{"adoption": {"forks": 210, "observed_at": "2026-08-28T04:04:59.695244+00:00", "stars": 1534}, "canonical_url": "https://ross.abutalabs.com/products/guac", "card": {"archived": false, "artifact_type": "service", "description": "GUAC aggregates software security metadata into a high fidelity graph database.", "domain": ["security", "developer-tools", "databases", "apis"], "enriched": true, "function": ["security", "database", "search-engine", "api-framework", "etl", "vulnerability-scanning", "developer-tools"], "health_score": 98, "homepage": "https://guac.sh", "language": "Go", "license": "Apache-2.0", "license_family": "permissive", "maturity": "active", "member_repos": ["guacsec/guac"], "name": "guacsec/guac", "platform": ["go", "self-hosted", "cross-platform", "cli"], "pushed_at": "2026-08-26T14:11:32+00:00", "repo": "guacsec/guac", "stars": 1534, "tags": ["sbom", "software-supply-chain-security", "spdx", "cyclonedx", "in-toto", "slsa", "vex", "graph-database", "supply-chain-visibility", "openssf", "vulnerability-management", "attestations", "automation", "docker"], "topics": ["security", "software-supply-chain", "software-supply-chain-security", "supply-chain", "supply-chain-security", "supply-chain-visibility", "supply-chain-analytics", "attestations", "graph", "sbom", "slsa", "cyclonedx", "cyclonedx-sbom", "in-toto", "spdx", "spdx-sbom", "vex", "vulnerability", "vulnerability-management"], "urls": [], "use_cases": ["find which of my applications are affected by a newly disclosed CVE", "aggregate SBOMs and security metadata from my whole organization into one queryable graph", "answer 'who depends on this library?' across my software estate", "audit the software supply chain for policy violations", "map relationships between software artifacts from SPDX and CycloneDX SBOMs", "check if any of my dependencies have known vulnerabilities or VEX statements", "query software supply chain metadata via GraphQL", "assess risk before approving a new open source dependency"], "what_it_is": "GUAC (Graph for Understanding Artifact Composition) is an OpenSSF incubating project that ingests software security metadata such as SBOMs, SLSA attestations, and vulnerability advisories into a high-fidelity graph database. It normalizes entity identities and maps relationships between software artifacts so organizations can query the graph for audit, policy, and risk management outcomes.", "when_to_avoid": ["you just need to generate a single SBOM for one project rather than aggregate many", "you want a lightweight vulnerability scanner without graph ingestion infrastructure", "you cannot operate a multi-service stack (databases, message queue, collectors, GraphQL API)", "you need a turnkey commercial product with support rather than an actively developing project"], "when_to_choose": ["you need a centralized, queryable graph of SBOMs, attestations, and vulnerability data across many projects", "you want to answer transitive dependency and vulnerability impact questions across your organization", "you need to correlate multiple metadata standards (SPDX, CycloneDX, in-toto, SLSA, VEX, OSV) in one place", "you are building supply chain policy, audit, or risk management workflows"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/guac", "repo": "guacsec/guac", "role": "main", "score": 90}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:04:59.695244+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T04:31:12.152164+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "9feeb96f2718add49e4b6dae511424f3cfe31ee33117841d442a0ebbf5547504", "fetched_at": "2026-08-28T04:04:59.695244+00:00", "kind": "readme", "missing": false, "url": "https://github.com/guacsec/guac"}, {"content_hash": "e1ee14a9ff9db9684cbb1e6b214ebd7d97fea3984e70f12cf7ad48380c8f17de", "fetched_at": "2026-08-29T11:33:09.356444+00:00", "kind": "homepage", "missing": false, "url": "https://guac.sh"}, {"content_hash": "3f2cfafc8a0464f685c43935e96c6e0a8976a3beb6164a03ed07c69958bde69e", "fetched_at": "2026-08-29T11:33:09.366049+00:00", "kind": "site_page", "missing": false, "url": "https://docs.guac.sh/"}, {"content_hash": "be2a78723a19861d130140b2ac2f4f6a6ce5c6b663287f82538e45a2070ba0cb", "fetched_at": "2026-08-29T11:33:09.368009+00:00", "kind": "site_page", "missing": false, "url": "https://guac.sh/trustify"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 99, "longevity": 100, "rhythm": 74}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 1545, "days_push": 7, "days_rel": 173, "gap_med": 5.0, "n_releases_24m": 27}, "score": 90, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}