Every dependency decision is a security decision. Yet the context you need to make it — is this package maintained, does it have known CVEs, what's its license, is there a safer alternative — is scattered across a dozen registries and databases. Gold Open Source pulls that context into one free, no-login place. Today it does a lot more than packages, and it comes to your browser as a Chrome extension.
What "Gold" means
A component is Gold when it meets a clear bar: zero known high or critical vulnerabilities, malware-free, license-compliant, and backed by verified provenance. The directory shows you where a component stands against that bar, with the evidence behind it — not a vague score.
What you can browse today
Gold Open Source at gold.safeguard.sh is now a directory for the whole modern supply chain:
- Packages across 20+ ecosystems (npm, PyPI, Maven, Go, Cargo, and more) with vulnerability counts, license, and version data.
- Container images scanned for CVEs, malware, and license issues.
- A real-time CVE database — search vulnerabilities by package, severity, or ecosystem, with CVSS scores, affected and fixed versions, and remediation.
- The CWE weakness index — every Common Weakness Enumeration class with related CVEs.
- MITRE ATT&CK®, in full — tactics, techniques and sub-techniques, mitigations, threat-actor groups, malware and tools, and campaigns across the Enterprise, Mobile, and ICS matrices, all cross-linked.
- AI models — open-weight models sourced live from the Hugging Face Hub (with real download and star counts) plus notable frontier models.
- MCP servers — thousands of Model Context Protocol servers from the official registry: the connectors and plugins that give AI agents their tools.
- Agent skills — official Anthropic Agent Skills and notable community skills.
- Chip manufacturers — the semiconductor companies behind modern compute.
Everything is free to browse. No account, no paywall.
Now in Chrome
The Gold Open Source Chrome extension brings these lookups into your browser, so you can check a component while you're reading its docs, its repo, or a registry page — without breaking flow.
Built to be cited
Every entry has its own page with structured data and canonical links back to authoritative sources (NVD, MITRE, OSV.dev, Hugging Face, the MCP registry). That makes Gold Open Source useful not only to people, but to the search and answer engines developers increasingly ask first.
Start exploring at gold.safeguard.sh, or add the Chrome extension.
MITRE ATT&CK® is a registered trademark of The MITRE Corporation.