{
  "markdown": "<p align=\"center\">\n  <a href=\"https://safedep.io\">\n    <picture>\n      <source srcset=\"docs/assets/vet-banner-dark.svg\" media=\"(prefers-color-scheme: dark)\">\n      <source srcset=\"docs/assets/vet-banner-light.svg\" media=\"(prefers-color-scheme: light)\">\n      <img src=\"docs/assets/vet-banner-light.svg\" alt=\"SafeDep VET - Real-time malicious package detection & software supply chain security\" width=\"100%\">\n    </picture>\n  </a>\n</p>\n\n<div align=\"center\">\n  <p>\n    <a href=\"#quick-start\"><strong>Quick Start</strong></a> •\n    <a href=\"https://docs.safedep.io/\"><strong>Documentation</strong></a> •\n    <a href=\"#community--support\"><strong>Community</strong></a>\n  </p>\n</div>\n\n<div align=\"center\">\n\n[![Go Report Card](https://goreportcard.com/badge/github.com/safedep/vet)](https://goreportcard.com/report/github.com/safedep/vet)\n[![License](https://img.shields.io/github/license/safedep/vet)](https://github.com/safedep/vet/blob/main/LICENSE)\n[![Release](https://img.shields.io/github/v/release/safedep/vet)](https://github.com/safedep/vet/releases)\n[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/safedep/vet/badge)](https://api.securityscorecards.dev/projects/github.com/safedep/vet)\n[![SLSA 3](https://slsa.dev/images/gh-badge-level3.svg)](https://slsa.dev)\n[![CodeQL](https://github.com/safedep/vet/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/safedep/vet/actions/workflows/codeql.yml)\n\n[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/safedep/vet)\n[![MCP Toplist](https://mcptoplist.com/badge/io.github.safedep%2Fvet-mcp.svg)](https://mcptoplist.com/server/io.github.safedep%2Fvet-mcp)\n\n</div>\n\n---\n\n> [!NOTE]\n> `vet` also runs in the cloud. Point it at your GitHub repositories and get continuous scanning, malware detection, and policy enforcement without managing any infrastructure. See [SafeDep Cloud](https://safedep.io/) for the end-to-end software supply chain security platform.\n\n## Why vet?\n\n> **70-90% of modern software is open source code** — how do you know it's safe?\n\nTraditional SCA tools drown you in CVE noise. **vet** takes a different approach:\n\n- **Shadow AI discovery** — Discover AI tool usage signals across various tools and configurations\n- **Catch malware before it ships** — Zero-day detection through static and dynamic behavioral analysis (requires SafeDep Cloud access)\n- **Cut through vulnerability noise** — Analyzes actual code usage to surface only the risks that matter\n- **Enforce policy as code** — Express security, license, and quality requirements as [CEL](https://cel.dev/) expressions\n- **CI/CD integration** — Zero-config security guardrails in CI/CD\n\nFree for open source. Hosted SaaS available at [SafeDep](https://safedep.io).\n\n## Quick Start\n\n**Install in seconds:**\n\n```bash\n# macOS & Linux\nbrew install vet\n\n# Using npm\nnpm install -g @safedep/vet\n```\n\nor download a [pre-built binary](https://github.com/safedep/vet/releases)\n\n**Get started immediately:**\n\n```bash\n# Scan for malware in your dependencies\nvet scan -D . --malware-query\n\n# Fail CI on critical vulnerabilities\nvet scan -D . --filter 'vulns.critical.exists(p, true)' --filter-fail\n```\n\n## Architecture\n\n`vet` follows a pipeline architecture: **readers** ingest package manifests from diverse sources (directories, repositories, container images, SBOMs), **enrichers** augment each package with vulnerability, malware, and scorecard data from SafeDep Cloud, the **CEL policy engine** evaluates security policies against enriched data, and **reporters** produce actionable output in formats like SARIF, JSON, and Markdown.