vetgate

The moment it gates

An agent that installs a package runs its postinstall hook before anyone reads any output. Post-install audits, PR checks, and dashboards all sit on the wrong side of that moment: by the time they run, the payload has already fired. vetgate sits before execution: the agent calls it, reads the verdict, and only then decides whether to install, install with --ignore-scripts, pin to a digest, or ask the user.

If your coding agent installs packages, actions, or scripts on your behalf, each install runs unreviewed — vetgate is the check that runs first.

What it vets

The default path sends nothing anywhere except downloading the artifact itself (vet_package) and fetching the script text (vet_script, labeled in the verdict manifest). All analysis is local. local: is fixture mode for offline demos; it is not a shipped MCP feature.

Verdicts

Every finding carries its evidence string, truncated to 120 characters. A finding without evidence is a bug. Determinism: same input bytes plus the same rules version give the same verdict, except for manifest.checkedAt.

Rules (v1)

DENY: install script, scanned .js/.sh file, or remote script text that reads a credential or environment value AND sends data to the network in the same text; download-and-execute chains (curl|sh, curl|bash, wget|sh, wget|bash, curl|node, PowerShell IEX with an http(s) URL); obfuscation markers (eval(atob(, base64-then-eval, String.fromCharCode with 10+ arguments, dense \x hex escapes) combined with a network call; typosquat — package name at Levenshtein distance exactly 1 from a popular package name; action refs that are :latest, untagged, or malformed.

REVIEW (never DENY alone): any install script present at all; missing license field; action ref that is a mutable tag (v4, main, a semver tag), with a pin-to-digest recommendation; zero-width or bidirectional-override characters in script text alone; a remote script containing an outbound URL but no DENY pattern.

Full rule set, patterns, and triggering fixtures: docs/RULES.md in the repository. The typosquat list is a fixed sample of 39 well-known packages, NOT exhaustive — a name absent from the list is simply not checked for typosquatting, never declared safe because of that absence.

Use it

# MCP server (see examples/mcp-config.json in the repo)
{
  "mcpServers": {
    "vetgate": { "command": "npx", "args": ["-y", "vetgate", "serve"] }
  }
}
# or directly over stdio:
vetgate serve
# CLI
vetgate check npm:react@18.3.1
vetgate check action:actions/checkout@v4
vetgate check url:https://example.com/install.sh

# Build from source
git clone https://github.com/techdevfun/vetgate.git
cd vetgate
npm ci
npm run build
npm test

Commands and config copied from the vetgate README (v0.1.0). Requires Node 20 or later. The CLI prints the Verdict JSON to stdout and one summary line to stderr. For vet_script, fetching the script text is itself a network fetch — the verdict manifest says exactly that, while all analysis was local and the script was never executed.

Measured numbers (README, fixture set)

• Fixture suite: 15 hand-built fixtures (no real malware, nothing fetched) — ALLOW 4, DENY 6, REVIEW 5. Every malicious-pattern fixture DENYs, every benign fixture ALLOWs, every weak-signal fixture REVIEWs.
• False-positive probe: 10 benign fixture contents — 0 DENY.
• Determinism: the same package contents vetted twice produce identical verdicts after stripping manifest.checkedAt.
• Latency over the fixture set (3,000 timed checks, analysis only, network download time excluded): median 0.006 ms, p95 0.075 ms, mean 0.026 ms per check. Re-run with scripts/measure-latency.mjs.
• Test suite: 26 tests, all passing.

What this is NOT — and where rivals beat us

• Not in v1: other ecosystems (npm only — PyPI, Maven, Go, Ruby, Rust, PHP are out); agent skill / MCP-server-config vetting; container image layer inspection; monitoring, re-scanning, fix PRs, dashboards, accounts, cloud APIs, policy languages, or network enrichment lookups; any claim about malware families beyond the stated rule list.
• SafeDep vet beats us on breadth and malicious detection (more ecosystems, Docker and SBOM support, policy expressions, cloud active scanning). Socket beats us on behavioral detection depth. Snyk and DeepSource beat us on monitoring and fixing. OpenSSF Scorecard beats us on maintainer-risk signals. OSV and the advisory databases beat us on known-vulnerability breadth — v1 has no enrichment mode, so it misses known CVEs a database lookup would catch.
• A registry firewall beats us on position: blocking at the registry edge stops a bad package before download, while we inspect after download and before execution — by design, because we are the gate for agents that install from anywhere, not just one registry. A registry-gateway approach (for example DepGate-style middleware in front of a proxy) and vetgate answer different moments: gateway before download, vetgate before execution.

Source + README on GitHub → · Report an issue → · ask@techdev.fun

Related tools

More open-source tools from TECHDEV: sessguard, runverdict, gheist-guard, context-diet, ci-failure-detective, agent-seatbelt, devsecops-os, env-doctor, skill-audit, logtrim, testguard, breakcheck, keymap, memgraph, ggufit, leaseguard, factfence, jsonfold

Have a say

Vote for this tool, suggest a feature, or discuss it with other operators on the community board.