Software Supply Chain (SBOM, Signing, Open Source Security)
Standards market (sbom formats, signing, foundation membership, compliance-programme conformance). The Kin Score Market layer reads each provider in its market: who it integrates with, how deep those integrations go, and where the market publishes its own structure. Methodology.
Where this market publishes its structure
- OpenSSF Landscape members (github.com/ossf/ossf-landscape landscape.yml @0c50858516) machine-readable, 113 members (Premier 14, General 75, Associate 24); 20 linked; 30 held out-of-market (AWS, Google, Microsoft, Apple, banks, Honda...)
- Sigstore landscape (same file: Integrations, Language Clients, Projects) machine-readable, 57 entries; 8 linked; 17 users (Signed With, Case Studies) held
- CycloneDX Tool Center (cyclonedx.org/tool-center, server-rendered tool cards) machine-readable, 316 tools / 227 publishers; 29 linked
- SPDX Tools (spdx.dev/use/spdx-tools, server-rendered vendor cards) machine-readable, 73 tools; 4 linked (mostly open-source projects on github.com)
- OpenChain Community of Conformance (openchainproject.org/community-of-conformance) machine-readable, 195 entries (5230: 164, 18974: 31), self-declared; 3 linked; 38 held out-of-market
- openssf.org/about/members not machine-readable: client-rendered; read through the OpenSSF landscape instead
- SLSA adopters / conformance not machine-readable: no register exists (slsa-framework/slsa holds nav data only)
- Sigstore public-good instance users (Rekor) not machine-readable: a transparency log of signatures, not a register of organisations
- OWASP DefectDojo parsers (dojo/tools, 369) not machine-readable: tool names only, no publisher or domain; a parser reads a tool's output format (compatible, report-only); not linked
Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.
Taxonomy how this market maps onto apis.io
Derived 2026-10-23 from the 50 providers in this market we could resolve in the catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.
| Tags | DevSecOps 36%, Security 32%, Vulnerability Management 30%, Application Security 30%, Software Composition Analysis 28%, Developer Tools 24%, Open Source 22%, SAST 22%, SBOM 20% |
|---|---|
| Tag groups | DevSecOps 56%, Security 52%, SBOM 36%, Developer Tools 32%, Repository 24%, Testing 20% |
| Industries | Developer Tools & DevOps 80%, Cybersecurity & Identity 58%, Artificial Intelligence 26% |
| Areas | Security 34%, Testing 10%, Containers 10% |
| Capabilities | Cybersecurity Management 40% |
share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py
Leaders by position (provisional)
Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside position, never inside it. Unknown-builder listings are left out of position shares and counted here.
builds-on 16 · publishes apps on other platforms' stores
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Veracode | 54.0 | 15 | 0 / 15 | 0 | 3 | 0 | contract 12%, standard 19%, builds-on-platform 50%, distribution 19% |
| Sonatype | 53.7 | 13 | 0 / 13 | 0 | 0 | 0 | standard 46%, builds-on-platform 54% |
| Checkmarx | 53.3 | 13 | 0 / 13 | 0 | 1 | 0 | standard 43%, builds-on-platform 50%, distribution 7% |
| Contrast Security | 53.3 | 15 | 0 / 15 | 0 | 2 | 1 | ipaas-bridge 7%, standard 27%, builds-on-platform 53%, distribution 13% |
| OpenText Cybersecurity | 52.1 | 5 | 0 / 5 | 0 | 0 | 0 | standard 33%, builds-on-platform 67% |
| Aikido Security | 51.8 | 14 | 0 / 14 | 0 | 2 | 0 | standard 29%, builds-on-platform 57%, distribution 14% |
| Black Duck | 49.4 | 10 | 0 / 10 | 0 | 1 | 0 | standard 40%, builds-on-platform 50%, distribution 10% |
| Mend | 48.9 | 8 | 0 / 8 | 0 | 1 | 0 | standard 25%, builds-on-platform 62%, distribution 12% |
| SonarSource | 47.1 | 10 | 0 / 10 | 0 | 2 | 0 | standard 20%, builds-on-platform 60%, distribution 20% |
| Xbow | 46.0 | 4 | 0 / 4 | 0 | 1 | 0 | standard 25%, builds-on-platform 50%, distribution 25% |
