# SafeDep Documentation

## Docs

- [AI Tools Discovery](https://docs.safedep.io/ai-security/ai-tools-discovery.md): Discover AI coding agents, MCP servers, CLI tools, IDE extensions, and agent skills across developer machines and project repositories
- [Gryph](https://docs.safedep.io/ai-security/gryph-overview.md): Gryph records what your AI coding agents do, every file read, write, and command, to a local audit log you can query and replay.
- [SafeDep MCP Server](https://docs.safedep.io/ai-security/mcp-server.md): Protect your AI coding agents against malicious packages using SafeDep MCP
- [AI Agent Security](https://docs.safedep.io/ai-security/overview.md): Discover, audit, and control what AI coding agents access and run across your developer environments.
- [Community](https://docs.safedep.io/community.md): Join the SafeDep and Vet user community for support and discussions
- [CEL](https://docs.safedep.io/concepts/cel.md): Common Expression Language (CEL) is the syntax SafeDep uses for filters, queries, and policy rules over package data.
- [Endpoint](https://docs.safedep.io/concepts/endpoint.md): An endpoint is a developer machine, CI runner, or agent sandbox that runs SafeDep tooling and reports inventory to Endpoint Hub.
- [Malicious Package](https://docs.safedep.io/concepts/malicious-package.md): What a malicious open-source package is, how it differs from a vulnerability, and how SafeDep detects them.
- [Policy](https://docs.safedep.io/concepts/policy.md): A SafeDep policy is a set of CEL rules that decide which dependencies pass or fail, enforced during scans and in CI/CD.
- [SBOM](https://docs.safedep.io/concepts/sbom.md): A Software Bill of Materials (SBOM) is a complete inventory of your software's components; an xBOM enriches it with AI, SaaS, and crypto usage.
- [Tenant](https://docs.safedep.io/concepts/tenant.md): A tenant is your organization's isolated space in SafeDep Cloud, identified by its tenant domain such as your-company.safedep.io.
- [Vulnerability](https://docs.safedep.io/concepts/vulnerability.md): What a vulnerability is in an open-source dependency, and how SafeDep surfaces and gates them.
- [Vet FAQ](https://docs.safedep.io/faq.md): Frequently asked questions about using Vet and troubleshooting common issues
- [SafeDep CLI Tools](https://docs.safedep.io/get-started/cli-tools.md): Which SafeDep command-line tool to use: Vet, PMG, Gryph, and the safedep CLI, and how they fit together.
- [AI Governance](https://docs.safedep.io/governance/ai-governance.md): Gain visibility into AI usage across your codebase and developer environments
- [Send Alerts from SafeDep Cloud](https://docs.safedep.io/governance/cloud/alerts.md): Turn any safedep query exec result into a Slack, Discord, Teams, PagerDuty, or custom HTTP alert.
- [Authentication](https://docs.safedep.io/governance/cloud/authentication.md): How SafeDep Cloud authentication works and how to authenticate the safedep CLI, vet, and CI/CD pipelines
- [Endpoint Inventory](https://docs.safedep.io/governance/cloud/endpoint-hub/inventory.md): View AI tools, Agent Skills, MCP servers, and coding agents discovered on your endpoints in SafeDep Cloud
- [Endpoint Scan Catalog](https://docs.safedep.io/governance/cloud/endpoint-hub/inventory-catalog.md): Catalog of all inventory items collected from endpoint scans
- [MCP Advisor](https://docs.safedep.io/governance/cloud/endpoint-hub/mcp-advisor.md): Review the packages your AI coding agents checked through the SafeDep MCP server, per endpoint in SafeDep Cloud
- [Endpoint Hub](https://docs.safedep.io/governance/cloud/endpoint-hub/overview.md): Visibility into AI tooling and package activity across your developer machines, CI runners, and agent sandboxes
- [Package Guard](https://docs.safedep.io/governance/cloud/endpoint-hub/package-guard.md): Monitor and control package installations across your endpoints using SafeDep Cloud
- [Cloud FAQ](https://docs.safedep.io/governance/cloud/faq.md): Frequently asked questions about SafeDep Cloud authentication and usage
- [Malware Analysis](https://docs.safedep.io/governance/cloud/malware-analysis.md): Detect malicious packages in your dependencies using SafeDep Cloud's advanced code analysis capabilities
- [SafeDep Cloud](https://docs.safedep.io/governance/cloud/overview.md): Hosted control plane that centralizes policy, malicious-package intelligence, and fleet-wide visibility across your organization.
- [Malicious Package Exclusions](https://docs.safedep.io/governance/cloud/package-exclusions.md): Manage package exclusions for malicious package analysis in SafeDep Cloud
- [SafeDep Cloud Quickstart](https://docs.safedep.io/governance/cloud/quickstart.md): Create a SafeDep Cloud tenant, authenticate the safedep CLI, connect a data source, and run your first query
- [Cloud Sync](https://docs.safedep.io/governance/cloud/sync.md): How vet, PMG, and vet endpoint scan send data to your SafeDep Cloud tenant, and how to set up each source
- [Talk to SafeDep](https://docs.safedep.io/governance/cloud/talk-to-safedep.md): Ask your supply chain questions in plain English and let an AI agent answer from your SafeDep Cloud tenant using the safedep CLI.
- [CycloneDX SBOM](https://docs.safedep.io/governance/cyclonedx-sbom.md): Generate a Software Bill of Materials (SBOM) with security metadata using Vet
- [Bitbucket Pipes](https://docs.safedep.io/governance/integrations/bitbucket.md): Native Bitbucket Cloud integration for SafeDep
- [DefectDojo Integration](https://docs.safedep.io/governance/integrations/defectdojo.md): Integrate Vet with DefectDojo for centralized vulnerability tracking and management
