
- MCP 6
- Agent security 5
- Prompt injection 5
- Claude Code 4
- Security 4
- MCP security 4
- Agent skills 3
- Security scanner 3
- Cursor 3
- Devsecops 3
- Model Context Protocol 3
Read from GitHub by SpecStream between October 11, 2026 and October 15, 2026; each row shows the day its repository was read. Stars and pushes change every day, and the GitHub page is the current one. Forks and archived repositories are left out.