Móðguðr
The nordisk supply-chain gatekeeper: a leaf Rust crate that hands any artifact a CVE / license / provenance verdict (Pass / Warn / Block) — and, with its heavy SCIP engine, diffs the behaviour of your entire dependency world between two snapshots over a time-travelling Iceberg warehouse.
Mashup — the verdict, plus what changed
A scanner hands you today's verdict; modgunn also remembers every advisory and world-snapshot and tells you what changed — categories the scanners have no concept for (vs Trivy · Snyk · Dependency-Track):
| capability | modgunn | Trivy | Snyk | Dependency-Track |
| Reachability-gated vulns — is the CVE actually called? (SCIP call-graph) | ✅ | ✗ | ✅ | ✗ |
| Whole-world behaviour-delta between snapshots — capability drift, blast-radius, tripwires | ✅ | NA | NA | NA |
| Advisories + world-snapshots in a time-travel + CDC Iceberg warehouse | ✅ | NA | NA | NA |
Embeddable leaf crate — drop the gate (core::Verdict) inside another Rust app |
✅ | ◐ | ✗ | ✗ |
The full matrix — every capability, all rivals — is in the overview. Rows marked NA: the rival has no such category, not a missing feature.
Measured — the verdict hot path
The numbers below are generated from the warehouse bench_runs table by nornir docs render modgunn; they come from nornir bench run modgunn (bench/examples/nornir-bench.rs) over a deterministic synthetic advisory world. fleet_scan is the shipped Engine A (linear match) fleet path, fleet_scan_indexed the Engine B (inverted-index) one over the same fixture — and the harness asserts both find exactly the same findings, so the speedup is honest.
Read the real docs
- 📖 The complete manual —
docs/manual.pdf— every subsystem chapter (both engines, the warehouse seam, exploit-intel gating, the behaviour-delta analyses). - 📄 Full overview —
.nornir/README-full.md— the detailed pitch, the full competitive matrix, what each engine does, and the quickstart. - 📝
docs/book.md— the manual, as Markdown. Search it withnornir docs search modgunn "<query>".