Dependency safety
Check packages before they land.
Package guard checks packages before installation. Dependency Audit helps you inspect the dependencies already in a project, including known vulnerability information.
Vet a package before install
Free. Available to coding agents through MCP as well as the editor and CLI package guard.
What it does
Check packages before installation and after they become dependencies.
Package guard checks what you are about to install against available package and advisory information. It can flag known vulnerabilities, malicious-package reports, yanked releases and brand-new versions before installation.
Dependency Audit examines what the project already uses. A deliberate fresh audit uses applicable project access and reads supported dependency files and lockfiles to inspect advisories for installed versions. That is a different question from checking the source code you wrote.
- Check package reputation and known advisories before an install.
- Use package checks from the editor, coding-agent hooks, MCP and the CLI.
- Inspect dependency risk and CVE findings rather than only the code you wrote.
Why use it
The code you import deserves a check too.
A small install command can add code maintained outside your repository. Check the available evidence at the point you add it and as part of reviewing the project.
- Pause before an install
- Use package guard before adding a dependency, whether you or a coding agent initiates the install. Free package checks make that an entry point rather than a paid audit requirement.
- Inspect the version you actually use
- A package name alone is not enough context for an advisory. Dependency Audit is lockfile-aware and filters findings to the installed version.
- Take dependency evidence into CI
- Pro's CVE command can fail at a chosen severity threshold, and SBOM export records dependency inventory. These complement the source-code gate.
How to use it
Check the incoming package. Audit the existing project.
Package guard and offline SBOM export are Free. A fresh dependency audit uses project access; CVE enforcement and lockfile checks on push require applicable paid access.
Check before installing
Use package guard through the editor, supported agent hooks, MCP or iris install. The MCP tool iris_check_package remains available even when other agent handoff is disabled.
ResultAvailable package risk information can inform the install decision before the package is added.
Audit the dependencies already present
Open Dependency Audit in the editor or run iris deps from the project. A fresh usable audit can spend one Free project action; unchanged cached results can be reused. Supported ecosystems include npm, Go, Python, RubyGems, NuGet, Maven, Gradle and Cargo.
Audit project dependencies iris depsResultYou can inspect version-specific dependency findings from supported project files.
Inspect the advisory and decide
Read the affected version and the advisory details before updating or accepting a dependency. A clean check reflects the information available; it cannot guarantee that a package is safe.
ResultYour decision can refer to a specific dependency version and the available advisory evidence.
The capabilities, in detail.
- Dependency AuditPro
- Version audit and CVE scan for npm, Go, Python, RubyGems, NuGet, Maven, Gradle, and Cargo dependencies - lockfile-accurate, monorepo-aware, and filtered to the version you actually run.
- Package guardFree
- Check every package before it installs, whether a coding agent or you run the install: known vulnerabilities, malicious packages, yanked and brand-new versions. A cloned repository is checked whole, install scripts included, before anything runs.
Choose your scope
What's included.
- Free
- Package guard before installation is Free, including the MCP package-check tool.
- Pro and Teams
- Fresh dependency audits use project access. Pro adds CVE enforcement and guard checks on pushed lockfile changes; offline SBOM export is Free.
Know the boundary
What it doesn't promise.
A package check uses the information available to it. It cannot guarantee that a dependency is safe.
Start here.
Use package guard before installing a dependency. For a project you already have, open Dependency Audit and deliberately refresh when you need new provider evidence.