# SafeDep Documentation

- [What is SafeDep?](https://docs.safedep.io/introduction.md): SafeDep protects developers and AI coding agents against malicious open source components: block them before they run, govern the rest.
- [Choose Your Path](https://docs.safedep.io/get-started/choose-your-path.md): Start free with the open source tool that fits your use case. Add SafeDep Cloud when your team needs one view.
- [SafeDep CLI Tools](https://docs.safedep.io/get-started/cli-tools.md): Which SafeDep command-line tool to use: Vet, PMG, Gryph, and the safedep CLI, and how they fit together.
- [Install the SafeDep Skill](https://docs.safedep.io/get-started/safedep-skill.md): Add the SafeDep Agent Skill to Claude Code or any skills-capable AI coding agent.
- [Malicious Package](https://docs.safedep.io/concepts/malicious-package.md): What a malicious open-source package is, how it differs from a vulnerability, and how SafeDep detects them.
- [Vulnerability](https://docs.safedep.io/concepts/vulnerability.md): What a vulnerability is in an open-source dependency, and how SafeDep surfaces and gates them.
- [Policy](https://docs.safedep.io/concepts/policy.md): A SafeDep policy is a set of CEL rules that decide which dependencies pass or fail, enforced during scans and in CI/CD.
- [CEL](https://docs.safedep.io/concepts/cel.md): Common Expression Language (CEL) is the syntax SafeDep uses for filters, queries, and policy rules over package data.
- [SBOM](https://docs.safedep.io/concepts/sbom.md): A Software Bill of Materials (SBOM) is a complete inventory of your software's components; an xBOM enriches it with AI, SaaS, and crypto usage.
- [Tenant](https://docs.safedep.io/concepts/tenant.md): A tenant is your organization's isolated space in SafeDep Cloud, identified by its tenant domain such as your-company.safedep.io.
- [Endpoint](https://docs.safedep.io/concepts/endpoint.md): An endpoint is a developer machine, CI runner, or agent sandbox that runs SafeDep tooling and reports inventory to Endpoint Hub.
- [Package Security](https://docs.safedep.io/package-security/overview.md): Block malicious open-source packages before they reach your code, on developer machines and in CI/CD.
- [PMG](https://docs.safedep.io/package-security/pmg/overview.md): PMG wraps your package managers and blocks malicious packages at install time, before any code runs. Free, open source, no account required.
- [PMG Quickstart](https://docs.safedep.io/package-security/pmg/quickstart.md): Install and configure PMG (Package Manager Guard) to block malicious packages at install time.
- [PMG System Install](https://docs.safedep.io/package-security/pmg/system-install.md): Install PMG for all users on Linux or Windows machines, including shared VMs, CI runners, and Linux container images.
- [Kernel Enforcement on Linux](https://docs.safedep.io/package-security/pmg/kernel-enforcement.md): Make the Linux kernel route every package install through PMG, on VMs, build hosts, self-hosted CI runners, and the containers they start.
- [PMG in Kubernetes](https://docs.safedep.io/package-security/pmg/kubernetes.md): Block package installs inside Kubernetes workloads and report PMG events with a stable workload identity.
- [Deploy PMG with MDM](https://docs.safedep.io/package-security/pmg/mdm/overview.md): Install PMG on macOS, Linux, and Windows fleets through Jamf, JumpCloud, Intune, or another MDM.
- [Jamf](https://docs.safedep.io/package-security/pmg/mdm/jamf.md): Deploy PMG to macOS devices with a Jamf script payload or package.
- [JumpCloud](https://docs.safedep.io/package-security/pmg/mdm/jumpcloud.md): Deploy PMG to macOS, Linux, or Windows devices with JumpCloud Commands.
- [Intune](https://docs.safedep.io/package-security/pmg/mdm/intune.md): Deploy PMG to macOS, Linux, or Windows devices with Intune scripts, or package a Windows Win32 app.
- [On-Demand Package Scanning](https://docs.safedep.io/package-security/scan/overview.md): Run an on-demand malware analysis of any package, IDE extension, or GitHub repository before you use it.
