Pricing

$20.00 / 1,000 mcp server auditeds

Repo Security Scanner — Malicious Code & Supply Chain

Run a supply chain audit on any GitHub repo before you install or depend on it. Scans for malicious code, install-time execution, credential exfiltration and prompt injection. Vet npm/PyPI package sources and MCP servers. Risk level, score and file/line evidence per repo.

Pricing

$20.00 / 1,000 mcp server auditeds

Rating

0.0

(0)

Developer

Ikko Eltociear Ashimine

Actor stats

Bookmarked

Total users

Monthly active users

5 days ago

Last modified

Categories

Developer tools

You can access the Repo Security Scanner — Malicious Code & Supply Chain programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in API & Integrations in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

1import { ApifyClient } from 'apify-client';
2
3// Initialize the ApifyClient with your Apify API token
4// Replace the '<YOUR_API_TOKEN>' with your token
5const client = new ApifyClient({
6    token: '<YOUR_API_TOKEN>',
7});
8
9// Prepare Actor input
10const input = {
11    "repos": [
12        "https://github.com/modelcontextprotocol/servers"
13    ],
14    "org": "modelcontextprotocol"
15};
16
17// Run the Actor and wait for it to finish
18const run = await client.actor("eltociear/mcp-server-security-scanner").call(input);
19
20// Fetch and print Actor results from the run's dataset (if any)
21console.log('Results from dataset');
22console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
23const { items } = await client.dataset(run.defaultDatasetId).listItems();
24items.forEach((item) => {
25    console.dir(item);
26});
27
28// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

GitHub Supply Chain Audit: Malicious Code Scanner API in JavaScript

The Apify API client for JavaScript is the official library that allows you to use Repo Security Scanner — Malicious Code & Supply Chain API in JavaScript or TypeScript, providing convenience functions and automatic retries on errors.

Install the apify-client

$npm install apify-client

Other API clients include:

Repo Security Scanner — Malicious Code & Supply Chain API in Python

Repo Security Scanner — Malicious Code & Supply Chain API through CLI

Repo Security Scanner — Malicious Code & Supply Chain OpenAPI definition

Repo Security Scanner — Malicious Code & Supply Chain API

Malicious Package Watch — npm/PyPI Supply Chain Alerts

0xgollum/malicious-package-watch

Watch the open-source packages your codebase depends on and get alerted the moment a new security advisory (including typosquat/malicious package takedowns) is published for one - built on the free OSV.dev vulnerability database. Only new advisories are reported after the first baseline check.

0xGollum

Malicious Package Supply Chain Tracker Scraper

jungle_synthesizer/malicious-package-supply-chain-tracker-scraper

Cross-ecosystem feed of confirmed malicious/typosquatted packages across npm, PyPI, crates.io, Go, Maven, NuGet, Packagist and RubyGems, sourced from the OSSF malicious-packages dataset (also feeds OSV.dev). Category taxonomy plus typosquat-target linkage for CI gating. Passive read only.

BowTiedRaccoon

Dependency Supply-Chain Risk Audit

scrapeworks/dependency-risk-audit

Audit your package.json or requirements.txt for supply-chain risk: known vulnerabilities (OSV), deprecated/abandoned packages, and a project-level risk score.

Nicolas van Arkens

Repo to Claude Skill Converter

ianymu/repo-to-claude-skill-converter

Convert any GitHub repository (CLI, library, API client) into a draft Claude Code Skill package (SKILL.md + install.sh + README) so Claude Code users can install that repo's capability as a one-line invocation.

Yanlong Mu

Github Repo User Scraper

inquisitive_sarangi/github-repo-scraper

Github Repo User Scraper is simple tool to extract users of a repo(s) like contributors, stargazers & watchers. You can also export listings to JSON/CSV or any other as format.

API Master

MCP Server Risk Auditor

trovevault/mcp-server-risk-auditor

Audits MCP server manifests for tool, permission, credential, prompt-injection, exfiltration, and execution risks. Export data, run via API, schedule and monitor runs, or integrate with other tools.

Trove Vault

OSS Supply Chain Risk Report - PyPI, npm, OSV and Docker Hub

changeable_peddler/oss-supply-chain-risk-report

Software supply chain risk API and requirements.txt security scanner for Python packages, npm packages, Docker images, lockfiles, SBOMs, and Dockerfiles.

Sean J

Package Registry Intelligence — npm, PyPI, crates & more

straightforward_hydra/package-registry-intelligence

One tool over 6 package registries (npm, PyPI, crates.io, RubyGems, NuGet, Packagist): version, license, repo, maintainer, downloads & dependencies. Keyless. For supply-chain & dev intel.