SafeDep PMG vs Chainsaw

Questions and answers

As of 30 October 2026 (PMG v0.34.0). Sources: the PMG README and the docs in its repository.

What is SafeDep PMG?

SafeDep PMG (Package Manager Guard) is a free, open-source tool that wraps package managers on a developer machine or CI runner and blocks malicious packages before they install. PMG is licensed under Apache-2.0 and, according to SafeDep’s README in October 2026, needs no account or API key. First, pmg setup install adds shell aliases. After that, npm, pnpm, yarn, bun, pip, poetry, uv and related tools run through a local proxy that inspects their registry traffic. Go and Cargo support is experimental and runs only through an explicit pmg go or pmg cargo command. Each package is checked against SafeDep’s free community API for known malware. For unknown malware, PMG adds two more layers: a dependency cooldown that hides very new versions on npm and PyPI, and an opt-in sandbox for installs. PMG’s config template ships with a 2-day cooldown. Finally, PMG keeps a local audit log of every install.

How do SafeDep PMG and Chainsaw differ?

SafeDep PMG and Chainsaw differ mainly in where the check runs and what the check needs. PMG sits on each machine. PMG wraps the package manager client and asks SafeDep’s community API about every package, so a verdict needs a network call. PMG’s docs don’t say what happens when that API is unreachable. Chainsaw comes in two forms. First, the free Chainsaw CLI guard is a shell hook for npm, pip, cargo, gem and go that works offline, because its seed data is embedded in the binary. Running chainsaw guard update pulls the full public OpenSSF malicious-packages feed with no account. Second, hosted Chainsaw is a registry proxy that laptops and CI pull through, covering 16 package ecosystems with one central policy and a shared audit log. Both engines are open source under Apache-2.0. On price, PMG is free standalone. SafeDep’s pricing page lists SafeDep Cloud Team at $16 per endpoint per month billed yearly (corrected 2 November 2026: this page said $20), and Chainsaw Team costs $25 per seat per month.

Where is SafeDep PMG stronger?

SafeDep PMG is the stronger tool at the moment an install script actually runs. With the sandbox enabled, according to SafeDep’s docs (October 2026), PMG runs the install inside an OS-native sandbox: macOS Seatbelt, Linux Landlock, or Bubblewrap as a fallback. The policy is default-deny, blocks reads of credential files such as .ssh and .aws, and scrubs secrets like NPM_TOKEN from the environment. Chainsaw does not claim this. Chainsaw reads package bytes and metadata before install and never executes them, so a malicious script that passes every Chainsaw rule runs with normal user permissions. PMG ships a GitHub Action that, on GitHub-hosted runners, uses eBPF kernel enforcement so a CI step cannot bypass the proxy with env -i or its own HTTP client. For fleets, a root-owned global config with global_lockdown: true stops users switching protection off. Under lockdown, PMG_INSECURE_INSTALLATION cannot skip malware checks.

Other strengths worth naming:

• Coding agents. PMG documents a sandbox mode for AI coding agents, not only for package installs.
• No sign-up at all. Install, run pmg setup install, and the check is live.
• Cost. PMG is free standalone. SafeDep’s pricing page says it counts no endpoint and needs no subscription.

When should you choose Chainsaw instead?

Chainsaw is the better fit when protection must cover a whole team, many ecosystems, or a network with no outside access. Chainsaw’s registry proxy covers 16 package ecosystems, including Maven, NuGet, RubyGems and Docker images, none of which the PMG README lists. Policy lives in one place, so a rule change reaches every laptop and CI job that pulls through the proxy, and each refusal lands in a shared audit log. Five seeded rules block from day one: CISA KEV entries, packages under one day old, install scripts that fetch remote URLs, import-time execution, and bidi Unicode. A 48-hour release hold is on by default. PMG’s docs say its cooldown does not apply to lockfile or direct tarball installs; Chainsaw’s hold also refuses an exact pin to a too-new version on 17 formats. The CLI guard runs fully offline from embedded seeds. Chainsaw publishes a test of 58 supply-chain attacks from 2026 with per-attack results.

Chainsaw rules start in monitor mode and move to enforce one at a time, and the decision engine is readable at github.com/chain305/chainsaw-core.

Can you run SafeDep PMG and Chainsaw together?

Yes, and they act at different points. Chainsaw decides which packages the registry serves; PMG can then sandbox the install scripts of the packages that pass. PMG’s proxy mode accepts custom npm, PyPI, Go and Cargo registry endpoints, so a Chainsaw proxy URL can sit behind it. To compare verdicts first, start a Chainsaw org in monitor mode, point one project at it, and run the same installs through PMG. Each tool’s log then shows what it would have refused on your own dependencies.

For the wider category, from SCA scanners to artifact managers, see where Chainsaw fits.

Sources

• SafeDep, PMG README and LICENSE.
• PMG docs: dependency cooldown, sandbox, configuration and lockdown, proxy mode.
• SafeDep, pricing.