chainprobe-guard 0.1.0

ChainProbe - Supply Chain Security Auditor

RegistryPulse

Package Registry Infrastructure Toolkit

RegistryPulse is an open-source infrastructure toolkit that monitors, secures, and audits package registries across all major ecosystems. It provides health monitoring, dependency analysis, provenance verification, and policy enforcement through a single unified interface.

Why RegistryPulse?

Package registries are the backbone of modern software development, yet they lack standardized tooling for:

• Health monitoring — No unified way to track registry uptime, latency, and availability
• Dependency analysis — Cross-registry dependency graphs are impossible to build
• Provenance verification — No standard way to verify package build integrity
• Policy enforcement — Organizations can't enforce registry policies at scale

RegistryPulse provides all of this through a single CLI tool, supporting 7 ecosystems out of the box: npm, PyPI, Cargo, Go, RubyGems, Maven, and Packagist.

Quick Start

# Install
pip install registrypulse

# Audit all registries
registrypulse audit --all

# Check registry health
registrypulse health --all

# Analyze a package's dependencies
registrypulse deps npm:express
registrypulse deps pypi:flask --depth 2

# Verify package provenance
registrypulse provenance cargo:serde

# Generate a registry-level SBOM
registrypulse sbom --format spdx-json -o registry-sbom.json

# Check organizational policies
registrypulse policy ./my-project

Commands

Command	Description
registrypulse audit	Audit registries for security and operational health
registrypulse health	Check registry availability and latency
registrypulse deps	Analyze cross-registry dependency graphs
registrypulse provenance	Verify package build provenance
registrypulse sbom	Generate registry-level SBOMs
registrypulse policy	Enforce organizational registry policies
registrypulse ecosystem	Show supported ecosystems and status

Supported Ecosystems

Ecosystem	Registry	Manifest Files
npm	registry.npmjs.org	package.json, package-lock.json
PyPI	pypi.org	requirements.txt, pyproject.toml
Cargo	crates.io	Cargo.toml, Cargo.lock
Go	proxy.golang.org	go.mod, go.sum
RubyGems	rubygems.org	Gemfile, *.gemspec
Maven	repo1.maven.org	pom.xml, build.gradle
Packagist	packagist.org	composer.json

Policy Enforcement

Create a registrypulse-policy.json in your project root:

{
  "rules": [
    {
      "id": "ALLOWED_REGISTRIES",
      "allowed_registries": ["npm", "pypi", "cargo"]
    },
    {
      "id": "LICENSE_COMPLIANCE",
      "blocked_licenses": ["GPL-3.0", "AGPL-3.0", "SSPL-1.0"]
    },
    {
      "id": "VERSION_PINNING"
    },
    {
      "id": "MAX_DEPTH",
      "max_depth": 5
    }
  ]
}

Contributing

We welcome contributions! See CONTRIBUTING.md.

Security Policy

See SECURITY.md for vulnerability reporting.

License

Apache License 2.0 — see LICENSE.