\n\n<details>\n<summary>View architecture diagram</summary>\n\n```mermaid\ngraph TB\n    subgraph \"OSS Ecosystem\"\n        R1[npm Registry]\n        R2[PyPI Registry]\n        R3[Maven Central]\n        R4[Other Registries]\n    end\n\n    subgraph \"SafeDep Cloud\"\n        M[Continuous Monitoring]\n        A[Real-time Code Analysis<br/>Malware Detection]\n        T[Threat Intelligence DB<br/>Vulnerabilities • Malware • Scorecard]\n    end\n\n    subgraph \"vet CLI\"\n        S[Source Repository<br/>Scanner]\n        P[CEL Policy Engine]\n        O[Reports & Actions<br/>SARIF/JSON/CSV]\n    end\n\n    R1 -->|New Packages| M\n    R2 -->|New Packages| M\n    R3 -->|New Packages| M\n    R4 -->|New Packages| M\n    M -->|Behavioral Analysis| A\n    A -->|Malware Signals| T\n\n    S -->|Query Package Info| T\n    T -->|Security Intelligence| S\n    S -->|Analysis Results| P\n    P -->|Policy Decisions| O\n\n    style M fill:#7CB9E8,stroke:#5A8DB8,color:#1a1a1a\n    style A fill:#E8A87C,stroke:#B88A5A,color:#1a1a1a\n    style T fill:#7CB9E8,stroke:#5A8DB8,color:#1a1a1a\n    style S fill:#90C695,stroke:#6B9870,color:#1a1a1a\n    style P fill:#E8C47C,stroke:#B89B5A,color:#1a1a1a\n    style O fill:#B8A3D4,stroke:#9478AA,color:#1a1a1a\n```\n\n</details>\n\n## Key Features\n\n### **Malicious Package Detection**\n\nReal-time protection against malicious packages powered by [SafeDep Cloud](https://docs.safedep.io/cloud/malware-analysis).\nFree for open source projects. Detects zero-day malware through active code analysis.\n\n### **Vulnerability Analysis**\n\nUnlike dependency scanners that flood you with noise, `vet` analyzes your **actual code usage** to prioritize real risks.\nSee [dependency usage evidence](https://docs.safedep.io/vet/guides/dependency-usage-identification) for details.\n\n### **Policy as Code**\n\nDefine security policies using CEL expressions to enforce context specific requirements:\n\n```bash\n# Block packages with critical CVEs\nvet scan --filter 'vulns.critical.exists(p, true)' --filter-fail\n\n# Enforce license compliance\nvet scan --filter 'licenses.contains_license(\"GPL-3.0\")' --filter-fail\n\n# Require minimum OpenSSF Scorecard scores\nvet scan --filter 'scorecard.scores.Maintained < 5' --filter-fail\n```\n\n### **Multi-Ecosystem Support**\n\nPackage managers: **npm**, **PyPI**, **Maven**, **Go**, **Ruby**, **Rust**, **PHP**\nContainer images: **Docker**, **OCI**\nSBOM formats: **CycloneDX**, **SPDX**\nSource repositories: **GitHub**, **GitLab**\n\n## Malicious Package Detection\n\n**Real-time protection against malicious packages** by querying SafeDep's threat intelligence\ndatabase, continuously populated through static and dynamic behavioral analysis.\n\n### Quick Setup\n\n```bash\n# Query known malicious packages (no API key needed)\nvet scan -D . --malware-query\n```\n\n> [!NOTE]\n> The `--malware` flag is deprecated. Active (on-demand) scanning has been retired in favour of\n> querying SafeDep's threat intelligence database. `--malware` now behaves identically to\n> `--malware-query` and is retained for backward compatibility.\n\n**Example detections:**\n\n- [MAL-2025-3541: express-cookie-parser](https://safedep.io/malicious-npm-package-express-cookie-parser/)\n- [MAL-2025-4339: eslint-config-airbnb-compat](https://safedep.io/digging-into-dynamic-malware-analysis-signals/)\n- [MAL-2025-4029: ts-runtime-compat-check](https://safedep.io/digging-into-dynamic-malware-analysis-signals/)\n\n**Key security features:**\n\n- Real-time lookups against SafeDep's known malicious packages database\n- Behavioral analysis using static and dynamic analysis (performed continuously in SafeDep Cloud)\n- Human-in-the-loop triaging for high-impact findings\n- Public [analysis log](https://vetpkg.dev/mal) for transparency\n\n### Advanced Usage\n\n```bash\n# Specialized scans\nvet scan --vsx --malware-query                  # VS Code extensions\nvet scan -D .github/workflows --malware-query   # GitHub Actions\nvet scan --image nats:2.10 --malware-query      # Container images\n```\n\n> [!NOTE]\n> The `vet inspect malware` command (on-demand analysis of a single package) is deprecated and\n> will be removed in a future release. Use `vet scan --malware-query` to check packages against\n> SafeDep's known malicious packages database.\n\n## Production Ready Integrations\n\n### GitHub Actions\n\nZero-config security guardrails in CI/CD:\n\n```yaml\n- uses: safedep/vet-action@v1\n  with:\n    policy: \".github/vet/policy.yml\"\n```\n\nSee [vet-action](https://github.com/safedep/vet-action) documentation.