Dependency guards

Dependency guards check named package additions against Socket.dev. A blocked result prevents the guarded install path from proceeding.

Connect a guard

Open Settings → Connections → Socket and enter your Socket.dev API token. Follow the setup form’s API token link, then select the organizations you want to connect. Checks require an active guard connection. If no service is connected, an explicit CheckPackage call reports that condition; it does not produce a safety result.

Provider behavior

Provider	Code-mode check
Claude	Pre-tool hook checks detected Bash install commands
Copilot	Pre-tool hook checks detected shell installs
Codex	Agent calls the explicit CheckPackage tool
Cursor	Agent calls the explicit CheckPackage tool

Codex and Cursor’s explicit tool path depends on the agent following its instruction to check before installing. It is not an automatic shell interceptor for every possible command.

What is checked

The guard checks explicit package additions, such as:

npm install date-fns
pip install requests
cargo add serde

Dependency restoration without package names, such as npm install or npm ci, is outside this named-package check. Supported install parsers cover npm-family tools, Python, Cargo, Go, and RubyGems. A result can include a score, risk level, and supply-chain alerts.

Limits

Checks follow the provider’s returned results and the supported command patterns. A failed lookup is not proof that a package is safe. Work and Chat do not expose the ordinary Code package-guard tool surface. You can still review dependency changes before committing them.

​Connect a guard

​Provider behavior

​What is checked

​Limits

Connect a guard

Provider behavior

What is checked

Limits