Dependency Guards

Dependency guards intercept package install commands during agent runs and check them against a security service before allowing the install to proceed. If a package is flagged as risky, the install is blocked and the agent is told to use a safer alternative.

​

How It Works

When an agent runs a package install command (e.g., npm install, pip install, cargo add), Mains intercepts the command, extracts the package names, and checks them against the configured guard service. If any package fails the security check, the command is denied before it executes. This works across all three agent runtimes:

​

Supported Ecosystems

Guards detect install commands for multiple package managers:

​

Socket.dev

Mains uses Socket.dev as the guard provider. Socket analyzes packages for supply chain risks, known vulnerabilities, and suspicious behavior.

​

Setup

​

What Gets Checked

For each package, Socket.dev returns: Packages below the minimum score threshold are blocked automatically.