DepWall docs

An install-time firewall for AI coding assistants. Version 0.1.1.

Install

Requires Node 20 or newer. Check with node --version.

$ npm install -g depwall
$ depwall init

init installs PATH shims, adds them to your shell profile, and wires the Claude Code hook. It explains each change, asks before making it, and backs up every file it touches. It is safe to re-run.

$ depwall init --yes         # no prompts
$ depwall init --project     # project-local instead of user-level
$ depwall init --uninstall   # undo everything

Windows

On Windows, init prints the PATH line for you to add rather than editing your PowerShell profile. Two shims are installed per manager: a .cmd for cmd.exe and PowerShell, and an extensionless script for Git Bash, which ignores PATHEXT.

Verdicts

Every check produces one of three answers, with the reason and the signals that fired.

Verdict	Meaning	Exit code
ALLOW	Nothing concerning found. The install proceeds.	`0`
ASK	Unclear. DepWall stops and asks a human.	`0` for `check`, gate for `guard`
BLOCK	Strong evidence of a problem. The install stops.	`1`

Uncertainty always resolves to ASK

No network, a registry outage, a truncated dependency tree, or an unknown package all produce ASK — never a silent ALLOW. If the guard itself cannot run, the install does not proceed.

Commands

Command	What it does
`depwall check <eco> <pkg>`	Check one package. `depwall check npm express@4.18.2`
`depwall scan <path\|url>`	Scan a repo or directory for prompt-injection and risky agent artifacts.
`depwall init`	Install shims, shell config and the Claude Code hook.
`depwall install-hook`	PATH shims only.
`depwall install-claude-hook`	Print the Claude Code PreToolUse hook snippet.
`depwall mcp`	Run the MCP server on stdio.
`depwall keygen`	Generate a signing keypair for a self-hosted cache.

AI assistants (MCP)

{
  "mcpServers": {
    "depwall": { "command": "depwall", "args": ["mcp"] }
  }
}

Tools exposed: check_package, scan_repo, and check_agent_artifacts.

MCP is advisory; the shims are the enforcement

MCP answers give your assistant something to reason about. The PATH shims from depwall init are what actually stop an install, and an assistant cannot route around them.

Deep scan

Gray-zone (ASK) packages can be analysed by an LLM for prompt-injection, exfiltration and obfuscation. Set either variable:

$ export ANTHROPIC_API_KEY=...
$ export ANTHROPIC_AUTH_TOKEN=...

It is optional and escalate-only: it can turn ASK into BLOCK, never into ALLOW. Without a key, gray-zone packages stay ASK and DepWall says so on every run.

Private registries

If your organisation uses an internal mirror, list its hosts once:

$ export DEPWALL_REGISTRY_ALLOWLIST=npm.corp.example.com,npm.pkg.github.com

Without it, a lockfile pointing at an unrecognised host resolves to ASK — deliberate, since that is also what a poisoned lockfile looks like. Listed hosts may also serve plain HTTP for localhost mirrors, but HTTP pointed at a public registry still asks.

Shared cache

Optional. Speeds up checks for public packages by consulting a shared verdict service.

$ export DEPWALL_CLOUD_URL=https://depwall-cache.sundarshahithakuri.com.np
$ export DEPWALL_CLOUD_PUBKEY=<public key>

Only public package coordinates — ecosystem, name, version — are sent. Your code, files and private package names never leave your machine. With a key pinned, every cloud verdict is signature-verified; anything forged, unsigned, stale or future-dated is rejected and DepWall falls back to a full local check.

Coverage

20 package managers plus git:

npm pnpm yarn npx pip pip3 pipx uv uvx cargo go brew gem bundle bundler composer dotnet mvn gradle gradlew

Depth	Where
Registry signals + gray-zone LLM judge	npm (incl. pnpm, yarn, npx)
Provenance, maturity, judge on README/description, build-script scanning	pip, cargo, go, RubyGems, Composer, NuGet, Maven/Gradle
Homebrew-core membership; third-party taps escalate	brew
Lockfile tree expansion + resolved-URL provenance	package-lock, yarn, pnpm, Gemfile.lock, composer.lock
Host-aware gating	`git clone`, `curl … \| sh`

Environment variables

Variable	Effect
`ANTHROPIC_API_KEY`	Enables the gray-zone deep scan.
`ANTHROPIC_AUTH_TOKEN`	Alternative to the API key.
`DEPWALL_CLOUD_URL`	Shared verdict cache. Unset = fully local.
`DEPWALL_CLOUD_PUBKEY`	Pinned key(s) for verifying cloud verdicts. `k1:<b64>,k2:<b64>`
`DEPWALL_REGISTRY_ALLOWLIST`	Trusted internal registry hosts, comma-separated.

Limits

Install time, not runtime. A package clean at install that misbehaves later is out of reach.
No live MCP inspection. A server that only sends malicious tool descriptions once connected cannot be checked in advance.
Not a sandbox. It protects against an assistant being tricked, not one already compromised.
Command reading is not shell emulation. eval, variable indirection and xargs can evade it; the install gate still catches the package.
No detection rate is published, and none should be inferred. See the evidence page for why.

Troubleshooting

“no prebuilt binary for <platform>”

DepWall ships a compiled binary per platform. Supported: macOS (arm64, x64), Linux (x64, arm64), Windows (x64).

“the platform package … is missing”

The install skipped optional dependencies. Reinstall with them:

$ npm install -g depwall --include=optional

Every install asks after I set an internal mirror

Add the mirror host to DEPWALL_REGISTRY_ALLOWLIST — see private registries.

Shims are installed but nothing is intercepted

The shim directory is probably not first on PATH. Run depwall init again, or check that ~/.depwall/shims precedes your package manager in echo $PATH.

Report a missed detection

That is the most useful bug you can file: open an issue.