Gold Open Source
Safeguard's free, public directory of security-verified open-source software — packages, container images, CVEs, CWEs, the full MITRE ATT&CK framework, AI models, MCP servers, agent skills, and chip manufacturers, available at gold.safeguard.sh and as a Chrome extension.
Gold Open Source
Gold Open Source is Safeguard's free, no-login public directory of security-verified open-source software, available at gold.safeguard.sh. It is the public, browsable face of Safeguard's verification pipeline: anyone can look up a component's security status without an account.
The Gold standard
A component is Gold when it meets a clear, evidence-backed bar:
- Zero known high or critical vulnerabilities
- Malware-free
- License-compliant
- Verified provenance
The directory shows where each component stands against that bar, with the underlying evidence rather than an opaque score.
What it covers
Gold Open Source spans the modern software (and AI) supply chain:
| Section | What's in it |
|---|---|
| Packages | Verified open-source packages across 20+ ecosystems (npm, PyPI, Maven, Go, Cargo, and more) with vulnerability counts, license, and version data. |
| Container Images | Docker/OCI images scanned for CVEs, malware, and license issues. |
| Vulnerabilities (CVEs) | A real-time CVE database searchable by package, severity, or ecosystem — CVSS, affected/fixed versions, remediation. |
| CWE Index | Every Common Weakness Enumeration class with related CVEs. |
| MITRE ATT&CK® | Tactics, techniques and sub-techniques, mitigations, threat-actor groups, malware/tools, and campaigns across the Enterprise, Mobile, and ICS matrices. |
| AI Models | Open-weight models sourced from the Hugging Face Hub (with live download and star counts) plus notable frontier models. |
| MCP Servers | Thousands of Model Context Protocol servers from the official registry. |
| Agent Skills | Official Anthropic Agent Skills and notable community skills. |
| Chip Manufacturers | Semiconductor companies from fabless designers to foundries and equipment makers. |
Chrome extension
Gold Open Source is available as a Chrome extension so lookups happen without leaving the browser. Install it from the Chrome Web Store.
Remediation guidance
Every CVE page includes an "Am I affected?" check — enter the version you're running and get an immediate verdict against the advisory's affected and fixed versions. Every package page with known vulnerabilities shows a recommended safe version: the lowest version that clears the most advisories, with a copy-ready upgrade command for your ecosystem.
CI gate — GitHub Action & CLI
Gate your pipeline on Gold intelligence for free — no account, no API key, and your source never leaves the runner (only dependency names are sent to the public read API). Add .github/workflows/gold-scan.yml:
name: Gold Scan
on: [push, pull_request]
jobs:
gold-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: safeguard-sh/gold-scan-action@v1
with:
fail-on: kev # kev = actively exploited only | vuln = any known CVE | none = report onlyOr run it anywhere Node ≥ 18 is available — pre-commit hooks, GitLab CI, Jenkins, or locally:
npx @safeguard/gold-scan . --fail-on kevIt discovers npm, PyPI, crates.io, Go, RubyGems, and Packagist manifests, flags dependencies that are actively exploited (CISA KEV) or known-vulnerable, and writes a summary to the run. It fails open if the API is unreachable, so a Gold outage never blocks your build. See Developers for the full API and README badge.
Data sources
Gold Open Source aggregates, normalizes, and enriches public data. Attribution for every source is listed on the Credits page: NVD (NIST), the CVE and CWE programs (MITRE), OSV.dev, GitHub Security Advisories, OWASP, the Hugging Face Hub, the MCP registry, and the open-source package and container registries.
MITRE ATT&CK® is a registered trademark of The MITRE Corporation.