Supply Chain Visibility
New in v0.9Track dependencies and vulnerabilities in your AI agent stack. Monitor models, packages, tools, and APIs for security issues.
Overview
AI agents depend on a complex stack of models, packages, tools, and services. Supply Chain Visibility helps you track these dependencies, verify their integrity, and monitor for security vulnerabilities.
Dependency Tracking
Register and track all agent dependencies
Vulnerability Scanning
Match dependencies against known CVEs
Verification
Mark dependencies as verified/trusted
Health Scoring
Calculate overall supply chain security
Dependency Types
| Type | Examples | Tracked Properties |
|---|---|---|
| model | gpt-4, claude-3, llama-2 | Version, provider, capabilities |
| package | langchain, crewai, numpy | Version, source, license |
| tool | web_search, calculator | Permissions, provider |
| service | database, cache, queue | Endpoint, authentication |
| api | weather_api, maps_api | Version, rate limits |
| mcp_server | Custom MCP servers | Tools provided, security config |
Register Dependencies
Supply-chain tracking is a cloud capability: the dependency inventory, the vulnerability matches and the health score all live server-side, so every call here goes to the Tork API with your API key.
The cloud entry class TorkClient ships in @torknetwork/sdk (npm, v2.0.0) and covers the governance surface. Supply-chain endpoints are called over REST, shown below. This is a different package from the on-device tork-governance family, whose only entry class is Tork and which never makes a network call without an API key. There is no Python cloud client, so the Python tab uses requests with a Bearer token.
import os
import requests
BASE = "https://tork.network/api/v1/supply-chain"
HEADERS = {
"Authorization": f"Bearer {os.environ['TORK_API_KEY']}",
"Content-Type": "application/json",
}
def register(**dep):
r = requests.post(f"{BASE}/dependencies", headers=HEADERS, json=dep, timeout=10)
r.raise_for_status()
return r.json()["dependency"]
# Register a model dependency
register(
agentId="agent-1",
dependencyType="model",
dependencyName="gpt-4",
dependencyVersion="0613",
dependencySource="openai",
isDirect=True,
)
# Register a package dependency
register(
agentId="agent-1",
dependencyType="package",
dependencyName="langchain",
dependencyVersion="0.1.0",
dependencySource="pypi",
license="MIT",
isDirect=True,
)
# Register a tool dependency
register(
agentId="agent-1",
dependencyType="tool",
dependencyName="web_search",
dependencyVersion="1.0.0",
dependencySource="internal",
isDirect=True,
)Check for Vulnerabilities
Scan registered dependencies against known vulnerability databases:
# Check all registered dependencies for an agent
r = requests.get(
f"{BASE}/vulnerabilities",
headers=HEADERS,
params={"action": "check", "agent_id": "agent-1"},
timeout=10,
)
r.raise_for_status()
data = r.json()
print(f"Matches found: {data['total']}")
print(f"Open: {data['openCount']}")
for match in data["matches"]:
print(f" {match['status']}: {match['vulnerabilityId']}")
# Counts by severity
r = requests.get(
f"{BASE}/vulnerabilities",
headers=HEADERS,
params={"action": "count", "agent_id": "agent-1"},
timeout=10,
)
r.raise_for_status()
print(r.json())Vulnerability Records
action: "check" only finds what has been loaded. Add records with POST /vulnerabilities (action: "add") and re-run matching with action: "match".Get Health Score
Calculate an overall supply chain health score:
# Full health report for an agent
r = requests.get(
f"{BASE}/health",
headers=HEADERS,
params={"action": "report", "agent_id": "agent-1"},
timeout=10,
)
r.raise_for_status()
report = r.json()["report"]
print(f"Health Score: {report['healthScore']}/100")
print("\nDependencies:")
print(f" Total: {report['totalDependencies']}")
print(f" Direct: {report['directDependencies']}")
print(f" Transitive: {report['transitiveDependencies']}")
print(f" Verified: {report['verifiedDependencies']}")
print(f" Unverified: {report['unverifiedDependencies']}")
print("\nVulnerabilities:")
print(f" Open: {report['openVulnerabilities']}")
print(f" Critical: {report['criticalVulnerabilities']}")
print("\nRecommendations:")
for rec in report["recommendations"]:
print(f" - {rec}")
# Or just the number
r = requests.get(
f"{BASE}/health",
headers=HEADERS,
params={"action": "score", "agent_id": "agent-1"},
timeout=10,
)
print(r.json()["healthScore"])Verify Dependencies
Mark a dependency as verified after security review. If you pass expectedHash, Tork compares it to the checksum stored at registration and refuses to mark the row verified on a mismatch — or when there is no stored checksum to compare against.
# Verify a dependency after security review
r = requests.post(
f"{BASE}/verify",
headers=HEADERS,
json={
"dependencyId": "dep_123",
"expectedHash": "sha256:...", # optional, but this is the check
"verifiedBy": "security@company.com", # defaults to the API key's user
},
timeout=10,
)
r.raise_for_status()
result = r.json()
print(f"Verified: {result['verified']}")
print(f"Integrity: {result['integrity']}") # match | mismatch | no_stored_checksum | not_checked
print(f"Source trusted: {result['trust']['trusted']}")
# List dependencies and their verification status
r = requests.get(
f"{BASE}/dependencies",
headers=HEADERS,
params={"agent_id": "agent-1"},
timeout=10,
)
r.raise_for_status()
for dep in r.json()["dependencies"]:
status = "Verified" if dep["verified"] else "Unverified"
print(f"{dep['dependencyName']}@{dep.get('dependencyVersion')}: {status}")MCP Tools
| Tool | Description |
|---|---|
tork_supply_chain_register | Register a new dependency |
tork_supply_chain_vulns | Scan for vulnerabilities |
tork_supply_chain_health | Get supply chain health score |
tork_supply_chain_verify | Mark dependency as verified |
tork_supply_chain_deps | List all dependencies |