Supply-chain analysis examines provenance, integrity, publisher trust, registry metadata, and typosquatting. SCA/SBOM remains the separate source for component inventory and known vulnerabilities. A professional security owner must combine both before a release decision.
Full scan
python -m src.cli supply-chain scan `
--project <project> `
--format sarif `
--fail-on high `
--output <supply-chain.sarif>
Confirm the project revision and network/cache freshness. Use a score or severity as a triage signal, then record the accountable security or release decision.
Focused checks
python -m src.cli supply-chain trust --project <project> --format json
python -m src.cli supply-chain typosquatting --project <project>
Use supply-chain registry to inspect the component registry and gost-report only when the GOST
assessment is in scope. Check exact subcommand help for the installed release.
Agent workflow
The authorized security role/full MCP profile exposes
codegraph_security_supply_chain_scan_run and
codegraph_security_supply_chain_trust_report_get. These tools are registered in
src/mcp/tools/security_suite/supply_chain.py and use project context rather than agent-supplied
storage paths.
There is no public REST supply-chain route registered in the current application. Use the CLI or authorized role-scoped tools; do not invent parity with SCA REST operations.
Review each finding
- verify the exact package, version, registry, publisher, and artifact digest;
- distinguish missing evidence from confirmed tampering;
- inspect name similarity and namespace ownership before calling a package typosquatting;
- document accepted source, mitigation, owner, and expiry;
- rerun the scan against the remediated lockfile and release revision.
Contract sources
src/cli/security_suite/supply_chain_commands.py— CLI surface;src/supply_chain/— scanner, registry, integrity, trust, and reports;src/mcp/tools/security_suite/supply_chain.py— role-scoped tools;- SCA and SBOM — component and vulnerability workflow.