Open-source project · Supply-chain security
SafeInstall
The install gate for the AI agent era.
Policy runs first. Then the package manager. Not the other way around.
SafeInstall is an open-source command-line tool that blocks risky installs for npm, pnpm and bun before they run. We built it because AI coding agents now suggest and install packages in seconds — without checking who published them or what happens during install.
MIT license · Runs locally · No cloud service · No account · Free
There's no check between "npm install" and "compromised"
Every package install involves three things that almost nobody checks — and that have become far more common with AI agents in the loop.
Install scripts run immediately.
A package is allowed to run arbitrary code during install — via preinstall, install or postinstall. That code runs before a single line of your own application starts, with the privileges of the person at the machine. If nobody read the package first, nobody checked it either.
AI agents install without checking.
A coding agent suggests a package and runs the command. It doesn't check the publish date, doesn't read install scripts, doesn't verify provenance. The human confirms and moves on. If the package name came from a hallucination or a manipulated tutorial, the attacker has already claimed that name.
Classic scanners report too late.
Vulnerability databases only know what's already known and published. For a freshly compromised package, no entry exists yet at install time. A vulnerability database warns about ground already lost — it isn't a gate.
One tool, three layers of defense
SafeInstall acts at three points: the people who install packages, the agents that do it for them — and the files that steer those agents.
Layer 1 — For people installing packages
You put the command in front: safeinstall pnpm add axios. The policy runs, then pnpm starts. Release age, install scripts, source and trust downgrades are checked before anything is written to disk.
Layer 2 — For AI agents installing packages
An MCP server gives agents the check_package tool, which they can call before an install. A shell guard also intercepts install commands in Claude Code, Codex and Cursor before they run. If the MCP server finds no project configuration, it deliberately runs a stricter profile than human use: typo-squat and provenance-continuity checks are then set to block — in agent operation, maximum signal counts.
Layer 3 — For the files that program the agents
This is the part that barely exists elsewhere. A manipulated agent doesn't have to fight the gate at all — it can simply rewrite the rules: weaken the config, delete a hook, hide an invisible instruction in AGENTS.md, or register a malicious MCP server. These files steer the next agent session; they are the new persistence mechanism.
The Agent Trust Surface, by contrast, stores a hash baseline of these files in the repository. SafeInstall checks the real state against it before every decision — and additionally verifies it in CI on every pull request, on a machine the agent doesn't control. Changes that weaken protection always require a human at the terminal.
What this looks like in practice
No dashboard, no after-the-fact report — the decision happens before the install, in the terminal.
Two independent reasons, both caught before any write access. If the policy allows the operation, SafeInstall calls the real package manager and steps aside.
Four checks by default, four opt-in
This split is deliberate. What's active by default is what makes sense in almost every project without disrupting the workflow. Anything that can cause project-dependent false positives is off by default and switched on deliberately.
Active by default
Release age — blocks versions younger than 72 hours (configurable)
Install scripts — preinstall, install, postinstall blocked until explicitly allowed
Sources — registry, workspace, file and directory allowed; Git and URL sources blocked
Trust downgrade — detects a dependency switching from registry to Git/URL, or newly introduced scripts on an update
Opt-in
Typo-squat detection — name similarity to known, widely used packages
Provenance verification — cryptographic check of the Sigstore attestation
Transitive check — examines the entire dependency tree, not just direct packages
Provenance continuity — detects when a new version loses its predecessor's attestation or suddenly originates from a different source repository
Unclear or incomplete metadata leads to a block, not a pass. When in doubt, against the install — that's the tool's baseline stance.
Three decisions that shape the tool
Local, not cloud.
SafeInstall runs entirely on your own machine, or in your own CI. There's no service that dependency data gets sent to, no account, and no telemetry. Whoever checks which packages a company uses also learns something about that company — that information never leaves the building.
When in doubt, block.
A security tool that lets things through when the situation is unclear just shifts the risk and creates false confidence. SafeInstall decides against the install when in doubt. That occasionally costs a deliberate exception entry — and that entry is then a documented decision instead of a silent assumption.
Humans at the critical points.
Any action that weakens protection requires a real person at a real terminal. The relevant commands read their confirmation directly from the controlling terminal and refuse to run in CI environments and known agent contexts. An agent can't switch off protection in passing.
What SafeInstall doesn't do
A security tool whose vendor only talks about its strengths is hard to assess. So here are the limits we document ourselves — they're stated the same way in the public documentation.
Compromised CI with valid provenance. If a legitimate project's build pipeline itself is taken over, a correctly attested version from the right repository is produced. The continuity check sees no break there. SafeInstall raises the bar against the most common attack pattern — it doesn't close every door.
Intercepting commands is a layer, not a guarantee. The shell guard also catches an agent that doesn't cooperate. But a program the agent writes and launches itself is only detected at the next reconciliation — not at the moment it's invoked.
Locally tamper-evident, not tamper-proof. Within your own user account, a sufficiently skilled attacker can rewrite files that the user can also rewrite. The resilient layer is the baseline checked into the repository, verified in CI, and read by a human in the pull request.
Knowing these limits is part of the protection. A tool whose reach you can assess is a tool you can use correctly.
Why we built this
SafeInstall isn't a side project. It's the answer to a problem we saw ourselves in daily work with AI-assisted development — and it's publicly verifiable. The complete source code is on GitHub under the MIT license. Every decision, every limit and every trade-off is there to read.
We consider that the most honest proof of competence a technology company can offer: not the claim that we understand security, but code you can inspect to check for yourself.
If you use AI agents in your development and want to know where your attack surface lies, talk to us.
At a glance
| Project | SafeInstall |
|---|---|
| Type | Open source, MIT license |
| Package | safeinstall-cli (npm) |
| Package managers | npm, pnpm, bun |
| Requirement | Node.js 20 or newer |
| Operation | Fully local — no cloud service, no account |
| Source code | github.com/Mickdownunder/SafeInstall |
| Documentation | safeinstall.dev |
Security in AI-assisted development
We advise companies that use AI agents in software development — from securing the development environment to the question of which controls actually hold in the delivery pipeline.
Cyntro Systems GmbH · Knittelfeld, Austria