{"repo":"eric-sabe/honey","free":true,"listed":false,"github":"https://github.com/eric-sabe/honey","clone":"git clone https://github.com/eric-sabe/honey.git","description":"Hands-off supply-chain watchdog for dev machines: orchestrates multiple security scanners (Perplexity bumblebee + osv-scanner, govulncheck, NVIDIA SkillSpector) into one daily verdict — via Claude/Slack, desktop notification, or plain CLI.","language":"Shell","stars":40,"topics":["bumblebee","dependency-scanning","devsecops","macos","security","supply-chain-security","threat-intelligence","ai-agent-security","claude","govulncheck"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"honey A hands-off supply-chain watchdog for your dev machine. honey runs best-in-class security scanners on a schedule, unifies their results into one verdict, and (optionally) has Claude DM you a triage write-up each day. honey doesn't detect anything itself — it orchestrates scanners, each a \"lens\" on a different risk: Lens Answers Upstream --- --- --- bumblebee (core) \"Do I have a known-compromised package/extension?\" Perplexity osv-scanner \"Do my dependencies have known CVEs?\" (all ecosystems) Google/OSV govulncheck \"Do I actually call a vulnerable Go function?\" Go team skillspector \"Is an installed AI agent skill behaving maliciously?\" NVIDIA smuggle \"Is something hidden from the scanners — invisible Unicode, a bidi trick, a remote include?\" honey-native mcp \"Did an MCP server's definition change since I approved it?\" (rug pulls) honey-native ocr \"Are there instructions hidden in an image bundled with a skill?\" honey-native Two further lenses — mcp-scan (cloud) and garak (live-model probing) — are off by default and wrap external tools; see Lenses. On top of the raw scanners, honey adds a suppression baseline (acknowledge a reviewed finding once, get told if it later changes) and a verdict policy (tune what escalates the daily alarm). bumblebee (the only required scanner) is a read-only inventory collector that flags on-disk package/extension/version metadata matching a known-compromised entry in a threat-intelligence catalog. The lenses are opt-in and inert until you in","default_branch":null,"files":null,"tree":[],"storefront":"/r/eric-sabe","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/eric-sabe/honey/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}