- [Package Scan Quickstart](https://docs.safedep.io/package-security/scan/quickstart.md): Install the safedep CLI, sign in to SafeDep Cloud, and run your first on-demand package scan.
- [Scanning from CI and AI Agents](https://docs.safedep.io/package-security/scan/automation.md): Use on-demand package scanning from scripts and AI agents: authentication model, JSON output, verdict gating, polling, and retries.
- [PMG in GitHub Actions](https://docs.safedep.io/package-security/pmg/github-actions.md): Block malicious packages in GitHub Actions CI by routing package installs through PMG's persistent proxy.
- [AI Agent Security](https://docs.safedep.io/ai-security/overview.md): Discover, audit, and control what AI coding agents access and run across your developer environments.
- [AI Tools Discovery](https://docs.safedep.io/ai-security/ai-tools-discovery.md): Discover AI coding agents, MCP servers, CLI tools, IDE extensions, and agent skills across developer machines and project repositories
- [Gryph](https://docs.safedep.io/ai-security/gryph-overview.md): Gryph records what your AI coding agents do, every file read, write, and command, to a local audit log you can query and replay.
- [SafeDep MCP Server](https://docs.safedep.io/ai-security/mcp-server.md): Protect your AI coding agents against malicious packages using SafeDep MCP
- [Visibility & Governance](https://docs.safedep.io/governance/overview.md): Scan repositories, SBOMs, and CI/CD for supply-chain risk, and govern policy and visibility across your org.
- [Vet](https://docs.safedep.io/governance/vet/overview.md): Vet is a free, open-source SCA scanner that finds malicious, vulnerable, and risky open-source dependencies in code and CI/CD.
- [Vet Quickstart](https://docs.safedep.io/governance/vet/quickstart.md): Get started with Vet in under 5 minutes
- [Dependency Inventory](https://docs.safedep.io/governance/vet/dependency-inventory.md): Generate accurate dependency inventories using package managers and SBOM tools
- [Dependency Usage](https://docs.safedep.io/governance/vet/dependency-usage.md): Identify which dependencies are actually used in your code using static code analysis
- [Code Analysis](https://docs.safedep.io/governance/vet/code-analysis.md): Analyze code and dependency usage patterns with Vet's code analysis features
- [Deploy vet with MDM](https://docs.safedep.io/governance/vet/mdm/overview.md): Install, update, and remove vet across macOS and Linux fleets, then add optional visibility tasks through your MDM.
- [xBom](https://docs.safedep.io/governance/xbom/overview.md): xBom generates a Bill of Materials enriched with AI and SaaS usage by analyzing your source code, not just manifests.
- [xBom Quickstart](https://docs.safedep.io/governance/xbom/quickstart.md): Get started with SafeDep xBom, an open source Bill of Materials generator enriched with AI and SaaS usage detected from source code.
- [CycloneDX SBOM](https://docs.safedep.io/governance/cyclonedx-sbom.md): Generate a Software Bill of Materials (SBOM) with security metadata using Vet
- [AI Governance](https://docs.safedep.io/governance/ai-governance.md): Gain visibility into AI usage across your codebase and developer environments
- [Shadow AI in Code](https://docs.safedep.io/governance/shadow-ai-detection.md): Detect AI and LLM SDK usage in your codebase using static code analysis and generate an SBOM with AI component evidence
- [Generate an AI BOM](https://docs.safedep.io/governance/vet/ai-bom.md): Build an AI Bill of Materials from source code with vet's xBOM engine: AI SDK detections in CycloneDX with file and line evidence.
- [Platform Integrations](https://docs.safedep.io/governance/integrations/overview.md): Integrate Vet into your CI/CD and developer platforms for automated supply-chain scanning.
- [GitHub App](https://docs.safedep.io/governance/integrations/github.md): Set up the SafeDep GitHub App to scan pull requests for supply-chain risk.
- [GitHub Code Scanning](https://docs.safedep.io/governance/integrations/github-code-scanning.md): Integrate Vet with GitHub Actions and Code Scanning for automated security alerts.
- [GitLab Dependency Scanning](https://docs.safedep.io/governance/integrations/gitlab.md): Native GitLab integration for dependency security scanning with Vet.
