murphysecurity/murphysec

Health v2 · maintenance only

Adoption not part of the score

1753 stars · 180 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

MurphySec CLI is an open-source software composition analysis (SCA) tool that detects vulnerable dependencies in projects from the command line. It analyzes direct and indirect dependencies and matches them against a vulnerability knowledge base, and can be integrated into CI/CD pipelines.

Use cases

• scan my project for vulnerable dependencies
• detect known CVEs in third-party libraries
• integrate dependency vulnerability scanning into CI/CD
• analyze direct and indirect dependencies of a Java, JavaScript, or Go project
• check software supply chain security before release
• find which dependencies have security issues locally

When to choose

• you need command-line SCA scanning for Java, JavaScript, or Go projects
• you want to add dependency vulnerability checks to a Jenkins or other CI/CD pipeline
• you want a tool backed by a professionally maintained vulnerability knowledge base

When to avoid

• you need fully offline scanning, since dependency info is uploaded to MurphySec's server for matching
• you need language support beyond Java, JavaScript, and Go
• you need a self-hosted SCA solution without external service calls

Facets

cli-tool · maturity active

security vulnerability-scanning dependency-audit cli ci-cd security developer-tools windows cli sca software-composition-analysis supply-chain-security vulnerability-detection go devops linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="murphysecurity/murphysec")