Works With

Malicious Package Protection
For AI Coding Agents

Every open source package your agent installs is checked before execution. Malicious packages are blocked at install time.

npx @safedep/cli setup mcp install

Docs

Claude Code

$ claude Claude Code v2.1.42 ▐▛███▜▌ Opus 4.6 · Claude Max ▝▜█████▛▘ /dev/workspace ▘▘ ▝▝❯ Install npm package eslint-config-prettier⏺ Let me check the security of this package.⏺ safedep - check_package_security (MCP)⎿ {"status": "malicious", ...}⏺ Installation blocked — this package is flagged as malicious.SafeDep security analysis identified eslint-config-prettier@9.1.1 as malware. The findings include:- DLL extension mismatch- Embedded executable- Install script executing arbitrary codeFull report: https://platform.safedep.io/community/malysis/01K0F3SC8XWRVW017ZR21MNK6TI will not proceed with the installation. If you need a specific functionality, let me know and I can help find a safe alternative.

Packages Scanned: 20M+
Components Analysed: 500K+
Projects Secured: 5000+
Threats Blocked: 80%

Add eslint configRunning npm installeslint-config-prettier> Fetching eslint-config-prettier@9.1.1> Running install script... ⏳> + 156 packages, audited 0 contributors in 2.4s✓ INSTALLED SUCCESSFULLY ✓KNOWN MALWAREeslint-config-prettierHIGH

The Threat

Agents Use Code
They Can't See

AI coding agents run real install commands in your environment. They cannot distinguish a trusted package from a malicious one.

Add eslint configRunning npm installeslint-config-prettier...Installation blockedThis package was flagged as maliciousView report — platform.safedep.io/community/malysis/01K0F3SC8XWRVW017ZR21MNK6T

Stay Protected

A Security Check Before Execution

SafeDep's hosted MCP server provides AI agents real-time access to a malicious package database. Before any install, the agent queries SafeDep. Malware gets blocked. Clean packages proceed. Zero friction.

Read the eslint-config-prettier report

See It In Action

Watch SafeDep Block a Malicious Package in Real Time

See what happens when an AI agent tries to install a flagged package. SafeDep intercepts the request, checks its threat database, and blocks the install — before any code executes.

Configure each agent

CLI not an option? Set up Claude Code, Cursor, Codex, and others manually.

Add SafeDep MCP Server To Your Agent

Add the SafeDep MCP server to your AI coding tool and authenticate using your API key and tenant ID. This establishes a secure connection between your agent and SafeDep's threat intelligence.

Setup via Dashboard

The API Keys page in the SafeDep dashboard, with one key per agent

Check Every Dependency
In Real Time

Choose your MCP-compatible agent (Claude Code, Cursor, etc.) and add the SafeDep MCP server using the provided setup command.

Claude

claude mcp add -s user --transport http safedep \
 https://mcp.safedep.io/model-context-protocol/threats/v1/mcp \
 --header "Authorization: YOUR_API_KEY" \
 --header "X-Tenant-ID: YOUR_TENANT_DOMAIN"

Cursor

// ~/.cursor/mcp.json
{
  "mcpServers": {
    "safedep": {
      "url": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
      "headers": {
        "Authorization": "YOUR_API_KEY",
        "X-Tenant-ID": "YOUR_TENANT_DOMAIN"
      }
    }
  }
}

OpenAI

# ~/.codex/config.toml
[mcp_servers.safedep]
url = "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp"

[mcp_servers.safedep.env_http_headers]
Authorization = "YOUR_API_KEY"
X-Tenant-ID = "YOUR_TENANT_DOMAIN"

Gemini

// ~/.gemini/settings.json
{
  "mcpServers": {
    "safedep": {
      "httpUrl": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
      "headers": {
        "Authorization": "YOUR_API_KEY",
        "X-Tenant-ID": "YOUR_TENANT_DOMAIN"
      }
    }
  }
}

Windsurf

// ~/.codeium/windsurf/mcp_config.json
{
  "mcpServers": {
    "safedep": {
      "serverUrl": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
      "headers": {
        "Authorization": "YOUR_API_KEY",
        "X-Tenant-ID": "YOUR_TENANT_DOMAIN"
      }
    }
  }
}

Install Dependencies, Safely

Every package your agent installs is now checked against SafeDep's threat intelligence before install — automatically blocked if malicious.

SafeDep verifying an install request for eslint-config-prettier from npm, requested by Claude

Built for the New Reality ofOpen Source

SafeDep protects developers from malicious code hidden in open source packages installed every day, guarding the entry point, not just the code inside.

Real-Time Detection

We scan packages as they're published to npm, PyPI, and other registries—not 24 hours later when it's too late.

Human-Verified Intelligence

Our security researchers verify every threat. No false positive noise. When we block something, it's real.

Zero Friction

Invisible when packages are safe. You only see SafeDep when we block something dangerous.

Security That MovesWith Coding Agent

SafeDep integrates directly with your AI coding agents and MCP-compatible IDEs, checking every dependency before install — without changing how you build.