Skip to main content
SafeDep ships several command-line tools. Each one solves a different supply-chain problem, and they run independently, so you install only what you need. This page helps you pick the right tool and points you to its setup guide.

​
Which tool do I need?

Scan code for supply-chain risk

Use Vet to scan repositories, lockfiles, and SBOMs for malicious packages, known vulnerabilities, and policy violations. It is the engine behind SafeDep’s CI/CD scanning.

Block malicious installs on my machine

Use PMG, a guard around npm, pip, and other package managers that blocks known-malicious packages before they install. No account or API key required.

Audit what my AI coding agent does

Use Gryph to record every file read, write, and command your AI coding agent runs. It keeps a local audit log you can query.

Generate a Bill of Materials

Use xBom to inventory dependencies plus AI and SaaS usage detected from your source code, as a CycloneDX BOM.

Deep-scan a package before using it

Use safedep package scan to run an on-demand malware analysis of any package, IDE extension, or GitHub repository. Needs a SafeDep Cloud paid plan or trial.

Work with SafeDep Cloud

Use safedep, the unified CLI for SafeDep Cloud: authentication, on-demand package scanning, endpoint telemetry queries, and AI agent hardening. It is new and still evolving.

​
The tools at a glance

Vet, PMG, and Gryph are free, open source, and work with no SafeDep account. The safedep CLI is the client for SafeDep Cloud’s hosted features. See pricing.

​
How they relate

  • Vet is the scanning engine. It analyzes dependencies and produces risk reports, queries, and SBOMs. It runs standalone or syncs results to SafeDep Cloud.
  • PMG and Gryph are standalone, single-purpose guards. PMG works at package-install time, Gryph around AI coding agents. Neither needs Vet or a SafeDep account.
  • safedep is an emerging unified CLI that brings SafeDep Cloud’s workflows (auth, on-demand package scanning, endpoint telemetry, agent hardening) to the terminal. It does not re-implement local scanning: repository analysis stays in Vet, and on-demand package analysis runs in SafeDep Cloud.
These tools have no “v1 to v2” relationship. safedep is a new Cloud-focused CLI, not a replacement for vet. Vet stays the standalone scanner and the recommended starting point for most users.

​
Install

Each tool is on the SafeDep Homebrew tap. Vet, PMG, Gryph, and safedep are also published to npm; Vet, PMG, Gryph, and xBom ship as pre-built binaries. The most common installs:
For every install method, current versions, and the full command surface, see each tool’s repository: Vet, PMG, Gryph, safedep.

​
Next steps

Vet Quickstart

Scan your first repository for supply-chain risk.

PMG Quickstart

Guard your package installs in minutes.

Gryph Overview

Set up an audit trail for your AI coding agents.

xBom Quickstart

Generate an enriched Bill of Materials from your code.

SafeDep Cloud Quickstart

Onboard to the hosted platform for org-wide visibility.