Freedom251 › Dependency Management Software

Marshal

Free plan Self-hosted

What Marshal is

Marshal is a self-hosted dependency update guard for Maven and Gradle projects. It checks new versions in Maven Central for behavioral signals associated with software supply-chain attacks and can block risky updates at pull-request time. Each dependency update receives a score from 0 to 100 across seven behavioral rules. Signals include maintainer changes, dropped signatures, dependency growth, repository changes, version jumps and yanked versions. The open-source GitHub Action checks pull requests and can send Slack webhook alerts for critical findings. The CLI and GitHub Action are available under the Apache 2.0 license and can run offline when packages are cached. The CLI requires Java 21 or later; the GitHub Action includes its own runtime. Marshal supports Maven and Gradle projects, including Spring Boot, Spring and plain JVM libraries. It does not look up known vulnerabilities, so it is designed to run alongside CVE scanners. Android projects using AGP and Kotlin Multiplatform are not supported in v1. The maker describes Marshal as being in early development and directs users to GitHub Issues for problems. Its founder, Usman, says he is building the project solo from Tilburg, Netherlands. Planned Team and Enterprise tiers are described as coming soon, with no price set.

Who it suits

Marshal suits teams maintaining Maven or Gradle JVM projects that want behavioral checks on dependency updates before pull requests are accepted. It is for users comfortable with self-hosting and pairing it with an existing CVE scanner.

What it does well

Scores dependency updates from 0 to 100.
Checks seven behavioral attack signals.
GitHub Action checks pull requests.
Open-source CLI and Action are Apache 2.0 licensed.
Can run offline for cached packages.

What to know first

Does not scan for known CVEs.
Does not support Android AGP or Kotlin Multiplatform in v1.
CLI requires Java 21 or later.
Project is described as being in early development.

Limits

The free CLI and GitHub Action cover behavioral analysis for Maven Central, but do not look up known vulnerabilities. Android AGP and Kotlin Multiplatform are unsupported in v1, and the CLI requires Java 21 or later.

Plans

Plan	Billed and limits	Price
CLI and GitHub Action	Open source under Apache 2.0 · self-hostable	Free
Enterprise	Self-hosted tier · coming soon · no price set	On request
Team	Hosted watcher · coming soon · no price set	On request

As marshalhq.dev lists them, read 8 Oct 2026. The maker's own page has the final word.

Getting started

Visit marshalhq.dev to access the project.
Choose the open-source CLI or GitHub Action.
For the CLI, provide Java 21 or later; the Action bundles its runtime.
Configure the GitHub Action to check pull requests.
Use Slack webhook alerts for critical findings if needed.

Verdict

Pick Marshal if you maintain Maven or Gradle projects and want self-hosted behavioral checks during dependency updates. It complements a CVE scanner rather than replacing one; teams using Android AGP or Kotlin Multiplatform should look elsewhere for this coverage.

Questions

Is Marshal free?

Yes. The CLI and GitHub Action are listed as free and are open source under Apache 2.0.

Can I self-host Marshal?

Yes. The CLI and GitHub Action are self-hostable.

Which build tools and projects does it support?

Marshal supports Maven and Gradle projects, including Spring Boot, Spring and plain JVM libraries. Android AGP and Kotlin Multiplatform are unsupported in v1.

Does Marshal scan for CVEs?

No. It does not look up known vulnerabilities and is intended to run alongside existing CVE scanners.

What does Marshal check?

It monitors Maven Central for new dependency versions and scores updates across seven behavioral rules, including maintainer and repository changes, signature drops, dependency growth, version jumps and yanked versions.

Are Team and Enterprise plans available?

The hosted Team watcher and self-hosted Enterprise tier are described as coming soon. No price is set for either tier.

Facts from Marshal's own pages

Availability: The hosted watcher is described as upcoming, and the maker says no price is set yet for the planned Team and Enterprise tiers. · marshalhq.dev, 8 Oct 2026
CLI requirement: The CLI requires Java 21 or later; the GitHub Action bundles its own runtime. · github.com, 8 Oct 2026
CLI requirements: The CLI requires Java 21 or later; the GitHub Action bundles its own runtime. · github.com, 7 Oct 2026
CVE scanners: Marshal is designed to complement CVE scanners and does not replace them. · marshalhq.dev, 8 Oct 2026
CVE scanning: Marshal does not look up known vulnerabilities and is intended to run alongside existing CVE scanners. · github.com, 7 Oct 2026
Detection signals: Signals include maintainer changes, signature drops, dependency surface growth, repository changes, and version jumps. · marshalhq.dev, 8 Oct 2026
Headquarters: Tilburg, Netherlands · marshalhq.dev, 28 Sept 2026
Integrations: The GitHub Action checks pull requests, and Slack webhook alerts are available for critical findings. · marshalhq.dev, 7 Oct 2026
License: The CLI and GitHub Action are open source under Apache 2.0. · marshalhq.dev, 8 Oct 2026
Maker: The founder identifies himself as Usman and says he is building Marshal solo from Tilburg. · marshalhq.dev, 8 Oct 2026
Notifications: The GitHub Action includes Slack webhook alerts for critical findings. · marshalhq.dev, 8 Oct 2026
Not supported: Android AGP and Kotlin Multiplatform are not supported in v1. · github.com, 8 Oct 2026
Offline use: The open-source CLI and GitHub Action can run fully offline for cached packages. · marshalhq.dev, 7 Oct 2026
Purpose: Marshal scans Maven and Gradle dependencies for behavioral signs of supply-chain attacks and can block risky updates at pull-request time. · marshalhq.dev, 8 Oct 2026
Registry coverage: Marshal monitors Maven Central for new versions of project dependencies. · marshalhq.dev, 7 Oct 2026
Risk scoring: Each dependency update receives a 0–100 risk score based on seven behavioral rules. · marshalhq.dev, 8 Oct 2026
Scope: The detection engine covers Maven Central with seven behavioral rules. · github.com, 8 Oct 2026
Security limitation: The maker says static behavioral analysis only partially detects slow, long-running social-engineering attacks such as XZ-style attacks. · marshalhq.dev, 7 Oct 2026
Support and maturity: Marshal is described as being in early development, and the maker directs users to GitHub Issues for issues. · github.com, 7 Oct 2026
Support channel: The maker’s GitHub repository links to GitHub Issues for issue reporting. · github.com, 8 Oct 2026
Supported build tools: Marshal supports JVM projects built with Maven or Gradle. · github.com, 8 Oct 2026
Unsupported projects: Android (AGP) and Kotlin Multiplatform are not supported in v1. · github.com, 7 Oct 2026

Where Marshal stands on Freedom251

Dependency Management Software#14 of 27