SafeDep Documentation

Your SafeDep Cloud tenant receives data from more than one tool. Each source syncs through its own path and shows up in a different part of the product:

Source	What it sends	Where it appears
`vet scan`	Packages, vulnerabilities, and policy violations per project	Projects and the SQL query tables
PMG	Package install and usage events from endpoints	Endpoint Hub › Package Guard
`vet endpoint scan`	AI tools, coding agents, MCP servers, and Agent Skills found on endpoints	Endpoint Hub › Inventory
GitHub App	Pull request scan results from repositories it is installed on	Projects

Every source needs SafeDep Cloud credentials: a tenant domain and an API key. New to Cloud? Start with the quickstart. This page covers vet scan sync in full. PMG and endpoint inventory sync have their own setup guides, summarized below.

Sync vet scan results

vet scan --report-sync uploads scan results to your tenant, grouped by project and version.

Prerequisites

vet needs SafeDep Cloud credentials before it can sync. The fastest path is the guided setup, which walks through account, tenant, and credentials in one command:

vet cloud quickstart

Already onboarded? See the authentication guide to configure vet with an existing tenant and API key.

Sync a scan

vet scan -M /path/to/package-lock.json --report-sync \
  --report-sync-project my-project \
  --report-sync-project-version my-project-version

--report-sync-project: project identifier. Use a consistent convention, like the repository path (github.com/org/repo), so names stay unique across teams.
--report-sync-project-version: project version, typically a branch, tag, or commit

Scan a whole repository the same way:

vet scan -D /path/to/repository \
  --report-sync \
  --report-sync-project github.com/org/repo \
  --report-sync-project-version main

The examples use package-lock.json, but vet supports many package manifest formats and code analysis.

Separate environments

The version field also separates environments. Sync the same project as production, staging, or a feature branch name, then compare them side by side in SafeDep Cloud:

vet scan -D . \
  --report-sync \
  --report-sync-project myapp \
  --report-sync-project-version staging

Enforce policy while syncing

Sync and policy enforcement run in the same scan. Add a policy suite and --filter-fail to gate the pipeline while results still sync to your tenant:

vet scan -D . \
  --policy-suite policy.yml \
  --filter-fail \
  --report-sync \
  --report-sync-project critical-app \
  --report-sync-project-version main

--policy-suite takes a v2 policy file (see the example in the vet repository); --filter-fail exits non-zero on a violation. The older --filter-suite format is documented in the policy reference.

Sync from GitHub Actions

vet-action syncs automatically when its cloud inputs are set. Add SAFEDEP_CLOUD_API_KEY and SAFEDEP_CLOUD_TENANT_DOMAIN as GitHub Actions secrets, then enable cloud sync in your workflow:

- name: Run vet
  uses: safedep/vet-action@v1
  with:
    cloud: true
    cloud-key: ${{ secrets.SAFEDEP_CLOUD_API_KEY }}
    cloud-tenant: ${{ secrets.SAFEDEP_CLOUD_TENANT_DOMAIN }}

vet-action sets project identification from the repository: the project name is ${{ github.repository }} and the version is ${{ github.ref_name }}.

Sync from other CI systems

The pattern is the same on any CI system: provide SAFEDEP_API_KEY and SAFEDEP_TENANT_ID as environment variables and run vet scan with the --report-sync flags. See CI/CD & Platform Integrations for the full GitLab and Bitbucket guides.

GitLab CI
Jenkins
Azure DevOps

stages:
  - security

security-scan:
  stage: security
  image: ghcr.io/safedep/vet:latest
  script:
    - vet scan -D . --report-sync --report-sync-project $CI_PROJECT_PATH --report-sync-project-version $CI_COMMIT_REF_NAME
  variables:
    SAFEDEP_API_KEY: $SAFEDEP_API_KEY
    SAFEDEP_TENANT_ID: $SAFEDEP_TENANT_ID
  only:
    - main
    - develop
    - merge_requests

pipeline {
    agent any

    environment {
        SAFEDEP_API_KEY = credentials('safedep-api-key')
        SAFEDEP_TENANT_ID = credentials('safedep-tenant-id')
    }

    stages {
        stage('Security Scan') {
            steps {
                sh """
                    vet scan -D . \
                      --report-sync \
                      --report-sync-project ${env.JOB_NAME} \
                      --report-sync-project-version ${env.BRANCH_NAME}
                """
            }
        }
    }
}

trigger:
  branches:
    include:
      - main
      - develop

variables:
  - group: safedep-credentials

jobs:
- job: SecurityScan
  displayName: 'Security Scan and Sync'
  pool:
    vmImage: 'ubuntu-latest'

  steps:
  - script: |
      vet scan -D . \
        --report-sync \
        --report-sync-project $(Build.Repository.Name) \
        --report-sync-project-version $(Build.SourceBranchName)
    displayName: 'Run vet security scan'
    env:
      SAFEDEP_API_KEY: $(safedep-api-key)
      SAFEDEP_TENANT_ID: $(safedep-tenant-id)

What gets synced

Package information

Discovered packages and versions
Dependency relationships and metadata
Package manifest locations and types

Security findings

Vulnerability information and severity levels
OpenSSF Scorecard metrics
License compliance data
Malware analysis results (if enabled)

Policy violations

Policy rule violations and details
Exception applications and status

Project context

Project identification and versioning
Scan timestamps and environment info
Git commit information (when available)

Sync package events from PMG

PMG intercepts package manager commands on the endpoint and records each install as an event. With cloud sync enabled, PMG drains its local event log to your tenant automatically after each invocation, and pmg cloud sync pushes events immediately. Setup, login, and auto-sync tuning live on the Package Guard page:

Package Guard

Enable PMG cloud sync and view package events in Endpoint Hub

Sync AI tool inventory

vet endpoint scan discovers AI tooling on a machine (coding agents, MCP servers, CLI tools, IDE extensions, Agent Skills) and delivers the inventory to your tenant when vet has credentials configured.

Endpoint Inventory

Enable inventory sync and browse discovered AI tooling in Endpoint Hub

Query synced data

Once data lands in your tenant, query it with safedep query exec or the web console. The quickstart has a worked example, and the SQL query guide covers the full schema, join model, and queries across vulnerabilities, licenses, malware findings, and endpoint events.

Troubleshooting

Sync failures

Verify the API key and tenant configuration (vet auth verify)
Check network connectivity to SafeDep Cloud
Ensure project names don’t contain invalid characters

Missing data

Confirm --report-sync and the project flags are set
Check that the scan completed successfully
Verify the project name and version identifiers match what you expect

Authentication issues

Verify the API key has sync permissions
Check the tenant domain configuration
Confirm credentials are set correctly in your CI/CD environment

Cloud Quickstart

Set up the safedep CLI and run your first query

Authentication Guide

SafeDep Cloud authentication methods

Endpoint Hub

AI tooling and package activity across your endpoints

vet-action Documentation

Complete GitHub Actions integration guide

​Sync vet scan results

​Prerequisites

​Sync a scan

​Separate environments

​Enforce policy while syncing

​Sync from GitHub Actions

​Sync from other CI systems

​What gets synced

​Sync package events from PMG

Package Guard

​Sync AI tool inventory

Endpoint Inventory

​Query synced data

​Troubleshooting

Cloud Quickstart

Authentication Guide

Endpoint Hub

vet-action Documentation

Sync vet scan results

Prerequisites

Sync a scan

Separate environments

Enforce policy while syncing

Sync from GitHub Actions

Sync from other CI systems

What gets synced

Sync package events from PMG

Sync AI tool inventory

Query synced data

Troubleshooting