- [Bitbucket Cloud App](https://docs.safedep.io/governance/integrations/bitbucket-app.md): Install the SafeDep app for Bitbucket Cloud and link your workspace to scan pull requests for supply-chain risk.
- [Bitbucket Pipes](https://docs.safedep.io/governance/integrations/bitbucket.md): Native Bitbucket Cloud integration for SafeDep
- [DefectDojo Integration](https://docs.safedep.io/governance/integrations/defectdojo.md): Integrate Vet with DefectDojo for centralized vulnerability tracking and management
- [Terraform Supply Chain Audit](https://docs.safedep.io/governance/terraform-audit.md): Audit Terraform provider inventory for supply chain risks using SafeDep Cloud
- [SafeDep Cloud](https://docs.safedep.io/governance/cloud/overview.md): Hosted control plane that centralizes policy, malicious-package intelligence, and fleet-wide visibility across your organization.
- [SafeDep Cloud Quickstart](https://docs.safedep.io/governance/cloud/quickstart.md): Create a SafeDep Cloud tenant, authenticate the safedep CLI, connect a data source, and run your first query
- [Authentication](https://docs.safedep.io/governance/cloud/authentication.md): How SafeDep Cloud authentication works and how to authenticate the safedep CLI, vet, and CI/CD pipelines
- [Usage & On-Demand Billing](https://docs.safedep.io/governance/cloud/usage-billing.md): How SafeDep Cloud seat allowances and usage-based on-demand billing work, and the CLI commands to inspect and manage them.
- [Cloud Sync](https://docs.safedep.io/governance/cloud/sync.md): How vet, PMG, and vet endpoint scan send data to your SafeDep Cloud tenant, and how to set up each source
- [Talk to SafeDep](https://docs.safedep.io/governance/cloud/talk-to-safedep.md): Ask your supply chain questions in plain English and let an AI agent answer from your SafeDep Cloud tenant using the safedep CLI.
- [Send Alerts from SafeDep Cloud](https://docs.safedep.io/governance/cloud/alerts.md): Turn any safedep query exec result into a Slack, Discord, Teams, PagerDuty, or custom HTTP alert.
- [Ingest Package Guard Events to CrowdStrike SIEM](https://docs.safedep.io/governance/cloud/crowdstrike-siem.md): Forward PMG malicious-package and dependency-cooldown block events from SafeDep Cloud to a CrowdStrike SIEM HEC endpoint.
- [Endpoint Hub](https://docs.safedep.io/governance/cloud/endpoint-hub/overview.md): Visibility into AI tooling and package activity across your developer machines, CI runners, and agent sandboxes
- [Endpoint Inventory](https://docs.safedep.io/governance/cloud/endpoint-hub/inventory.md): View AI tools, Agent Skills, MCP servers, and coding agents discovered on your endpoints in SafeDep Cloud
- [Endpoint Scan Catalog](https://docs.safedep.io/governance/cloud/endpoint-hub/inventory-catalog.md): Catalog of all inventory items collected from endpoint scans
- [Package Guard](https://docs.safedep.io/governance/cloud/endpoint-hub/package-guard.md): Monitor and control package installations across your endpoints using SafeDep Cloud
- [MCP Advisor](https://docs.safedep.io/governance/cloud/endpoint-hub/mcp-advisor.md): Review the packages your AI coding agents checked through the SafeDep MCP server, per endpoint in SafeDep Cloud
- [Agentic Endpoint Investigation](https://docs.safedep.io/governance/cloud/endpoint-hub/agentic-investigation.md): Investigate package activity and AI tooling across your developer endpoints with an AI coding agent and the safedep CLI.
- [Malware Analysis](https://docs.safedep.io/governance/cloud/malware-analysis.md): Detect malicious packages in your dependencies by querying SafeDep's known malicious packages database
- [Malicious Package Exclusions](https://docs.safedep.io/governance/cloud/package-exclusions.md): Manage package exclusions for malicious package analysis in SafeDep Cloud
- [Threat Intel Feed](https://docs.safedep.io/threat-intel/overview.md): A feed of malicious open-source packages, served as an incremental API stream of reports and campaigns.
