What problem does it solve? Modern software pulls in dependencies, CI actions, plugins, and build inputs that can be tampered with, confused, or poorly pinned, and teams often lack a structured way to assess whether these inputs can be identified, reproduced, and trusted before release. ## Core Features & Use Cases - Supply-Chain Inventory: Catalogs package manifests, lockfiles, registries, transitive dependencies, install hooks, base images, SBOMs, and release workflows with their trust status. - Provenance and Trust Tracing: Checks lockfile integrity, dependency-confusion indicators, CI action pinning, workflow permissions, signature identity, and attestation evidence. - Evidence-Based Reporting: Produces a ranked findings report distinguishing confirmed local evidence, provider claims, blocked checks, and approval-gated remediations. - Use Case: Before a release, ask the assistant to review your repository's lockfiles, GitHub Actions workflows, and existing SBOM to identify unpinned actions, suspicious lifecycle scripts, and incomplete provenance, without installing or executing anything. ## Quick Start Review this repository's dependency manifests, lockfiles, CI workflows, and SBOM for supply-chain risks and report findings with evidence, without installing packages or making changes.
