# Chainsaw for developers
> What changes in your terminal when your team adopts Chainsaw: nothing on a pass, a clear error on a block, and CI usually gets faster.
Source: https://chain305.com/solutions/developers/
---
For developers
# Your .npmrc picks up a token. The rest of your day doesn't change.
Chainsaw is a registry proxy, not a plugin and not an agent. A pass looks no different. A block tells you which rule fired and who can unblock it.
What you'll see
## Same install command, one new check
1. 01 · You, or CI
`npm install`
pip, Maven, Cargo, Go, Docker: unchanged
3. 02 · Chainsaw proxy
- vulnerability rules
- license and version rules
- typosquat and attack signals
5. Blocked
the error names the rule and who can unblock it
Allowed
repeat installs serve from cache
Common worries
## What's actually true
Worry
What's true
Builds get slower
Repeat installs serve from Chainsaw's cache. CI usually gets faster.
I can't debug a block
The error names the rule, the reason and the exception reviewer.
Workspaces break
It proxies the registry, so pnpm, Yarn, Nx and Turborepo work unchanged. Lockfiles stay the same.
A new rule breaks me
Ask for new rules in monitor first. The audit log records what would have been blocked.
Setup eats a day
One client credential per machine. chainsaw install-hook writes it for you.
My agent picks packages
It can ask Chainsaw's MCP server first, with only the scope an admin grants it.
Agent setup: [/for-agents/](https://chain305.com/for-agents/)
Config
## Point your package manager at Chainsaw
Paste one into your config, or let `chainsaw install-hook` write it.
.npmrc
```
registry=https://chain305.com/chainproxy/repository/@default/npmjs/
//chain305.com/chainproxy/repository/@default/npmjs/:_authToken=${CHAINSAW_TOKEN}
always-auth=true
```
pip.conf
```
[global]
index-url = https://${CHAINSAW_TOKEN}@chain305.com/chainproxy/repository/@default/pypi/simple/
trusted-host = chain305.com
```
~/.m2/settings.xml
```
chainsaw
https://chain305.com/chainproxy/repository/@default/maven-central/
*
```
~/.docker/config.json
```
{
"auths": {
"chain305.com": {
"auth": "${BASE64_TOKEN}"
}
}
}
```
.cargo/config.toml
```
[source.crates-io]
replace-with = "chainsaw"
[source.chainsaw]
registry = "https://chain305.com/chainproxy/repository/@default/crates-io/"
token = "${CHAINSAW_TOKEN}"
```
Go GOPROXY
```
export GOPROXY=https://${CHAINSAW_TOKEN}@chain305.com/chainproxy/repository/@default/gomod/,direct
export GOSUMDB=off
```
Evaluating for your team?
## Free plan is permanent; ten minutes to wire one repo
Point one .npmrc at Chainsaw, install a package on a CVE list, and read the error yourself.
[Try it on your laptop](https://chain305.com/chainsaw/signup) [See the dev guide →](https://docs.chain305.com/categories/getting-started/)
---
## Long form
The full text behind this page, including detail the page itself leaves out.
For developers
### Your .npmrc picks up a token. The rest of your day doesn't change.
Chainsaw is a registry proxy, not a plugin and not an agent. You install packages the same way you always have. When something passes policy, nothing looks different. When something fails, the error tells you what rule fired and who can unblock it. That's the whole developer-facing surface area.
zsh · ~/src/payments
```
$ npm install react@18.3.1
added 1 package in 220ms
$ npm install left-paid
npm ERR! code EBLOCKED
npm ERR! chainsaw: left-paid@1.0.3 blocked
npm ERR! rule: typosquat/left-pad
npm ERR! score: 98 (word-reorder match)
npm ERR! exception contact: security-platform@acme.example
npm ERR! request exception: https://chainsaw.acme.example/exceptions/new?pkg=left-paid
```
Common worries
- My builds get slower or less reliable because someone put a proxy in front of the registry.
- I can't debug why a package got blocked without pinging the security channel.
