Supply Chain
MVP available
Supply Chain verifies supported agent components before teams trust them. It scans the exact repository commit selected by GitHub and keeps the result tied to that immutable source.
What it protects
Section titled “What it protects”The first release inspects:
- skill entrypoints whose filename equals
SKILL.mdcase-insensitively; and - known MCP configuration files.
Supply Chain is designed to cover more component types over time, including plugins and packages. The current scan scope is always shown with the result.
What a result contains
Section titled “What a result contains”Each result records:
- the exact commit that was inspected;
- the scanner and ruleset versions;
- the policy used for the decision;
- scan completeness and file counts;
- duration; and
- normalized findings with file and line evidence where available.
Scanner errors are reported as failures. They are not treated as clean scans.
How it fits your workflow
Section titled “How it fits your workflow”The GitHub App responds to check events, queues a scan, reads a bounded archive for the requested commit, and publishes the outcome as a GitHub check. Repository code, scripts, hooks, package managers, and builds are never run during scanning.
Read How scanning works for the scan lifecycle and security boundaries.
GitHub administrators can require the Supply Chain check to prevent merging when the managed policy produces a blocking result.