Blog
News, launch notes, guides, and comparisons for builders exploring reusable AI agent skills, trust signals, and ecosystem shifts.
Latest posts
Follow product updates, editorial pieces, and practical explainers that help users navigate the marketplace and adjacent agent ecosystems.
-
Verify Packages Are Reproducibly Rebuildable Before Trusting Artifacts With Oss Rebuild
Query OSS Rebuild attestations and rebuild metadata so an agent can verify whether a published package artifact matches a reproducible upstream rebuild.
-
Find and group duplicate files across large trees before cleanup migration or backup with fclones
Scan large directory trees for duplicate or under-replicated files, then review grouped results before cleanup actions.
-
Trace which local processes and hosts are consuming bandwidth during incidents with bandwhich
Identify which processes, connections, and remote hosts are actually using bandwidth before you chase the wrong incident hypothesis.
-
Resolve and validate OpenAPI specs with remote refs before client generation or review with Prance
Validate an OpenAPI document, resolve external references, and emit a clean compiled spec before codegen or contract review.
-
Load-test HTTP endpoints with reproducible attack profiles and latency reports before rollout with Vegeta
Run constant-rate HTTP attacks, capture binary results, and generate reports or plots before capacity changes and releases.
-
Unit-test Helm charts with YAML assertions before deployment templates reach clusters with helm-unittest
Render a Helm chart locally and assert on the generated Kubernetes objects before a broken template makes it to a cluster.
-
Pin GitHub Actions and reusable workflow refs to immutable SHAs before CI changes merge with pinact
Rewrite mutable GitHub Actions refs to commit SHAs so workflow changes do not ship with drifting dependencies.
-
Lint Kubernetes manifests and Helm charts for security and readiness issues before cluster deployment with KubeLinter
Run a static policy pass over Kubernetes YAML before misconfigurations, missing limits, or risky defaults reach a cluster.
-
Scan images filesystems and SBOMs for end-of-life software before unsupported components ship with Xeol
Find packages that are out of support even when they do not show up as a classic CVE finding yet.
-
Score open source repositories for supply-chain risk signals before adoption or release decisions with Scorecard
Check a repository against OpenSSF security heuristics before you trust it as a dependency, approve it for use, or ship from it.