- Workspace tools — pnpm, Yarn, Turborepo — break under the proxy.
- The setup is a Yak shave that'll eat a day of my sprint.
What's actually true
##### Cache usually makes CI faster
Once a version has passed policy once, subsequent installs serve from Chainsaw's content-addressed blob store. The round trip to npmjs.org or pypi.org goes away. For teams with big CI matrices this is a noticeable win.
##### Blocked installs tell you what to do
The error names the rule, the reason, and the exception reviewer. A blocked log4j install doesn't say "denied" — it tells you which CVE and which policy, with a link to request an exception if you need to.
##### Monorepos and workspaces work
Chainsaw proxies the registry, not the package manager. Yarn workspaces, pnpm workspaces, Nx, Turborepo, Lerna — no changes needed. Lockfiles stay the same.
##### Setup is one token per machine
One client credential in .npmrc, pip.conf, ~/.docker/config.json, or settings.xml. The CLI install-hook command will drop it in the right place for the ecosystems you use.
Config snippets
#### Point your package manager at Chainsaw
Drop one of these into your existing config file. The `chainsaw install-hook` CLI command can do it for you across every ecosystem your project uses.
.npmrc ini
```
registry=https://chain305.com/chainproxy/repository/@default/npmjs/
//chain305.com/chainproxy/repository/@default/npmjs/:_authToken=${CHAINSAW_TOKEN}
always-auth=true
```
pip.conf ini
```
[global]
index-url = https://${CHAINSAW_TOKEN}@chain305.com/chainproxy/repository/@default/pypi/simple/
trusted-host = chain305.com
```
~/.m2/settings.xml xml
```
chainsaw
https://chain305.com/chainproxy/repository/@default/maven-central/
*
```
~/.docker/config.json json
```
{
"auths": {
"chain305.com": {
"auth": "${BASE64_TOKEN}"
}
}
}
```
Cargo .cargo/config.toml toml
```
[source.crates-io]
replace-with = "chainsaw"
[source.chainsaw]
registry = "https://chain305.com/chainproxy/repository/@default/crates-io/"
token = "${CHAINSAW_TOKEN}"
```
Go GOPROXY shell
```
export GOPROXY=https://${CHAINSAW_TOKEN}@chain305.com/chainproxy/repository/@default/gomod/,direct
export GOSUMDB=off
```
Performance
#### Cache math, briefly
On a cache miss, Chainsaw adds the cost of [the policy evaluation](https://chain305.com/product/how-it-works/) — low single-digit milliseconds for most rules. On a cache hit, Chainsaw is often faster than the public registry because the blob store is on your network. [CI pipelines that install the same 200 packages on every run](https://chain305.com/pricing/) almost always see an end-to-end speedup.
Local dev
#### Monitor mode while you learn the rules
Ask your platform team to keep new rules in monitor for a week. Your installs succeed as they always did; the audit log captures what _would_ have been blocked. By the time a rule flips to enforce, you've already been warned about the handful of legitimate dependencies that need exceptions.
Monorepos
#### Workspaces, lockfiles, and the rest
Chainsaw proxies the registry, so anything that resolves dependencies through npm, pip, Maven, Go modules, Cargo, Composer, or Docker works unmodified. Turbo, Nx, Lerna, Yarn workspaces, and pnpm workspaces all run without changes. Lockfiles don't need to be regenerated.
Agents
#### Claude Code, Cursor, Windsurf
If you use an AI coding agent, it can query Chainsaw's MCP server to check whether a package would be allowed before suggesting it. The same RBAC applies — agents get exactly the scope the admin gives them. See [/for-agents/](https://chain305.com/for-agents/) for setup.
Evaluating for your team?
#### Free plan is permanent; ten minutes to wire one repo
Point a single .npmrc at Chainsaw, install a package that's on a CVE list, and see the error for yourself. If it's not faster or safer than what you run today, that's a clean signal.
[Try it on your laptop](https://chain305.com/chainsaw/signup) [See the dev guide →](https://docs.chain305.com/categories/getting-started/)