- [GitHub App](https://docs.safedep.io/governance/integrations/github.md): Set up the SafeDep GitHub App to scan pull requests for supply-chain risk.
- [GitHub Code Scanning](https://docs.safedep.io/governance/integrations/github-code-scanning.md): Integrate Vet with GitHub Actions and Code Scanning for automated security alerts.
- [GitLab Dependency Scanning](https://docs.safedep.io/governance/integrations/gitlab.md): Native GitLab integration for dependency security scanning with Vet.
- [Platform Integrations](https://docs.safedep.io/governance/integrations/overview.md): Integrate Vet into your CI/CD and developer platforms for automated supply-chain scanning.
- [Visibility & Governance](https://docs.safedep.io/governance/overview.md): Scan repositories, SBOMs, and CI/CD for supply-chain risk, and govern policy and visibility across your org.
- [Shadow AI in Code](https://docs.safedep.io/governance/shadow-ai-detection.md): Detect AI and LLM SDK usage in your codebase using static code analysis and generate an SBOM with AI component evidence
- [Terraform Supply Chain Audit](https://docs.safedep.io/governance/terraform-audit.md): Audit Terraform provider inventory for supply chain risks using SafeDep Cloud
- [Code Analysis](https://docs.safedep.io/governance/vet/code-analysis.md): Analyze code and dependency usage patterns with Vet's code analysis features
- [Dependency Inventory](https://docs.safedep.io/governance/vet/dependency-inventory.md): Generate accurate dependency inventories using package managers and SBOM tools
- [Dependency Usage](https://docs.safedep.io/governance/vet/dependency-usage.md): Identify which dependencies are actually used in your code using static code analysis
- [Vet](https://docs.safedep.io/governance/vet/overview.md): Vet is a free, open-source SCA scanner that finds malicious, vulnerable, and risky open-source dependencies in code and CI/CD.
- [Vet Quickstart](https://docs.safedep.io/governance/vet/quickstart.md): Get started with Vet in under 5 minutes
- [xBom](https://docs.safedep.io/governance/xbom/overview.md): xBom generates a Bill of Materials enriched with AI and SaaS usage by analyzing your source code, not just manifests.
- [xBom Quickstart](https://docs.safedep.io/governance/xbom/quickstart.md): Get started with SafeDep xBom, an open source Bill of Materials generator enriched with AI and SaaS usage detected from source code.
- [What is SafeDep?](https://docs.safedep.io/introduction.md): SafeDep secures your open source software supply chain: block malicious packages, govern dependency risk, and control what AI coding agents can do.
- [JFrog Xray Integration](https://docs.safedep.io/package-security/jfrog-xray.md): Stream SafeDep malware intelligence to JFrog Xray
- [Package Security](https://docs.safedep.io/package-security/overview.md): Block malicious open-source packages before they reach your code, on developer machines and in CI/CD.
- [PMG in GitHub Actions](https://docs.safedep.io/package-security/pmg/github-actions.md): Block malicious packages in GitHub Actions CI by routing package installs through PMG's persistent proxy.
- [PMG](https://docs.safedep.io/package-security/pmg/overview.md): PMG wraps your package managers and blocks malicious packages at install time, before any code runs. Free, open source, no account required.
- [PMG Quickstart](https://docs.safedep.io/package-security/pmg/quickstart.md): Install and configure PMG (Package Manager Guard) to block malicious packages at install time.
- [PMG in Docker and Shared VMs](https://docs.safedep.io/package-security/pmg/system-install.md): Install PMG system-wide on Linux so Docker images, CI runners, and shared VMs block malicious packages for every user account.
- [API Reference](https://docs.safedep.io/reference/api-introduction.md): SafeDep Cloud API: transport, request headers, OAuth2/OIDC endpoints, and rate limits
- [Build Your Own Queries](https://docs.safedep.io/reference/build-your-own-queries.md): Speed up filtering and reporting by working with enriched JSON data dumps
- [API Endpoints](https://docs.safedep.io/reference/endpoints.md): Canonical list of SafeDep service hostnames: console, data plane, control plane, identity, community API, and MCP.
- [Exceptions](https://docs.safedep.io/reference/exceptions.md): Reference for Vet exceptions: the file format, the flags that generate and apply them, and the matching rules.
- [Filtering](https://docs.safedep.io/reference/filtering.md): Reference for Vet's CEL filter expressions: the input schema, available fields, and the operators and functions you can use.
- [Insights API with TypeScript](https://docs.safedep.io/reference/insights-api-typescript.md): Build applications that leverage SafeDep Insights API using TypeScript and ConnectRPC
- [Path Exclusion](https://docs.safedep.io/reference/path-exclusion.md): Exclude specific directories and files from security scans using pattern matching
- [Policy as Code](https://docs.safedep.io/reference/policy-as-code.md): Reference for SafeDep policy files: the filter suite format, the flags that apply it, and the CEL fields available to rules.
- [SafeDep Cloud SQL](https://docs.safedep.io/reference/sql-query.md): Run SQL-like queries against your SafeDep Cloud data with the safedep CLI.

## OpenAPI Specs

- [openapi](https://docs.safedep.io/api-reference/openapi.json)

## Optional

- [GitHub](https://github.com/safedep/vet)
- [Discord](https://discord.gg/kAGEj25dCn)
- [Website](https://safedep.io)