About Chainsaw
The refusal point: a firewall that decides on every install
Scanners flag dependencies already in production. The install path is the one place left where a policy decision can still refuse a package before it lands.
Socket, Sonatype and JFrog all refuse before download. None of them lets you read the code that made the call, or run the whole control plane inside your own boundary. The engine is Apache-2.0: read the function that returns the 403 first.