— · Apache 2.0
Exposes an assess_repo tool that scans a repository, local folder, or npm/PyPI package and returns supply-chain risk findings with file, line, and code evidence — install-time scripts, dangerous patterns, secrets, AI-agent manipulation, impersonation and published-artifact mismatches — while never executing the target's code. Findings carry severities from info to critical so results can gate installs and CI jobs.
— · Apache 2.0
Exposes three read-only tools that list local Agent and MCP runtime candidates, inspect running processes, and check a live runtime against an approved artifact expectation. Returns explicit verdicts such as matched, stale, leaked, conflict, unknown, or not running without exposing argv, environment values, or file contents.