# murphysecurity/murphysec

An open source tool focused on software supply chain security. 墨菲安全专注于软件供应链安全，具备专业的软件成分分析（SCA）、漏洞检测、专业漏洞库。

Repository: https://github.com/murphysecurity/murphysec
Canonical: https://ross.abutalabs.com/products/murphysec
Language: Go
License: Apache-2.0
License Family: permissive
Topics: security, scanner, dependency, vulnerability-detection, software-supply-chain, sca, software-composition-analysis, codescan
Last push: 2026-04-07T09:07:34+00:00

## Health v2 (maintenance only)
Score: 57/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 76, release rhythm 8, longevity 100
- inputs: {"age_days": 1631, "days_push": 148, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1753, forks 180 (observed 2026-08-28T04:05:31.825126+00:00)

## What it is
MurphySec CLI is an open-source software composition analysis (SCA) tool that detects vulnerable dependencies in projects from the command line. It analyzes direct and indirect dependencies and matches them against a vulnerability knowledge base, and can be integrated into CI/CD pipelines.

## Use cases
- scan my project for vulnerable dependencies
- detect known CVEs in third-party libraries
- integrate dependency vulnerability scanning into CI/CD
- analyze direct and indirect dependencies of a Java, JavaScript, or Go project
- check software supply chain security before release
- find which dependencies have security issues locally

## When to choose
- you need command-line SCA scanning for Java, JavaScript, or Go projects
- you want to add dependency vulnerability checks to a Jenkins or other CI/CD pipeline
- you want a tool backed by a professionally maintained vulnerability knowledge base

## When to avoid
- you need fully offline scanning, since dependency info is uploaded to MurphySec's server for matching
- you need language support beyond Java, JavaScript, and Go
- you need a self-hosted SCA solution without external service calls

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, dependency-audit, cli, ci-cd
- domain: security, developer-tools
- platform: windows, cli
- tags: sca, software-composition-analysis, supply-chain-security, vulnerability-detection, go, devops, linux, macos

## Member repositories
- murphysecurity/murphysec (main) score 57

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:31.825126+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:28:14.088629+00:00, confidence not recorded.
  - readme: https://github.com/murphysecurity/murphysec (fetched 2026-08-28T04:05:31.825126+00:00, sha 4e9935616682)
- Data as of 2026-08-30T08:39:29.467469+00:00.