MMCPMarkets
SV

safedep/vet

开发工具
1096 stars 质量 35 趋势 35
Repository Install

vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository.

概览

vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository.

README

[!NOTE] vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository.

Why vet?

70-90% of modern software is open source code — how do you know it’s safe?

Traditional SCA tools drown you in CVE noise. vet takes a different approach:

  • Shadow AI discovery — Discover AI tool usage signals across various tools and configurations
  • Catch malware before it ships — Zero-day detection through static and dynamic behavioral analysis (requires SafeDep Cloud access)
  • Cut through vulnerability noise — Analyzes actual code usage to surface only the risks that matter
  • Enforce policy as code — Express security, license, and quality requirements as CEL expressions
  • CI/CD integration — Zero-config security guardrails in CI/CD

Free for open source. Hosted SaaS available at SafeDep.

Quick Start

Install in seconds:

# macOS & Linux
brew install safedep/tap/vet

# Using npm
npm install -g @safedep/vet

or download a pre-built binary

Get started immediately:

# Scan for malware in your dependencies
vet scan -D . --malware-query

# Fail CI on critical vulnerabilities
vet scan -D . --filter 'vulns.critical.exists(p, true)' --filter-fail

Architecture

vet follows a pipeline architecture: readers ingest package manifests from diverse sources (directories, repositories, container images, SBOMs), enrichers augment each package with vulnerability, malware, and scorecard data from SafeDep Cloud, the CEL policy engine evaluates security policies against enriched data, and reporters produce actionable output in formats like SARIF, JSON, and Markdown.

Key Features

Malicious Package Detection

Real-time protection against malicious packages powered by SafeDep Cloud. Free for open source projects. Detects zero-day malware through active code analysis.

Vulnerability Analysis

Unlike dependency scanners that flood you with noise, vet analyzes your actual code usage to prioritize real risks. See dependency usage evidence for details.

Policy as Code

Define security policies using CEL expressions to enforce context specific requirements:

# Block packages with critical CVEs
vet scan --filter 'vulns.critical.exists(p, true)' --filter-fail

# Enforce license compliance
vet scan --filter 'licenses.contains_license("GPL-3.0")' --filter-fail

# Require minimum OpenSSF Scorecard scores
vet scan --filter 'scorecard.scores.Maintained < 5' --filter-fail

Multi-Ecosystem Support

Package managers: npm, PyPI, Maven, Go, Ruby, Rust, PHP Container images: Docker, OCI SBOM formats: CycloneDX, SPDX Source repositories: GitHub, GitLab

Malicious Package Detection

Real-time protection against malicious packages by querying SafeDep’s threat intelligence database, continuously populated through static and dynamic behavioral analysis.

Quick Setup

# Query known malicious packages (no API key needed)
vet scan -D . --malware-query

[!NOTE] The --malware flag is deprecated. Active (on-demand) scanning has been retired in favour of querying SafeDep’s threat intelligence database. --malware now behaves identically to --malware-query and is retained for backward compatibility.

Example detections:

Key security features:

  • Real-time lookups against SafeDep’s known malicious packages database
  • Behavioral analysis using static and dynamic analysis (performed continuously in SafeDep Cloud)
  • Human-in-the-loop triaging for high-impact findings
  • Public analysis log for transparency

Advanced Usage

# Specialized scans
vet scan --vsx --malware-query                  # VS Code extensions
vet scan -D .github/workflows --malware-query   # GitHub Actions
vet scan --image nats:2.10 --malware-query      # Container images

[!NOTE] The vet inspect malware command (on-demand analysis of a single package) is deprecated and will be removed in a future release. Use vet scan --malware-query to check packages against SafeDep’s known malicious packages database.

Production Ready Integrations

GitHub Actions

Zero-config security guardrails in CI/CD:

- uses: safedep/vet-action@v1
  with:
    policy: ".github/vet/policy.yml"

See vet-action documentation.

GitLab CI

Enterprise scanning with vet CI Component:

include:
  - component: gitlab.com/safedep/ci-components/vet/scan@main

Container Integration

Run vet anywhere using our container image:

docker run --rm -v $(pwd):/app ghcr.io/safedep/vet:latest scan -D /app --malware-query

Installation

brew install safedep/tap/vet

npm

npm install @safedep/vet

Direct Download

See releases for pre-built binaries.

Go Install

go install github.com/safedep/vet@latest

Container Image

# Quick test
docker run --rm ghcr.io/safedep/vet:latest version

# Scan local directory
docker run --rm -v $(pwd):/workspace ghcr.io/safedep/vet:latest scan -D /workspace

Verify Installation

vet version
# Should display version and build information

Advanced Features

Learn more in our comprehensive documentation:

Privacy

vet collects anonymous usage telemetry to improve the product. Your code and package information is never transmitted.

# Disable telemetry (optional)
export VET_DISABLE_TELEMETRY=true

Community & Support

Get Help & Share Ideas

View this README on GitHub

推荐工具

换一个关键词，或者移除筛选条件。

安装

npx skillfish add safedep/vet