sarif — independent software & tools

5 independent sarif listings the big search engines bury.

• patient-zero

  github · Free · by 0xSteph

  Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or drop into CI as a GitHub Action. Covers npm + Python + MCP agent configs. Free, MIT, no signup, no telemetry.

• repopilot

  github · Free · by MykytaStel

  Local-first CLI for reviewing Git changes, security boundaries, and blast radius before merge.

• snitch

  github · Free · by n4uu

  Single static-binary recon orchestrator in Go: chains subfinder, httpx, nmap, nuclei, ffuf, katana + injection testing (dalfox/crlfuzz/sqlmap), with dedup, diff-based webhook alerts, an interactive TUI and JSON/CSV/SARIF export.

• trustabl-action

  github · Free · by trustabl

  GitHub Action that runs trustabl — static reliability/safety analyzer for AI agent SDKs (Claude, OpenAI, Google ADK, MCP). Gates CI on risk + severity.

• markdownlint-obsidian

  npm · Free · by GitHub Actions

  Obsidian Flavored Markdown linting engine — programmatic API and rule set