Tamp 

Tamp's small core: target executor, parameter injection, host detection, secret handling, dry-run support. The lifecycle bet is that this stays small and tool wrappers ship as independently-versioned packages.

Tamp wrapper for the .NET 10 SDK CLI (`dotnet build`, `test`, `pack`, `publish`, `restore`, ...). Pinned to .NET 10's CLI surface; sibling packages exist for other supported majors.

Tamp global tool. Install via `dotnet tool install -g Tamp.Cli`; invoke as `tamp <target>`. For the `dotnet tamp <target>` form, install the sibling `dotnet-tamp` package instead.

Tamp global tool, dotnet-verb flavor. Install via `dotnet tool install -g dotnet-tamp`; invoke as `dotnet tamp <target>`. For the bare `tamp <target>` form, install the sibling `Tamp.Cli` package instead.

Tamp wrapper for Azure Functions Core Tools (func) 4.x. v0.1.0 covers: Publish (FC1-friendly: --build, --no-build, --slot, access token via stdin Secret), LogStream, FetchAppSettings, ListFunctions, Version,... More information

Tamp wrapper for the .NET 9 SDK CLI (`dotnet build`, `test`, `pack`, `publish`, `restore`, ...). For long-term projects that adopted .NET 9 STS to surface early features and will roll forward to LTS before... More information

Tamp wrapper for the .NET 8 LTS SDK CLI (`dotnet build`, `test`, `pack`, `publish`, `restore`, ...). For locked-down environments and federal/regulated dev shops where newer SDKs are not approved.

Tamp wrapper for the Microsoft dotnet-coverage tool (current major v17). Cross-platform code-coverage collection + merge + format conversion (binary, xml, cobertura). For Sonar integration, the typical flow is... More information

Tamp's SARIF 2.1.0 contract package: typed records (SarifReport, SarifRun, SarifResult, ...) plus load/write/merge helpers and the IFindingSource interface. Scanner satellites emit SarifReport; sinks consume... More information

Tamp's CycloneDX SBOM contract package: typed records (CycloneDxBom, Component, Vulnerability with inline VEX, Dependency, ...) plus load/write helpers and the ISbomSource/ISbomSink interfaces. Producers... More information

Tamp wrapper for SonarScanner for .NET (the dotnet-sonarscanner global tool, current major v10). Two-phase begin/end invocation around the build, command-line driven (no properties file). For non-.NET projects... More information

Tamp meta-package — one PackageReference, one base-class inheritance, get the whole Wave 1+2 security chain: CycloneDX SBOM → SAST (OpenGrep + Roslyn) → SCA (osv-scanner + Dependency-Track) → Trivy... More information

Tamp CommandPlan wrapper for the `dotnet-CycloneDX` global tool (6.x) — generates CycloneDX SBOMs from .NET projects and solutions. Pinned to 6.x: the 5→6 boundary renamed --json to --output-format Json,... More information

Tamp CommandPlan wrapper for Aqua Security's `trivy` CLI. Single satellite, three scan modes — `trivy image` (container vulnerability scanning incl. OS-package layer that lockfile scanners miss), `trivy config`... More information

Tamp REST client for DefectDojo (API v2). Push SARIF findings and Dependency-Track FPF exports into a DefectDojo engagement via import-scan / reimport-scan. Reimport reconciles against prior scans so triage... More information

Foundation library for HTTP-API wrappers in Tamp. TampApiClient base class handles HttpClient construction, Basic/Bearer/CustomHeader auth with Secret-redacted credentials, JSON serialization, and typed error... More information

Tamp REST client for OWASP Dependency-Track v4.x (API v1). Upload CycloneDX BOMs, poll the asynchronous analysis to completion, export findings in raw FPF JSON for downstream passthrough to DefectDojo. Uses... More information

Tamp CommandPlan wrapper for Google's `osv-scanner` (2.x). Cross-ecosystem SCA: reads a CycloneDX SBOM or per-language lockfiles, queries OSV.dev (npm, PyPI, Cargo, Go, Maven, NuGet, Packagist, Pub, …), emits... More information

Tamp CommandPlan wrapper for the `opengrep` CLI. Pattern-based SAST scanner forked from Semgrep with cleaner licensing (multi-vendor governance, no Pro paywall). Defaults to SARIF output because the Wave 1... More information

Typed C# client + DTOs for the tamp-ingest-v1 egress contract — the canonical wire shape any Tamp.Security.Pipeline-driven build pushes to a compliant dashboard / defect tracker / evidence vault. First... More information