| Assembled | 43.5 | 10 | 0 / 10 | 0 | 0 | 2 | ipaas-bridge 20%, standard 10%, builds-on-platform 70% |
| TestFairy | 36.4 | 3 | 0 / 3 | 0 | 2 | 0 | builds-on-platform 33%, distribution 67% |
| Browserless | 19.7 | 4 | 0 / 4 | 0 | 0 | 3 | ipaas-bridge 75%, builds-on-platform 25% |
| Klaus | 19.7 thin | 2 | 0 / 2 | 0 | 0 | 1 | ipaas-bridge 50%, builds-on-platform 50% |
| Geekflare | 19.2 | 4 | 0 / 4 | 0 | 2 | 2 | ipaas-bridge 40%, builds-on-platform 20%, distribution 40% |
| Fortify | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | builds-on-platform 100% |
standard 29 · listed by a voluntary standard's own directory
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| In-Toto | 56.5 | 4 | 0 / 4 | 0 | 0 | 0 | standard 100% |
| Sonar | 56.5 | 4 | 0 / 4 | 0 | 0 | 0 | standard 50%, builds-on-platform 50% |
| GoHarbor | 55.6 | 5 | 0 / 5 | 0 | 0 | 0 | standard 80%, builds-on-platform 20% |
| Tekton | 54.9 | 6 | 0 / 6 | 0 | 0 | 0 | standard 83%, builds-on-platform 17% |
| Synopsys | 53.0 | 9 | 0 / 9 | 0 | 0 | 0 | standard 78%, builds-on-platform 22% |
| Chainguard | 52.2 | 14 | 0 / 14 | 0 | 2 | 0 | standard 43%, builds-on-platform 43%, distribution 14% |
| Fossa | 51.7 | 4 | 0 / 4 | 0 | 0 | 0 | standard 75%, builds-on-platform 25% |
| Ko | 51.7 | 4 | 0 / 4 | 0 | 0 | 0 | standard 50%, builds-on-platform 50% |
| Manifest Cyber | 51.7 | 3 | 0 / 3 | 0 | 0 | 0 | standard 100% |
| Stacklok | 51.7 | 3 | 0 / 3 | 0 | 0 | 0 | standard 67%, builds-on-platform 33% |
| RapidFort | 51.1 | 6 | 0 / 6 | 0 | 1 | 0 | standard 67%, builds-on-platform 17%, distribution 17% |
| Apiiro | 50.1 | 10 | 0 / 10 | 0 | 2 | 0 | standard 45%, builds-on-platform 36%, distribution 18% |
| Kyverno | 49.0 | 9 | 0 / 9 | 0 | 2 | 0 | standard 67%, builds-on-platform 11%, distribution 22% |
| Legit Security | 47.1 | 5 | 0 / 5 | 0 | 1 | 0 | standard 60%, builds-on-platform 20%, distribution 20% |
| Defense Unicorns | 46.4 | 5 | 0 / 5 | 0 | 2 | 0 | standard 60%, distribution 40% |
| Socket | 44.1 | 9 | 0 / 9 | 0 | 4 | 0 | standard 30%, builds-on-platform 30%, distribution 40% |
| Tidelift | 44.1 | 3 | 0 / 3 | 0 | 1 | 0 | standard 67%, distribution 33% |
| Endor Labs | 42.5 | 5 | 0 / 5 | 0 | 2 | 0 | standard 40%, builds-on-platform 20%, distribution 40% |
| Semgrep | 38.3 | 5 | 0 / 5 | 0 | 1 | 1 | ipaas-bridge 20%, standard 40%, builds-on-platform 20%, distribution 20% |
| Kondukto | 36.4 | 3 | 0 / 3 | 0 | 2 | 0 | standard 33%, distribution 67% |
| Root (fka Slim.ai) | 34.5 thin | 2 | 0 / 2 | 0 | 0 | 0 | standard 100% |
| Trivy | 34.5 thin | 2 | 0 / 2 | 0 | 0 | 0 | standard 100% |
| Anaconda | 26.8 thin | 2 | 0 / 2 | 0 | 1 | 0 | standard 50%, distribution 50% |
| Observe.AI | 26.8 thin | 2 | 0 / 2 | 0 | 1 | 0 | standard 50%, distribution 50% |
| Gradle | 23.6 thin | 1 | 0 / 1 | 0 | 0 | 0 | standard 100% |
| Amazon Inspector | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | standard 100% |
| FOSSology | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | standard 100% |
| Oligo | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | standard 100% |
| pnpm | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | standard 100% |
distribution 2 · only sells through cloud marketplaces
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Artillery | 19.2 thin | 2 | 0 / 2 | 0 | 2 | 0 | distribution 100% |
| Treblle | 8.3 | 13 | 0 / 13 | 0 | 1 | 0 | distribution 100% |
undeclared 3 · declares nothing we can read: no number
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Amazon CodeArtifact | undeclared | - | - | - | - | - | |
| Amazon Device Farm | undeclared | - | - | - | - | - | |
| TempMailGrab API | undeclared | - | - | - | - | - |
Generated 2026-10-24 from API Evangelist's own files; nothing on this page is a model's judgement. Provisional and unweighted; not part of the Kin Score composite or agent readiness. Read the Market layer methodology. Disagree with an edge? Every edge cites its evidence and can be corrected through the normal correction path.