Safedep · safedep bundle SafeDep protects developers and AI coding agents against malicious open source components. External components are the blindspot: developers and agents can inspect the code they own, not the packages, IDE extensions, Agent Skills, MCP servers, and GitHub repositories they pull in, and every one of those can carry a supply chain attack (Shai-Hulud, Miasma, S1ngularity). The toolset: vet (scan dependencies for malware and known vulnerabilities), PMG (block malicious npm/pip/other packages at install time), gryph (audit what AI coding agents read, write, and execute), xBom (AI- and SaaS-aware bill of materials), plus SafeDep Cloud, Endpoint Hub, and an MCP server for hosted governance and fleet visibility. Use this skill whenever the user wants to secure their dependencies, block or detect malicious packages, scan a repository for vulnerabilities, deploy SafeDep for a team, install or configure vet / PMG / gryph / xBom, monitor developer machines for malicious package installs, investigate package activity or a
