GUAC vs StepSecurity

GUAC ingests software metadata, including software bills of materials, and connects it into a queryable view of supply-chain relationships. That portfolio-level view lets developers, operations and security practitioners, and Open Source Program Offices examine dependencies across software rather than one SBOM at a time. Teams can look for vulnerable, deprecated, unsupported, or duplicated dependencies and identify risky upstreams using OpenSSF Scorecard. APIs and a visualization tool support queries and exploration. GUAC documents SPDX and CycloneDX SBOM formats, with graph enrichment from OSV for vulnerability data, ClearlyDefined for license information, and Deps.dev for dependency information. Its GraphQL server can use in-memory storage or PostgreSQL for persistence. Collectors can read or watch files, storage buckets, and Git repositories; the filesystem collector is stable, while other collectors are experimental. Setup uses Docker Compose and requires Docker, Docker Compose, and jq. The project is an OpenSSF Incubating Project. GUAC is free and open source: its code is under the MIT license, and documentation content is under CC BY 4.0.

StepSecurity is a software supply chain security platform spanning developer environments, code repositories, and CI/CD pipelines. Harden-Runner uses eBPF to monitor network calls, file writes, and process executions, then relates activity to workflow steps. Dev Machine Guard inventories AI coding agents, MCP servers, IDE extensions, and local packages on developer machines. Secure Registry provides package cooldowns, blocks compromised versions, and offers typosquat protection and blocklists. Code Repo Security screens pull requests and can open remediation pull requests according to policies. Security alerts can go to email, Slack, or Microsoft Teams. Dev Machine Guard can be deployed without an agent through Intune, SCCM, or Jamf on macOS, Windows, and Linux. The Community plan is free for unlimited public repositories and lists GitHub-hosted runners on GitHub Cloud; private repositories are included in the 14-day trial. Dev Machine Guard costs $8 a month per device, while Enterprise costs $16 a month per contributing developer. The Trust Center lists SOC 2 Type 2 and ISO 27001:2022 compliance.