Package registries and enterprises need consistent, portable security decisions across different scanners and vendors. Today each registry builds one-off integrations: different schemas, verdict vocabularies, severity models, and webhook formats. A finding from one provider cannot be compared with, substituted for, or combined with a finding from another under a single policy.
Eclipse SCINTX (Supply Chain Intelligence Exchange) was created to define a vendor-neutral interchange layer between package registries (and CI / feed bridges) and security providers. It normalizes provider output into a common verdict model, applies consumer policy, and emits a signed CloudEvents lifecycle so registries can mix or swap providers without rewriting integrations.
The work originated at Yeeth Security and is proposed for contribution to the Eclipse Foundation as SCINTX (Supply Chain Intelligence Exchange), so the interchange APIs, schemas, and reference gateway can evolve under open governance rather than as a single-vendor product.
Eclipse SCINTX (Supply Chain Intelligence Exchange) defines a vendor-neutral interchange layer between package registries (and CI/feed bridges) and security providers that normalizes provider output into a common verdict model, applies consumer policy, and emits a signed CloudEvents lifecycle.
In scope:
- An interoperability model for package-security assessment: submission API, normalized finding/verdict vocabulary, provider interface, and policy decision model.
- Normative artifacts: OpenAPI description, JSON Schemas, and documentation of the HTTP lifecycle (submit → process → poll / webhook → optional adjudication).
- A reference gateway implementation (orchestration, durable store, optional cache, worker dispatch, signed webhooks).
- Reference and example provider adapters and policy engines (extension model).
- HTTP integration patterns for registries, CI, and external feed bridges (e.g. package-feeds → POST /v1/submissions).
Out of scope:
- Operating a public package registry.
- In-process registry pollers (prefer external feeds posting submissions).
- Replacing or competing with security scanners — the project integrates scanners.
Eclipse SCINTX (Supply Chain Intelligence Exchange) is a vendor-neutral open standard and reference implementation for package-security integration. It sits between package registries / CI systems and security providers. Users submit package artifacts (e.g. by PURL and digests). The gateway assesses them via pluggable providers, evaluates consumer policy, and returns portable decisions and findings. Outcomes can be delivered by polling or signed CloudEvents webhooks; consumers may adjudicate review decisions and share the final allow/deny gate back to the gateway.
The goal is to eliminate duplicated registry–vendor integrations, make security verdicts comparable and portable, and let registries and enterprises mix-and-match conforming providers without lock-in.
The short name “SCINTX” and the proposed project name “SCINTX (Supply Chain Intelligence Exchange)” need to be cleared for Eclipse trademark use. No known conflicting trademark ownership is asserted by the proposers at this time.
The Eclipse Foundation already governs Open VSX, a primary target registry and natural first adopter for SCINTX (Supply Chain Intelligence Exchange). Eclipse provides a proven, vendor-neutral governance model for specifications with competing commercial implementors, and the Eclipse Foundation Specification Process offers the IP stewardship an open standard needs. The existing Eclipse community of registry operators, IDE vendors, and tool builders is the ideal place to incubate a cross-registry security integration standard.
Over the next 12–18 months we expect to:
- Stabilize the HTTP API, OpenAPI, and JSON Schemas toward a versioned 1.0 interchange.
- Expand reference provider adapters beyond the current OSV and stub providers.
- Harden the reference gateway (store/cache backends, webhook reliability, observability).
- Publish conformance guidance for providers and policy engines.
- Grow community: contributor docs, sample registry/CI integrations, and outreach to package ecosystems and security vendors.
- Explore alignment with related open supply-chain efforts (e.g. feed bridges, SBOM/attestation consumers) without expanding past the stated scope.
Rough schedule (exact dates TBD with creation review):
- Proposal / creation review — upon submission and community discussion period.
- Initial contribution — existing public repository code and docs available at proposal time; migrate to Eclipse-hosted git after project creation and IP checklist.
- 0.x releases — iterative reference gateway + schema updates in the first months after creation.
- Community / 1.0 interchange milestone — subject to adopter feedback.
The following individuals, organisations, companies and projects have expressed interest in this project:
- Yeeth Security (initial contributor)
- Open VSX / Eclipse Foundation ecosystem
The initial contribution is the existing SCINTX codebase developed by Yeeth Security and available at:
https://github.com/yeeth-security/scintx
- Log in to post comments