\n\n### GitLab CI\n\nEnterprise scanning with [vet CI Component](https://docs.safedep.io/vet/guides/gitlab-dependency-scanning):\n\n```yaml\ninclude:\n  - component: gitlab.com/safedep/ci-components/vet/scan@main\n```\n\n### Container Integration\n\nRun `vet` anywhere using our container image:\n\n```bash\ndocker run --rm -v $(pwd):/app ghcr.io/safedep/vet:latest scan -D /app --malware-query\n```\n\n## Installation\n\n### Homebrew (Recommended)\n\n```bash\nbrew install safedep/tap/vet\n```\n\n### npm\n\n```bash\nnpm install @safedep/vet\n```\n\n### Direct Download\n\nSee [releases](https://github.com/safedep/vet/releases) for pre-built binaries.\n\n### Go Install\n\n```bash\ngo install github.com/safedep/vet@latest\n```\n\n### Container Image\n\n```bash\n# Quick test\ndocker run --rm ghcr.io/safedep/vet:latest version\n\n# Scan local directory\ndocker run --rm -v $(pwd):/workspace ghcr.io/safedep/vet:latest scan -D /workspace\n```\n\n### Verify Installation\n\n```bash\nvet version\n# Should display version and build information\n```\n\n## Advanced Features\n\n**Learn more in our comprehensive documentation:**\n\n- **[AI Usage Discovery](./docs/ai-discovery.md)** - Discover AI tool usage signals across various tools and configurations\n- **[AI Agent Mode](./docs/agent.md)** - Run vet as an AI agent\n- **[MCP Server](./docs/mcp.md)** - Run vet as an MCP server for AI-assisted code analysis\n- **[Reporting](./docs/reporting.md)** - SARIF, JSON, CSV, HTML, Markdown formats\n- **[SBOM Support](https://docs.safedep.io/vet/guides/cyclonedx-sbom)** - CycloneDX, SPDX import/export\n- **[Query Mode](https://docs.safedep.io/cloud/quickstart#query-your-data)** - Scan once, analyze multiple times\n- **[GitHub Integration](https://docs.safedep.io/)** - Repository and organization scanning\n- **[GitHub Actions Pinning](./docs/github-actions-pinning.md)** - Pin GitHub Actions to commit SHAs to prevent supply chain attacks\n\n## Privacy\n\n`vet` collects anonymous usage telemetry to improve the product. **Your code and package information is never transmitted.**\n\n```bash\n# Disable telemetry (optional)\nexport VET_DISABLE_TELEMETRY=true\n```\n\n## Community & Support\n\n<div align=\"center\">\n\n### Join the Community\n\n[![Discord](https://img.shields.io/discord/1090352019379851304?color=7289da&label=Discord&logo=discord&logoColor=white)](https://rebrand.ly/safedep-community)\n[![GitHub Discussions](https://img.shields.io/badge/GitHub-Discussions-green?logo=github)](https://github.com/safedep/vet/discussions)\n[![Twitter Follow](https://img.shields.io/twitter/follow/safedepio?style=social)](https://twitter.com/safedepio)\n\n</div>\n\n### Get Help & Share Ideas\n\n- **[Interactive Tutorial](https://killercoda.com/safedep/scenario/101-intro)** - Learn vet hands-on\n- **[Complete Documentation](https://docs.safedep.io/)** - Comprehensive guides\n- **[Discord Community](https://rebrand.ly/safedep-community)** - Real-time support\n- **[Issue Tracker](https://github.com/safedep/vet/issues)** - Bug reports & feature requests\n- **[Contributing Guide](CONTRIBUTING.md)** - Join the development\n\n---\n\n<div align=\"center\">\n\n### Built With Open Source\n\nvet stands on the shoulders of giants:\n\n[OSV](https://osv.dev) • [OpenSSF Scorecard](https://securityscorecards.dev/) • [SLSA](https://slsa.dev/) • [OSV-SCALIBR](https://github.com/google/osv-scalibr) • [Syft](https://github.com/anchore/syft)\n\n### Contributors\n\nThank you to all contributors ❤️\n\n<a href=\"https://github.com/safedep/vet/graphs/contributors\">\n  <img src=\"https://contrib.rocks/image?repo=safedep/vet\" alt=\"Contributors to vet\" />\n</a>\n\n---\n\n<p><strong>Secure your supply chain today. Star the repo and get started!</strong></p>\n\nCreated with love by [SafeDep](https://safedep.io) and the open source community\n\n</div>\n\n<img referrerpolicy=\"no-referrer-when-downgrade\" src=\"https://static.scarf.sh/a.png?x-pxid=304d1856-fcb3-4166-bfbf-b3e40d0f1e3b\" />\n",
  "bytes": 11911,
  "sha": "899db201b7020843a24e28ca6d83fe2a2eebc5e9f7ebe29876ba3ee2c36ab5c6",
  "repo_slug": "safedep/vet",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_safedep_vet_mcp_6def2fcd/readme"
}