safedep is SafeDep Cloud on the command line. Manage auth, query endpoint
telemetry, harden AI coding agents, and integrate with your security toolchain.
Built for humans and the agents they work with.
npx @safedep/cli setup mcp install
One command authenticates you with SafeDep Cloud, detects your AI coding agents (Claude Code, Cursor, Gemini CLI, and more), and injects MCP-based threat protection into each one.
Homebrew (macOS and Linux):
brew install safedep/tap/cli
Other installation options
npm:
npm install -g @safedep/cli
pnpm:
pnpm add -g @safedep/cli
Bun:
bun add -g @safedep/cli
Download prebuilt binaries for Linux, macOS, and Windows from the GitHub Releases page.
# Authenticate with SafeDep Cloud safedep auth login # Check your endpoint fleet safedep endpoint status # Query your security telemetry safedep query exec --sql "select name, version from packages limit 10" # Protect your AI coding agents safedep setup mcp install
Authentication and profiles: safedep auth
Log in to SafeDep Cloud, manage credential profiles, and switch between tenants.
Endpoint fleet intelligence: safedep endpoint
Monitor the health of every endpoint reporting to your tenant, list active machines,
and drill into package inventory and recent activity.
Policy management: safedep policy
Edit the one policy of your tenant: the policy base, policy overrides that select
endpoints and projects by label, and package rules that trust or block packages.
Review each policy change before you publish it, and roll back from any policy revision.
See which rule made each decision of pmg and the pull request check, and where.
Projects and labels: safedep project
List projects by label selector, set custom/ labels, and see which policy applies
to a project and why.
Audit log: safedep audit
See who changed the policy, what, and when.
Security telemetry queries: safedep query
Run SQL against SafeDep Cloud's query service. Inspect packages, events, and findings
across your entire fleet.
On-demand package scanning: safedep package scan
Submit a package version (OSS library, editor extension, and more) for malware
scanning via SafeDep Cloud, then track the verdict and read the full report.
Subscription and plan: safedep subscription
Check your plan status, start a free trial, subscribe, and manage on-demand
(usage-based) billing. Low-level billing is handled in the hosted portal.
AI agent protection: safedep protect mcp
Inject or remove the SafeDep MCP server from detected AI coding agents. Supports
Claude Code, Cursor, Gemini CLI, and more.
Integrations: safedep integration
Push SafeDep malware findings to external security tools. JFrog XRay is supported.
- Documentation: guides, concepts, and API reference
- SafeDep Cloud: the platform behind the CLI
- GitHub Issues: bug reports and feature requests
Full command reference
| Command | Description |
|---|---|
safedep auth login |
Authenticate with SafeDep Cloud |
safedep auth logout |
Remove credentials for the active profile |
safedep auth status |
Show authentication status |
safedep auth token |
Print the OAuth access token for the active profile |
safedep auth profile list |
List credential profiles |
safedep endpoint status |
Show fleet health |
safedep endpoint list |
List endpoints with filters |
safedep endpoint show |
Show endpoint detail |
safedep endpoint activity list |
List recent endpoint activity |
safedep endpoint inventory list |
List current endpoint inventory |
safedep endpoint label set |
Set custom labels on endpoints |
safedep endpoint label delete |
Delete custom labels from endpoints |
safedep endpoint policy show |
Show the policy of an endpoint and the source of each value |
safedep policy show |
Show a summary of the tenant policy |
safedep policy get |
Write the policy settings document as YAML |
safedep policy edit |
Edit the policy settings document in your editor |
safedep policy change list |
List policy changes |
safedep policy change show |
Show what a policy change does |
safedep policy change edit |
Edit the policy settings of an open policy change |
safedep policy change sync |
Move the base of a policy change to the head revision |
safedep policy change publish |
Publish a policy change as a new policy revision |
safedep policy change delete |
Delete an open policy change |
safedep policy change create |
Create a policy change that restores an old revision |
safedep policy revision list |
List policy revisions |
safedep policy revision show |
Show one policy revision with its policy settings |
safedep policy rule create |
Create a trust entry or block entries |
safedep policy rule list |
List package rules |
safedep policy rule show |
Show one package rule |
safedep policy rule update |
Change the reason, expiry, ticket or requester of a package rule |
safedep policy rule delete |
Delete a package rule |
safedep policy decision list |
List the decisions that the policy made, and where |
safedep audit event list |
List audit events of the tenant |
safedep query exec |
Execute a SQL query against SafeDep Cloud |
safedep query schema list |
List tables in the query schema |
safedep query schema show |
Show one table from the query schema |
safedep query schema get |
Get the full schema in one call (for AI agents and scripts) |
safedep project sync |
Sync GitHub or Bitbucket repositories into SafeDep projects |
safedep project list |
List projects with their labels |
safedep project show |
Show one project with its labels and policy |
safedep project label set |
Set custom labels on projects |
safedep project label delete |
Delete custom labels from projects |
safedep project policy show |
Show the policy of a project and the source of each value |
safedep project scan create |
Submit project scans by name to SafeDep Cloud-hosted scanners |
safedep project scan list |
List project scans with filters |
safedep package scan run |
Submit a package for on-demand scanning |
safedep package scan get |
Get the status and verdict of a scan |
safedep package scan list |
List package scans |
safedep package scan show |
Show the full report of a completed scan |
safedep subscription status |
Show subscription status |
safedep subscription pricing |
Show published plan and add-on prices |
safedep subscription trial enable |
Activate the free trial |
safedep subscription create |
Subscribe to the Team plan |
safedep subscription ondemand enable |
Enable on-demand (overage) billing |
safedep subscription ondemand disable |
Disable on-demand (overage) billing |
safedep subscription ondemand status |
Show on-demand billing state |
safedep subscription addon list |
List purchased add-ons |
safedep subscription addon add |
Buy an add-on |
safedep subscription addon remove |
Remove an add-on |
safedep subscription customer create |
Create the billing customer profile |
safedep subscription customer show |
Show the billing customer profile |
safedep subscription portal open |
Open the billing portal |
safedep protect mcp status |
Show SafeDep MCP integration status for detected AI agents |
safedep protect mcp install |
Inject SafeDep MCP server config into detected AI agents |
safedep protect mcp uninstall |
Remove SafeDep MCP server config from detected AI agents |
safedep integration bitbucket link create |
Issue a link code for a Bitbucket workspace |
safedep integration bitbucket link list |
List Bitbucket workspaces linked to the tenant |
safedep integration bitbucket link delete |
Unlink a Bitbucket workspace from the tenant |
safedep integration bitbucket repository list |
List repositories of a linked Bitbucket workspace |
safedep integration bitbucket allowlist update |
Update the Bitbucket scan scope and repository allowlist |
safedep integration jfrog run |
Push SafeDep malware findings to JFrog XRay |
safedep integration jfrog cursor set |
Set the JFrog feed cursor to a timestamp for the active profile |
safedep integration jfrog cursor remove |
Remove the saved JFrog feed cursor for the active profile |
safedep setup mcp install |
Guided onboarding: authenticate and configure AI agents |
safedep version |
Print CLI version |