# guacsec/guac

GUAC aggregates software security metadata into a high fidelity graph database.

Repository: https://github.com/guacsec/guac
Canonical: https://ross.abutalabs.com/products/guac
Homepage: https://guac.sh
Language: Go
License: Apache-2.0
License Family: permissive
Topics: security, software-supply-chain, software-supply-chain-security, supply-chain, supply-chain-security, supply-chain-visibility, supply-chain-analytics, attestations, graph, sbom, slsa, cyclonedx, cyclonedx-sbom, in-toto, spdx, spdx-sbom, vex, vulnerability, vulnerability-management
Last push: 2026-08-26T14:11:32+00:00

## Health v2 (maintenance only)
Score: 90/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 74, longevity 100
- inputs: {"age_days": 1545, "days_push": 7, "days_rel": 173, "gap_med": 5.0, "n_releases_24m": 27}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1534, forks 210 (observed 2026-08-28T04:04:59.695244+00:00)

## What it is
GUAC (Graph for Understanding Artifact Composition) is an OpenSSF incubating project that ingests software security metadata such as SBOMs, SLSA attestations, and vulnerability advisories into a high-fidelity graph database. It normalizes entity identities and maps relationships between software artifacts so organizations can query the graph for audit, policy, and risk management outcomes.

## Use cases
- find which of my applications are affected by a newly disclosed CVE
- aggregate SBOMs and security metadata from my whole organization into one queryable graph
- answer 'who depends on this library?' across my software estate
- audit the software supply chain for policy violations
- map relationships between software artifacts from SPDX and CycloneDX SBOMs
- check if any of my dependencies have known vulnerabilities or VEX statements
- query software supply chain metadata via GraphQL
- assess risk before approving a new open source dependency

## When to choose
- you need a centralized, queryable graph of SBOMs, attestations, and vulnerability data across many projects
- you want to answer transitive dependency and vulnerability impact questions across your organization
- you need to correlate multiple metadata standards (SPDX, CycloneDX, in-toto, SLSA, VEX, OSV) in one place
- you are building supply chain policy, audit, or risk management workflows

## When to avoid
- you just need to generate a single SBOM for one project rather than aggregate many
- you want a lightweight vulnerability scanner without graph ingestion infrastructure
- you cannot operate a multi-service stack (databases, message queue, collectors, GraphQL API)
- you need a turnkey commercial product with support rather than an actively developing project

## Facets
- artifact type: service
- maturity: active
- function: security, database, search-engine, api-framework, etl, vulnerability-scanning, developer-tools
- domain: security, developer-tools, databases, apis
- platform: go, self-hosted, cross-platform, cli
- tags: sbom, software-supply-chain-security, spdx, cyclonedx, in-toto, slsa, vex, graph-database, supply-chain-visibility, openssf, vulnerability-management, attestations, automation, docker

## Member repositories
- guacsec/guac (main) score 90

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:59.695244+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:31:12.152164+00:00, confidence not recorded.
  - readme: https://github.com/guacsec/guac (fetched 2026-08-28T04:04:59.695244+00:00, sha 9feeb96f2718)
  - homepage: https://guac.sh (fetched 2026-08-29T11:33:09.356444+00:00, sha e1ee14a9ff9d)
  - site_page: https://docs.guac.sh/ (fetched 2026-08-29T11:33:09.366049+00:00, sha 3f2cfafc8a04)
  - site_page: https://guac.sh/trustify (fetched 2026-08-29T11:33:09.368009+00:00, sha be2a78723a19)
- Data as of 2026-08-30T08:39:29.467469+00:00.