DepGate vs Chainsaw

Questions and answers

As of 30 October 2026 (DepGate v1.0.3). Sources: DepGate on GitHub and the DepGate docs.

What is DepGate?

DepGate is an open-source dependency gateway: a registry proxy that you run inside your own network. Developers and CI point npm, pip, Maven, Go, NuGet, Cargo, Composer or RubyGems at DepGate instead of the public registry, according to its docs. DepGate fetches each version upstream, checks it against a malware list and your policies, then serves it or returns HTTP 403 with the reason. The malware list syncs every hour from a feed built on the OpenSSF malicious-packages data set, with more than 200,000 entries (malware docs). Policies cover CVSS and EPSS scores, licences, release age, pre-releases, OpenSSF Scorecard and named packages. DepGate ships as one container image backed by PostgreSQL and Redis. The whole project, gateway included, is MIT-licensed. DepGate’s starter policy refuses minimist@1.2.5 for CVE-2021-44906. Version 1.0.0 shipped on 21 October 2026.

How do DepGate and Chainsaw differ?

DepGate and Chainsaw are both registry proxies that refuse a package before it reaches a laptop or a build. The difference is what each one reads and how each one is sold. First, DepGate decides from data about a package: the known-malware feed, OSV vulnerabilities, EPSS scores, licence, publish date and Scorecard. DepGate’s own comparison table, as of October 2026, lists heuristic detection of never-seen malware as roadmap (README). Chainsaw also reads what the package does, with 25 supply-chain signals beyond CVE, such as install scripts that fetch remote URLs, import-time execution and bidi Unicode. Second, DepGate covers 8 ecosystems and Chainsaw covers 16, including Docker images. Finally, DepGate is free software you run yourself. Chainsaw’s engine and CLI are Apache-2.0, but the central server is a paid product: hosted SaaS, or self-hosted and air-gapped on the Enterprise plan from $36,000 a year.

	DepGate	Chainsaw
Where it refuses	A registry proxy you run	A registry proxy, hosted or self-hosted, plus a local CLI guard
Licence	MIT, gateway included	Engine and CLI Apache-2.0; the server is paid
Air-gapped	Registries and feeds pointed at internal mirrors	A verified intelligence bundle loaded from a path you choose
Sign-in	OIDC and SAML; the docs don’t mention SCIM	SSO and SCIM from the Team plan
Price	Free; you run PostgreSQL and Redis	Free local guard or hosted for 3 people; Team $25 per seat per month; Enterprise from $36,000 a year

Where is DepGate stronger?

• Fully open source, gateway included. Every part of DepGate, including the server that makes the decision, is MIT. With Chainsaw, the server you would self-host is paid.
• Air-gapped at no licence cost. The networking docs describe running with no inbound internet access, with registries and the EPSS, malware and OSV feeds pointed at internal mirrors. Chainsaw’s air-gapped deployment is on the Enterprise plan.
• Licence and project-health rules. Licence allow and deny lists and OpenSSF Scorecard thresholds are built-in policy rules.
• Fits next to your artifact manager. DepGate can sit in front of or behind Artifactory and Nexus, and serves internal names only from internal registries to stop dependency confusion (architecture).
• Developer self-service. Package check names the newest allowed version, and blocked developers can request a time-bound waiver.
• Small footprint. The docs size a team install at 2 vCPU and 4 GB RAM (requirements).

If your ecosystems are among its eight and known-malware data plus policy is enough, DepGate is a reasonable free choice. It is young: v1.0.3 shipped on 25 October 2026.

When should you choose Chainsaw instead?

Choose Chainsaw when you need to refuse malicious packages that are not yet on any feed, or when you depend on ecosystems beyond DepGate’s eight. A feed-driven gateway refuses a malicious version after someone has reported it. Chainsaw also refuses on behaviour, before any advisory exists. For example, Chainsaw refuses an install script that fetches a remote URL, or code that runs at import time. The evidence is public: the Chainsaw attack coverage report tests 58 supply-chain attacks from 2026 with per-attack results. Second, Chainsaw fits teams that want a hosted service with no PostgreSQL or Redis to run. SSO, SCIM and an audit trail come with the Team plan at $25 per seat per month. Third, developers can add the free offline CLI guard for npm, pip, cargo, gem and go, with no account. Finally, teams that install Docker images get coverage that DepGate does not list today.

How do you test DepGate and Chainsaw on your own dependencies?

The fairest test is a one-week trial of both tools in monitor mode on the same lockfiles. DepGate’s monitor mode applies a new policy to real traffic and shows which downloads it would break, according to DepGate’s README. Chainsaw rules also start in monitor mode and move to enforce one rule at a time. First, point one CI job at DepGate and a second CI job at Chainsaw. Second, install the same lockfile through each and export both decision logs. Make sure the test includes a package version published in the last 48 hours. Chainsaw holds new versions for 48 hours by default, and the DepGate release-age rule blocks versions younger than a set number of hours. Finally, read the refusals that only one tool made, with the reason each gave. Keep the tool whose refusals your team can explain and act on.