A supply-chain security scanner that reads every dependency before it runs.

Attackers stopped breaking in and started being installed: a typosquatted package, a release pushed with a stolen token, a workflow that prints its secrets, an MCP server that tells your coding agent to read ~/.ssh. Cordon reads all of it before any of it runs: source, manifests, lockfiles, build scripts, CI config, Dockerfiles, IaC, container images, and everything a repository hands an AI coding agent. It never executes what it scans, it adds no runtime dependency to your build, and it works offline.

Sixty seconds

pipx install cordon-scanner
cordon-scanner scan .

_{A recording of the scanner itself, not a mock-up: scripts/build/record_terminal.sh records it (the first command with FORCE_COLOR=1, so the pipe keeps its colour) and scripts/build/render_terminal.py replays it. The repository scanned is built from the project's own test corpus.}

What it catches

	What Cordon finds	For example
Malware	Install hooks that steal, droppers, wipers, poisoned models, obfuscated loaders, known-malicious releases	MALWARE.EXFIL.001
Leaked credentials	Cloud keys, tokens and private keys, even split across string literals; reported by hash, never printed	SECRET.AWS.ACCESS_KEY.001
AI agents and MCP	Instruction files, skills, MCP servers and their source, hooks and approvals	SUSPECT.MCP.TOOL_DESCRIPTION.001
CI/CD pipelines	Secrets sent out, expression injection, untrusted checkouts, on GitHub, GitLab, Jenkins and more	MALWARE.CI.SECRET_EXFIL.001
Dependencies	Known-malicious and exploited versions, typosquats, provenance that does not verify, release diffs	VULNERABLE.DEPENDENCY.EXPLOITED.001
Containers and IaC	Images' OS packages, Dockerfiles, Kubernetes, Terraform, Helm and Ansible	SUSPECT.K8S.RBAC_WILDCARD.001

Every rule that ships, by threat domain: docs/05-COVERAGE-MATRIX.md.

Twenty-eight ecosystems

npm	PyPI	Cargo	Go modules	Maven	Gradle
NuGet	RubyGems	Composer	Hex	Pub	CocoaPods
Swift	Conan	vcpkg	Conda	CRAN	Hackage
Julia	opam	Nix	Homebrew	Bazel

GitHub Actions

Terraform

Helm

Ansible

container images

The file-by-file list, and which checks each ecosystem gets: docs/07-ECOSYSTEMS.md.

Seventeen AI coding agents

Claude Code	Cursor	GitHub Copilot	Windsurf	Gemini CLI	OpenAI Codex
Kiro	Amazon Q	JetBrains Junie	Augment	Trae	Roo Code
Continue	Zed	goose	opencode	Cline

For each, Cordon reads the instruction files, skills, MCP server configs and their source, hooks and approvals, against its own rules and 815 of the Agent Threat Rules. An optional judge (--judge) has a language model read that text for wordings no rule anticipated (tutorial 18).

Measured, not claimed

	Result
npm malware blocked by reading its code alone, every release of the set (0.7.0)	91.08% of 6,793
Benign npm packages blocked, every release of the set (0.7.0)	0.96% of 34,437
Real malicious packages (39,328: npm, PyPI, AI skills, IDE extensions; 0.6.0)	94.2% detected
The same malware against GuardDog (a fixed-seed draw of 498; 0.6.0)	95.2%, against GuardDog's 85.5%
Popular packages wrongly blocked (top 1,000 PyPI + 1,000 npm; 0.6.0)	1.6%, against GuardDog's 16.8%
AI-agent attacks (4,034 Agent Threat Rules test cases; 0.6.0)	97.7% detected

Every number is measured against code nobody here wrote, and says the release it was measured for. Each measurement, the method behind it and what it is not: docs/08-ACCURACY.md.

How it works

1. Target: a repository, an archive, a package before you install it, a container image, or git history.
2. Identify: its languages, ecosystems, manifests and lockfiles.
3. Detect: 1,491 rules, code reading, binary analysis and the AI-agent chain.
4. Decide: score, policy and baseline settle what fails the build.
5. Report: text, JSON, SARIF, JUnit, GitHub annotations, SBOM.

Cordon never executes the code it scans, and sends nothing about your code anywhere unless you ask. By default it asks OSV which advisories changed since its intel was built, naming no package; --offline makes no request at all.

Install

pipx install cordon-scanner                    # or: pip install cordon-scanner
docker run --rm -v "$PWD:/scan" ghcr.io/threx-code/cordon:<version>

Python 3.11 to 3.15 on Linux, macOS and Windows, with zero third-party runtime dependencies. The image and the Action are distroless, non-root, signed with cosign and carry SLSA provenance; pin them by digest, not by tag.

Into your pipeline

permissions:
  contents: read          # checkout
  security-events: write  # upload SARIF

jobs:
  supply-chain:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Threx-code/cordon/action@v0.7.0   # pin to a commit sha in production
        with:
          fail-on: high
          sarif: true

A finding fails the build when it says the code is compromised or giving something away; a posture choice about your own infrastructure is reported, not failed. Exit codes: 0 clean, 1 findings, 2 scanner error, 3 configuration error, 4 incomplete. Pre-commit, GitLab, Jenkins and org-wide policy: docs/09-INTEGRATIONS.md.

Documentation

Tutorials · Every command · Configuration · Architecture · Threat model · Interfaces and SDK · Coverage matrix · Ecosystems · Accuracy · Changelog · Contributing · Security

Licensed under Apache-2.0: see LICENSE and NOTICE.