guacsec/guac

Health v2 · maintenance only

Adoption not part of the score

1534 stars · 210 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

GUAC (Graph for Understanding Artifact Composition) is an OpenSSF incubating project that ingests software security metadata such as SBOMs, SLSA attestations, and vulnerability advisories into a high-fidelity graph database. It normalizes entity identities and maps relationships between software artifacts so organizations can query the graph for audit, policy, and risk management outcomes.

Use cases

• find which of my applications are affected by a newly disclosed CVE
• aggregate SBOMs and security metadata from my whole organization into one queryable graph
• answer 'who depends on this library?' across my software estate
• audit the software supply chain for policy violations
• map relationships between software artifacts from SPDX and CycloneDX SBOMs
• check if any of my dependencies have known vulnerabilities or VEX statements
• query software supply chain metadata via GraphQL
• assess risk before approving a new open source dependency

When to choose

• you need a centralized, queryable graph of SBOMs, attestations, and vulnerability data across many projects
• you want to answer transitive dependency and vulnerability impact questions across your organization
• you need to correlate multiple metadata standards (SPDX, CycloneDX, in-toto, SLSA, VEX, OSV) in one place
• you are building supply chain policy, audit, or risk management workflows

When to avoid

• you just need to generate a single SBOM for one project rather than aggregate many
• you want a lightweight vulnerability scanner without graph ingestion infrastructure
• you cannot operate a multi-service stack (databases, message queue, collectors, GraphQL API)
• you need a turnkey commercial product with support rather than an actively developing project

Facets

service · maturity active

security database search-engine api-framework etl vulnerability-scanning developer-tools security developer-tools databases apis go self-hosted cross-platform cli sbom software-supply-chain-security spdx cyclonedx in-toto slsa vex graph-database supply-chain-visibility openssf vulnerability-management attestations automation docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="guacsec/guac")