SafeDep
Supply chain security guarding AI coding agents and dependencies.
About
SafeDep is a real-time open-source software supply chain security platform that analyzes every package published to major registries around the clock. Its open-source vet CLI scans dependencies for malware and vulnerabilities across npm, PyPI, Maven, Go, containers, and SBOMs, with policy-as-code enforcement via CEL filters and CycloneDX SBOM output.
What earns it a place in an AI catalog is its AI-native posture: it vets what AI coding agents install, audits agent skills, plugins, MCP servers, and tools agents invoke, and ships an MCP server plus AI agents that query and analyze scan results. Its research team regularly discloses campaigns like typosquat trojans targeting Claude Code and Cursor users, making it a timely defense layer for the agent era.
What it can do
- Real-time malicious package detection across major registries
- Vetting of AI agent skills, plugins, and MCP servers
- MCP server for hosted governance and fleet visibility
- Policy-as-code with CEL filters and SBOM output
- Free forever for individual use
Setup
Install the vet CLI via brew (safedep/tap/vet) or npm; run vet scan in any repo. Cloud dashboard optional.
Prerequisites
None for the CLI; SafeDep Cloud account for higher rate limits and fleet features.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 124; Trending score 78/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.