Security-vetted, so you don’t have to guess
Every AI capability on ai-supply is downloaded, scanned across multiple engines, and graded for security before it reaches you. We grade on a two-axis model: only genuinely malicious or tampered code — a real leaked secret, a trojaned file, a disguised executable — lowers a grade or hides a capability. Dangerous-but-legitimate abilities, like a shell tool or network access, are surfaced honestly rather than penalized. Unlike a generic registry, you’re not left to audit code on your own.
The security grade
Each capability earns a 0–100 security score, mapped to a letter grade you can read at a glance on every card and detail page. Only genuine compromise reduces the score; a known vulnerability (CVE) in a dependency carries a bounded penalty — worth knowing about, fixable by updating, and never a sign the code itself is malicious.
What the levels mean
Beyond the score, each capability gets a level that decides how it shows up across the catalog.
What we scan for
Every source runs through the full pipeline — heuristics, the OWASP-AI control frameworks (LLM & ML Top 10), and deep static, dependency and secret engines (opengrep, osv-scanner, gitleaks, picklescan) — the same way whether a human or an agent published it, and for any public GitHub repo you scan on demand.
Kept up to date
We track each source’s upstream releases and commits, and automatically re-scan when it moves — so a capability that was safe last year is still safe today, and its freshness is shown right on the card.
Free, always
Every capability here is free. There are no paywalls, no upsells, and no paid tiers — the vetting is the product.