SafeDep

🎯 Why vet?

70-90% of modern software constitute code from open sources — How do we know if it's safe? vet is an open source software supply chain security tool built for developers and security engineers who need: ✅ Next-gen Software Composition Analysis — Vulnerability and malicious package detection ✅ Policy as Code — Express opinionated security policies using CEL ✅ Real-time malicious package detection — Powered by SafeDep Cloud active scanning ✅ Multi-ecosystem support — npm, PyPI, Maven, Go, Docker, GitHub Actions, and more ✅ CI/CD native — Built for DevSecOps workflows with support for GitHub Actions, GitLab CI, and more ✅ MCP Server — Run vet as a MCP server to vet open source packages from AI suggested code ✅ Agents — Run AI agents to query and analyze scan results

⚡ Quick Start

Install in seconds:

brew install safedep/tap/vet

or download a pre-built binary

Scan your project:

vet scan -D .\n\n# Scan a single file
vet scan -M package-lock.json\n\n# Fail CI on critical vulnerabilities
vet scan -D . --filter 'vulns.critical.exists(p, true)' --filter-fail\n\n# Fail CI on OpenSSF Scorecard requirements
vet scan -D . --filter 'scorecard.scores.Maintained < 5' --filter-fail\n\n# Fail CI if a package is published from a GitHub repository with less than 5 stars
vet scan -D . --filter 'projects.exists(p, p.type == "GITHUB" && p.stars < 5)' --filter-fail

🔒 Key Features# 🕵️ Code Analysis

Unlike dependency scanners that flood you with noise, vet analyzes your actual code usage to prioritize real risks. See dependency usage evidence for more details.\n\n### 🛡️ Malicious Package Detection Integrated with SafeDep Cloud for real-time protection against malicious packages in the wild. Free for open source projects. Fallback to Query Mode when API key is not provided. Read more about malicious package scanning.\n\n### 📋 Policy as Code Define security policies using CEL expressions to enforce context specific security requirements.

vet scan \
- -filter 'vulns.critical.exists(p, true)'\n\n# Enforce license compliance
vet scan \
- -filter 'licenses.contains_license("GPL-3.0")'\n\n# Enforce OpenSSF Scorecard requirements\n\n# Require minimum OpenSSF Scorecard scores
vet scan \
- -filter 'scorecard.scores.Maintained < 5'
```\n\n### 🎯 **Multi-Format Support**
- **Package Managers**: npm, PyPI, Maven, Go, Ruby, Rust, PHP
- **Container Images**: Docker, OCI
- **SBOMs**: CycloneDX, SPDX
- **Binary Artifacts**: JAR files, Python wheels
- **Source Code**: Direct repository scanning

## 🤖 **MCP Server**
**vet** can be used as an MCP server to vet open source packages from AI suggested code.
```bash\n\n# Start the MCP server with SSE transport
vet server mcp --server-type sse

For more details, see vet MCP Server documentation.