Sarif Python Packages

lintrunner-adapters

Adapters and tools for lintrunner

agent-bom

Open security scanner for AI supply chain and infrastructure: agents, MCP, containers, cloud, GPU, and runtime with blast-radius analysis.

ai-bom

AI Bill of Materials — discover every AI agent, model, and API in your infrastructure

compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

agent-audit-kit

Security scanner for MCP-connected AI agent pipelines — 77 rules, 13 scanners, OWASP Agentic 10/10, GitHub Action, SARIF, compliance mapping

selvo

Linux dependency blast-radius ranker — surfaces highest-value CVE patch opportunities

securescan

Security scanning without the SaaS tax. Multi-scanner orchestration, baseline diffing, SBOM + SARIF, signed everything — runs in your terminal, your CI, or a dashboard you own.

agents-shipgate

Static release-readiness gate for AI agent tool surfaces. CLI + GitHub Action. Scans MCP, OpenAPI, OpenAI Agents SDK, Anthropic, Google ADK, LangChain, CrewAI. Apache-2.0.

mcp-wallfacer

Runtime testing harness for MCP servers: fuzz tools, validate schemas, run YAML invariants and multi-step sequences, ship SARIF to CI. 17 embedded packs · stdio + HTTP · 5 install paths.

codesight

Code analysis CLI - code review, bugs, security, docs, refactoring. Multi-provider LLM, SARIF output, CI-ready.

surface-audit

Deterministic security smoke tests for preview, staging, and pre-deploy web URLs.

simplesecurity

Combine multiple popular python security tools and generate reports or output into different formats

vulnhawk

AI-powered code security scanner that finds vulnerabilities Semgrep and CodeQL miss

graveyard

Find dead code across Python, JS/TS, Go, and Rust with git-aware confidence scoring.

pylint-sarif-unofficial

Pylint output as SARIF

diplomat-agent

What can your AI agent do to the real world? Scan your code. See which tool calls have zero checks

dockerfile-doctor

The only Dockerfile linter that fixes what it finds. 80 rules, 51 auto-fixers, SARIF output, zero dependencies. Pure Python.

iam-sarif-report

No description available

selvo-client

Linux dependency risk scanner — distro-aware CVE prioritisation with blast-radius scoring

trusera-sdk

AI Bill of Materials — discover every AI agent, model, and API in your infrastructure

malwar

Malware detection engine for agentic skills (SKILL.md)

vulnhunter

Offline vulnerability scanner with AI triage — your dependencies have secrets, VulnHunter finds them.

mcp-config-guard

Zero-dependency MCP security linter — 54 OWASP-mapped checks, 56 malicious packages, 28 CVEs. pip install mcp-config-guard