Every verdict fires on the install path, not in a post-build scan.

Chainsaw sits between your developers and the upstream registries. npm (plus pnpm / yarn / bun on npm semantics), pip, Maven, Gradle, Cargo, Go modules, Composer, NuGet, RubyGems, Swift, CocoaPods, Docker, Hugging Face, APT, Yum, and DNF all flow through. Developers and CI keep using the tools they know.

Every artifact that passes policy is stored in a content-addressed blob store. Repeat installs skip the upstream round-trip and ship from your cache, so CI usually gets faster once Chainsaw is in the path, not slower.

Every upstream fetch is audited against the declared hash. A silently swapped mirror can't reach the build. Run in log, quarantine, or block mode; Chainsaw distinguishes a real mismatch from an upstream that never published a hash.

Block on CVSS score, EPSS exploit probability, CISA KEV membership, or any combination. Log4j went from disclosure to global block in the time it takes to push one policy edit.

Enforce SPDX license policy across every ecosystem. GPL-3.0 in a commercial product, AGPL on the client, or unknown licenses you need to review — each gets its own rule.

Require a minimum release age before a version is installable. Pin majors. Block pre-release tags from production builds. Cuts exposure to publish-then-exploit attacks without blocking the whole ecosystem.

Require npm provenance, Sigstore signatures, Go's sumdb, or Maven's GPG. Chainsaw understands each ecosystem's trust anchor and exposes the result the same way in policy.

Flags packages whose install hooks (npm preinstall, pip setup.py, Cargo build.rs, Composer lifecycle) run remote fetches or decode base64 payloads. This is the PhantomRaven attack shape and the precise pattern Chainsaw refuses before the hook fires.

Compares the current maintainer set of a package against its history. A surprise publisher on a popular dependency — the pattern behind the Axios compromise — blocks until reviewed.

Catches backdated publish timestamps, semver regressions, and multi-major skips used to sneak compromised versions under a higher constraint. Works on any ecosystem with SemVer.

BK-tree and homoglyph matchers against popular packages, with word-reorder detection for multi-token names. Go, CocoaPods, and GitHub Actions now covered — not just npm.

Refuses packages whose source includes invisible characters, bidi-override sequences, or tag characters. Closes the GlassWorm and Trojan Source attack class without running the code.

A rolling 24-hour counter per publisher. When one compromised account starts pushing dozens of tainted versions in a day — the Shai-Hulud pattern — the burst trips the rule before your build runs.

Dependency confusion works because attackers publish your internal package names on the public registry first. One click applies a starter pack that reserves your namespaces across every ecosystem you use. No Birsan enumeration gets through.

Matches container pulls against a Docker-native malware feed by digest and by name-plus-tag. Closes the OpenSSF index gap for container images, which the public SCA feeds miss.

Walks every image layer with Trivy under the hood. Reads dpkg, RPM (BDB + ndb + sqlite), and apk databases inside each layer, follows multi-arch indexes and digest refs, and handles distroless status.d layouts. On by default — new orgs get container depth without flipping a flag. A clean image tag no longer guarantees a clean image.

APT InRelease and Yum/DNF repomd.xml.asc verification. A mirror that tampers with a package between publish and your fetch fails the chain. Trust roots are configurable; Debian and Fedora keyrings ship baked in.

Native CVE detectors for Alpine, Debian, Red Hat, and Oracle Linux — distinct from upstream OSV. Each distro stream updates on its own cadence so a vendor advisory lands as a block-list entry the same hour the distro publishes it, not whenever OSV next syncs.

Unmaintained repos with a live npm publisher are a compromise waiting to happen. Chainsaw scores each package on repo activity and ownership match; you pick the threshold under which installs are blocked or flagged.

Also called out above — when it comes to supply-chain attack surface, refusing a mismatched artifact is often the last line. Configurable per-ecosystem to log, quarantine, or block.

Generate a CycloneDX 1.6 SBOM for any repo on demand. Export via dashboard or API; wire it into procurement, audit, and vendor-review workflows without a separate scanner.

Every install through the proxy lands in a queryable inventory — by package, by client, by ecosystem. When the next CVE drops, ask 'who has it?' and get an answer in seconds, not after a scanner re-run.

Every install decision — allowed, blocked, or monitored — gets logged with user, repo, rule, and reason. Filter by ecosystem, team, or time range from the dashboard, or stream the whole thing to your SIEM.

Post to any endpoint when an install is blocked, when a policy changes, or when a trust-score threshold is crossed. Five per user, included on Free. No enterprise gate.

Claude Code, Cursor, and Windsurf can query policy state, check a package before they suggest it, and propose policy edits that route through human approval. Same RBAC as a human API key.

On Enterprise, the audit log ships as structured events to your existing SIEM. Splunk HEC, Microsoft Sentinel (CEF over TLS syslog), and IBM QRadar (CEF over TLS syslog) are supported out of the box, and any SIEM that accepts syslog/HEC or a webhook can sink the same stream — Elastic, Sumo Logic, Chronicle, Datadog, and the rest.

Every install — allowed, monitored, or blocked — leaves a signed audit row with rule, reason, user, repo, CI job, and timestamp. Policy changes route through Billy's human-approval flow; exceptions carry a reviewer, a reason, and an expiry. Whichever framework your auditor works from — SOC 2, ISO 27001, HIPAA — they read the same export. No separate evidence-collection step.

Policy proposals — whether drafted by a human or an AI agent via MCP — route through Billy, the in-product approval queue. Reviewers see diff, blast radius, and which installs the change would have affected over the last week. Nothing flips to enforce without a human signing off.

CLI and dashboard both use the same browser-based login. Device-code flow for headless shells, Turnstile on the auth page to keep bots out. Nothing to paste in from an email.

Email, password, and TOTP out of the box. Good enough for most teams; a starting point for the ones that graduate to SSO.

Okta, Azure AD, Google Workspace, Auth0 — any SAML 2.0 or OIDC provider works without a custom integration. SCIM 2.0 auto-provisions and auto-deprovisions.

Chainsaw ships static binaries for macOS, Linux, and Windows, each with a published SHA-256 checksum — verify your download before you run it. Sigstore-signed releases follow once the release-signer bot is provisioned.

One container, one database, optional Redis for scale. Runs in your cloud or fully disconnected. The server URL can be baked into the CLI at build time so air-gapped users never see a public origin.