- [Quickstart](https://docs.safedep.io/threat-intel/quickstart.md): Set your credentials and run your first Threat Intel Feed query with curl.
- [Concepts](https://docs.safedep.io/threat-intel/concepts.md): The Threat Intel Feed data model: reports, verdicts, confidence, withdrawal, indicators, campaigns, and the change cursor.
- [Connecting](https://docs.safedep.io/threat-intel/connecting.md): Transport, base URL, request headers, authentication, and JSON conventions for the Threat Intel Feed API.
- [Pagination & sync](https://docs.safedep.io/threat-intel/pagination.md): Cursor pagination for every list RPC, and the incremental-pull pattern that keeps a local mirror of the Threat Intel Feed in sync.
- [Package reports](https://docs.safedep.io/threat-intel/package-reports.md): List and fetch malicious package reports, with filters by ecosystem, verdict, time, and withdrawal.
- [Campaigns](https://docs.safedep.io/threat-intel/campaigns.md): List campaigns, fetch one campaign's details, and page through its member package reports. Only active campaigns are served.
- [Recipes](https://docs.safedep.io/threat-intel/recipes.md): Working scripts for the Threat Intel Feed: mirror the whole feed, keep it current, poll for new malicious packages, and expand a campaign.
- [JFrog Xray Integration](https://docs.safedep.io/threat-intel/integrations/jfrog-xray.md): Stream SafeDep malware intelligence to JFrog Xray
- [Schema reference](https://docs.safedep.io/threat-intel/schema.md): JSON wire conventions for the Threat Intel Feed, and where the authoritative message and enum definitions live.
- [Errors & limits](https://docs.safedep.io/threat-intel/errors.md): Error codes, rate limits, versioning and forward-compatibility, and troubleshooting for the Threat Intel Feed API.
- [SDKs](https://docs.safedep.io/threat-intel/sdks.md): Generate a typed Threat Intel Feed client from the SafeDep protobuf schema, with Go and TypeScript examples.
- [Filtering](https://docs.safedep.io/reference/filtering.md): Reference for Vet's CEL filter expressions: the input schema, available fields, and the operators and functions you can use.
- [Build Your Own Queries](https://docs.safedep.io/reference/build-your-own-queries.md): Speed up filtering and reporting by working with enriched JSON data dumps
- [Policy as Code](https://docs.safedep.io/reference/policy-as-code.md): Reference for SafeDep policy files: the filter suite format, the flags that apply it, and the CEL fields available to rules.
- [Exceptions](https://docs.safedep.io/reference/exceptions.md): Reference for Vet exceptions: the file format, the flags that generate and apply them, and the matching rules.
- [Path Exclusion](https://docs.safedep.io/reference/path-exclusion.md): Exclude specific directories and files from security scans using pattern matching
- [API Reference](https://docs.safedep.io/reference/api-introduction.md): SafeDep Cloud API: transport, request headers, OAuth2/OIDC endpoints, and rate limits
- [API Endpoints](https://docs.safedep.io/reference/endpoints.md): Canonical list of SafeDep service hostnames: console, data plane, control plane, identity, community API, and MCP.
- [Insights API with TypeScript](https://docs.safedep.io/reference/insights-api-typescript.md): Build applications that leverage SafeDep Insights API using TypeScript and ConnectRPC
- [SafeDep Cloud SQL](https://docs.safedep.io/reference/sql-query.md): Run SQL-like queries against your SafeDep Cloud data with the safedep CLI.
- [Community](https://docs.safedep.io/community.md): Join the SafeDep and Vet user community for support and discussions
- [Vet FAQ](https://docs.safedep.io/faq.md): Frequently asked questions about using Vet and troubleshooting common issues
- [Cloud FAQ](https://docs.safedep.io/governance/cloud/faq.md): Frequently asked questions about SafeDep Cloud authentication and usage

## Optional

- [GitHub](https://github.com/safedep/vet)
- [Discord](https://discord.gg/kAGEj25dCn)
- [Website](https://safedep.io)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.