Heisenberg Supply Chain Health Checker

An open-source software supply chain health check tool that analyzes dependencies using deps.dev, SBOMs, and external advisories. Heisenberg generates health scores, detects risky packages, and produces CSV reports for individual dependencies or entire GitHub organization portfolios.

Installation

Use the upstream install or setup path that matches your environment:

• 2. Install with pipx [if you don't want to install keep reading]

• pipx install "git+https://github.com/AppOmni-Labs/heisenberg-ssc-health-check"
• git clone https://github.com/AppOmni-Labs/heisenberg-ssc-health-check
• pip install -e .

Requirements and caveats from upstream:

• Heisenberg requires python 3.11.
• If you do not wish to install the tool you can just clone it and run it directly with python
• python -m heisenberg.main sbom -r my_repo

Basic usage or getting-started notes:

• bash

• 1. Set up your GitHub token

• export GITHUB_TOKEN=ghp_YOUR_TOKEN

• Source: https://github.com/AppOmni-Labs/heisenberg-ssc-health-check

• Extracted from upstream docs: https://raw.githubusercontent.com/AppOmni-Labs/heisenberg-ssc-health-check/HEAD/README.md

Source

• Agent Skill Exchange