ForgeGuardian
A local-first security scanner that checks your project's open-source dependencies for malicious packages and known vulnerabilities without sending your code anywhere.
🔗 Visit ForgeGuardian
Description
Every time you run "npm install" or "pip install", you're trusting that none of the hundreds of packages being pulled in are secretly malicious or carrying a known security hole — and in the last few years, attackers have increasingly slipped bad code into popular open-source packages specifically to exploit that trust. ForgeGuardian is a tool that checks your project's dependencies for exactly that kind of danger, entirely on your own machine, before you ever ship.
ForgeGuardian is a local-first, AI-native software supply-chain security platform written in Go that scans projects offline to detect malicious packages, known vulnerabilities, and suspicious behavior, without requiring an external account or sending code off-device. It runs eight concurrent scan engines — including OSV vulnerability data, behavioral analysis, malware detection, AI-based models, MCP, Grype, Trivy, and Semgrep — across nine package ecosystems (npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems, HuggingFace, and GitHub Actions), backed by 223+ detection signatures covering real supply-chain attacks documented between 2016 and 2026. It also generates SBOMs (software bills of materials), signs artifacts via Sigstore, and integrates directly into GitHub Actions with webhook alerts, all surfaced through a 30-page web dashboard.
💬 Our review
The short version: ForgeGuardian packs a genuinely comprehensive scan stack — eight engines, nine ecosystems, 223+ signatures — into a free, local-first tool, but with only 25 GitHub stars it's early enough that you're trusting a young project with a security-critical job.
Snyk and Trivy are the natural comparisons: Trivy is the closest in spirit (free, open-source, broad ecosystem coverage) but ForgeGuardian goes further by combining it with AI-based detection, behavioral analysis, and malware scanning in one local pipeline, rather than relying on a single vulnerability database lookup. Snyk offers a more polished commercial dashboard and remediation workflow, but at a real subscription cost and with data leaving your infrastructure. ForgeGuardian's local-first, no-account-needed design is the strongest argument for security-conscious teams that don't want dependency metadata phoning home — the tradeoff is a Go 1.25+ requirement and a much smaller community to vet the tool itself against edge cases. Worth adopting as a second opinion alongside an established scanner rather than a sole replacement, at least until adoption grows.
📊 Global score
🤖 AI-enriched data
Apache 2.0, open source ; palier commercial Pro disponible.
Pros
Huit moteurs de scan concurrents, dont des modèles IA pour la détection avancée
Couvre neuf écosystèmes de paquets (npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems, HuggingFace, GitHub Actions)
223+ signatures de détection couvrant des attaques réelles de 2016 à 2026
Architecture local-first, aucune donnée transmise à l'extérieur
Génération SBOM, signature Sigstore, intégration GitHub Actions, alertes webhook
Cons
Nécessite un runtime Go 1.25+
25 étoiles GitHub — adoption encore précoce comparée aux concurrents établis