DevRadar Guard detects early supply chain threat signals, verifies repo exposure, and generates guardrail files you can commit today.
Built for npm and poetry.lock workflows in Alpha. More ecosystems planned next.
Alpha runs in alert-only mode. No automatic blocking. You stay in control.
If a compromised package touched your repo — directly or transitively — you were in the blast radius. DevRadar Guard tells you when that threat creates real exposure in your codebase — before it turns into an expensive incident.
Three engines work together so your team can keep building instead of triaging security alerts.
We monitor supply chain threat signals before incidents make the news.
Alpha: GitHub Advisories, Reddit security communities, and npm ecosystem signalsWe verify repo exposure down to the version and dependency path.
Alpha: package-lock.json, poetry.lockWe generate guardrail files you can apply right away — not just alerts.
CLAUDE.md, .npmrc, hooks, GitHub ActionsYour team doesn't need another dashboard. Get guardrail files you can commit today.
Guardrail files generated from a supply chain incident scenario.
Generated guardrails from this analysis:
8 guardrail files generated — 5 shown, full list in docs
Snyk manages known vulnerabilities. Socket analyzes package risk. DevRadar Guard verifies repo exposure and compiles guardrail files from a single policy bundle.
Repo-specific exposure, not generic headlines. We don't just report incidents — we verify repo exposure across your lockfile, versions, and dependency paths.
Guardrail files you can commit today. CLAUDE.md, .npmrc, pre-install hooks, and GitHub Actions workflows — generated from your actual exposure, not a template.
AI agent and dependency policy in one flow. Claude Code settings, hooks, and dependency controls — compiled from a single policy bundle into one guardrail bundle.
DevRadar Guard runs on our own codebase first. We use the same guardrails we generate for customers.
No surprise PR failures. No automatic blocking. You review every recommendation before applying it.
Start with minimal permissions for repo inspection and lockfile parsing. No write access required.
Not ready to connect a repo? Grab our open-source starter kit on GitHub and apply baseline guardrails to your workflow.
Connect a repo — we'll check your lockfile and generate your first guardrail bundle.
Need a custom rollout for a larger team? Contact us. Contact us.
DevRadar Guard helps teams reduce supply chain risk faster. It does not guarantee complete protection. See our terms for details.
No. In Alpha, PR checks are alert-only. DevRadar does not block merges or fail PRs. Optional hard-blocking is planned for Beta with configurable thresholds.
We start with read-only permissions for repository inspection and lockfile parsing. If you later opt in to automated PR comments, we'll request write access — but that's entirely optional.
Alpha supports npm (package-lock.json) and Python (poetry.lock) first. CocoaPods, SPM, and broader ecosystem support are planned for later releases.