# DepGate vs Chainsaw: two self-hosted package firewalls > DepGate is an MIT-licensed, self-hosted dependency gateway for 8 ecosystems. Where it is stronger, where Chainsaw differs, and how to test both on your code. Source: https://chain305.com/vs-depgate/ --- # DepGate vs Chainsaw Both refuse at the registry proxy. They differ in what they read and how they are licensed. An honest comparison: where DepGate is stronger, where Chainsaw is different, and how to test both on your own dependencies. By [Muhammad Zeeshan Sultan](https://chain305.com/about/#founder), founder of Chain305 · October 2026 Questions and answers _As of 30 October 2026 (DepGate v1.0.3). Sources: [DepGate on GitHub](https://github.com/secmods/depgate) and [the DepGate docs](https://secmods.github.io/depgate/guide/what-is-depgate)._ ## What is DepGate? DepGate is an open-source dependency gateway: a registry proxy that you run inside your own network. Developers and CI point npm, pip, Maven, Go, NuGet, Cargo, Composer or RubyGems at DepGate instead of the public registry, [according to its docs](https://secmods.github.io/depgate/guide/what-is-depgate). DepGate fetches each version upstream, checks it against a malware list and your policies, then serves it or returns HTTP 403 with the reason. The malware list syncs every hour from a feed built on the OpenSSF malicious-packages data set, with more than 200,000 entries ([malware docs](https://secmods.github.io/depgate/admin/malware)). Policies cover CVSS and EPSS scores, licences, release age, pre-releases, OpenSSF Scorecard and named packages. DepGate ships as one container image backed by PostgreSQL and Redis. The whole project, gateway included, is [MIT-licensed](https://github.com/secmods/depgate/blob/main/LICENSE). DepGate’s starter policy refuses `minimist@1.2.5` for CVE-2021-44906. Version 1.0.0 shipped on 21 October 2026. ## How do DepGate and Chainsaw differ? DepGate and Chainsaw are both registry proxies that refuse a package before it reaches a laptop or a build. The difference is what each one reads and how each one is sold. First, DepGate decides from data about a package: the known-malware feed, OSV vulnerabilities, EPSS scores, licence, publish date and Scorecard. DepGate’s own comparison table, as of October 2026, lists heuristic detection of never-seen malware as roadmap ([README](https://github.com/secmods/depgate#how-depgate-compares)). Chainsaw also reads what the package does, with 25 supply-chain signals beyond CVE, such as install scripts that fetch remote URLs, import-time execution and bidi Unicode. Second, DepGate covers 8 ecosystems and Chainsaw covers 16, including Docker images. Finally, DepGate is free software you run yourself. Chainsaw’s engine and CLI are Apache-2.0, but the central server is a paid product: hosted SaaS, or self-hosted and air-gapped on the Enterprise plan from $36,000 a year. DepGate Chainsaw Where it refuses A registry proxy you run A registry proxy, hosted or self-hosted, plus a local CLI guard Licence MIT, gateway included Engine and CLI Apache-2.0; the server is paid Air-gapped Registries and feeds pointed at internal mirrors A verified intelligence bundle loaded from a path you choose Sign-in OIDC and SAML; the docs don’t mention SCIM SSO and SCIM from the Team plan Price Free; you run PostgreSQL and Redis Free local guard or hosted for 3 people; Team $25 per seat per month; Enterprise from $36,000 a year ## Where is DepGate stronger? - **Fully open source, gateway included.** Every part of DepGate, including the server that makes the decision, is MIT. With Chainsaw, the server you would self-host is paid. - **Air-gapped at no licence cost.** The [networking docs](https://secmods.github.io/depgate/install/https-and-networking) describe running with no inbound internet access, with registries and the EPSS, malware and OSV feeds pointed at internal mirrors. Chainsaw’s air-gapped deployment is on the Enterprise plan. - **Licence and project-health rules.** Licence allow and deny lists and OpenSSF Scorecard thresholds are built-in [policy rules](https://secmods.github.io/depgate/admin/policy-rules). - **Fits next to your artifact manager.** DepGate can sit in front of or behind Artifactory and Nexus, and serves internal names only from internal registries to stop dependency confusion ([architecture](https://secmods.github.io/depgate/guide/architecture)). - **Developer self-service.** Package check names the newest allowed version, and blocked developers can request a time-bound waiver. - **Small footprint.** The docs size a team install at 2 vCPU and 4 GB RAM ([requirements](https://secmods.github.io/depgate/install/requirements)). If your ecosystems are among its eight and known-malware data plus policy is enough, DepGate is a reasonable free choice. It is young: v1.0.3 shipped on 25 October 2026. ## When should you choose Chainsaw instead? Choose Chainsaw when you need to refuse malicious packages that are not yet on any feed, or when you depend on ecosystems beyond DepGate’s eight. A feed-driven gateway refuses a malicious version after someone has reported it. Chainsaw also refuses on behaviour, before any advisory exists. For example, Chainsaw refuses an install script that fetches a remote URL, or code that runs at import time. The evidence is public: the Chainsaw [attack coverage report](https://chain305.com/attack-coverage-2026/) tests 58 supply-chain attacks from 2026 with per-attack results. Second, Chainsaw fits teams that want a hosted service with no PostgreSQL or Redis to run. SSO, SCIM and an audit trail come with the Team plan at $25 per seat per month. Third, developers can add the free offline CLI guard for npm, pip, cargo, gem and go, with no account. Finally, teams that install Docker images get coverage that DepGate does not list today. ## How do you test DepGate and Chainsaw on your own dependencies? The fairest test is a one-week trial of both tools in monitor mode on the same lockfiles. DepGate’s monitor mode applies a new policy to real traffic and shows which downloads it would break, according to [DepGate’s README](https://github.com/secmods/depgate#features). Chainsaw rules also start in monitor mode and move to enforce one rule at a time. First, point one CI job at DepGate and a second CI job at Chainsaw. Second, install the same lockfile through each and export both decision logs. Make sure the test includes a package version published in the last 48 hours. Chainsaw holds new versions for 48 hours by default, and the DepGate release-age rule blocks versions younger than a set number of hours. Finally, read the refusals that only one tool made, with the reason each gave. Keep the tool whose refusals your team can explain and act on. About this comparison Chain305, the company that makes Chainsaw, wrote this comparison. Every claim about another product was checked against that vendor's public documentation. Last checked: 30 October 2026. If anything here is wrong or out of date, email [sales@chain305.com](mailto:sales@chain305.com) and it will be corrected. How these pages are written and checked: [editorial policy](https://chain305.com/editorial-policy/). Test it on your own code ## Run Chainsaw in monitor mode next to what you use today Start a free org in monitor mode. Compare what each tool would have refused on your dependencies this week. [Start in monitor mode](https://chain305.com/chainsaw/signup) [Read the engine on GitHub →](https://github.com/chain305/chainsaw-core)