Freedom251 › Software Composition Analysis Software
SafeDep vet
What SafeDep vet is
SafeDep vet is a free, self-hosted command-line tool for checking software dependencies and supply-chain risks. It looks for malicious packages, known vulnerabilities, risky CI workflows, lockfile tampering, and newly published dependency versions before production use. Scans can target directories, Git repositories, container images, SBOMs, individual packages, and installed tools. The CLI reads manifests and lockfiles for ecosystems including npm, PyPI, Go, Maven, Gradle, Cargo, RubyGems, NuGet, Packagist, and Pub, and supports Docker and OCI images plus CycloneDX and SPDX SBOMs. It works without an account and does not send source code; package ecosystem, name, and version are sent to retrieve package data. CEL rules control scan failures. vet can inventory AI libraries and cryptographic algorithms, create xBOM and CBOM reports, produce SARIF, and support GitHub pull-request checks. It runs on Linux and macOS.
Who it suits
It suits development and security teams that want self-hosted dependency, container, SBOM, and pull-request scanning across several ecosystems. Teams should verify that their platforms and package formats are supported.
What it does well
- Free plan with no expiry
- Self-hosted Linux and macOS deployment
- Scans repositories, images, SBOMs, and packages
- Supports many package ecosystems
- Pull-request checks and SBOM generation
What to know first
- v2 branch is still alpha
- Free plan supports up to three endpoints
- Team plan limits displayed endpoint count to five
- No account operation still sends package identifiers
Limits
The Free plan costs nothing, covers up to three endpoints, keeps findings for seven days, and includes community support. Team costs $100 a month, includes five endpoints at the displayed price, 90-day findings history, 50 on-demand package scans monthly, and 125 on-demand repository scans monthly.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free | up to 3 endpoints · no card · no expiry · 7-day findings history · community support | Free |
| Team | billed monthly · 5 endpoints at displayed price · 90-day findings history · 50 on-demand package scans/month · 125 on-demand repository scans/month · email support | $100 a month |
| Enterprise | volume endpoint pricing · SSO · RBAC · MDM rollout · custom retention · SIEM/EDR integrations · dedicated support | On request |
As github.com lists them, read 10 Oct 2026. The maker's own page has the final word.
Getting started
- Install vet through Homebrew, mise, Go install, or the container image
- Run the CLI on Linux, macOS, or a self-hosted environment
- Point a scan at a directory, Git repository, image, SBOM, package, or installed tool
- Apply CEL policy rules and test them against a saved scan
- Use documented GitHub pull-request checks and GitLab or Bitbucket report support
Verdict
SafeDep vet provides broad dependency and SBOM scanning without a required account or source-code upload. Its self-hosted model and alpha v2 status are important considerations for deployment planning.
Questions
Does SafeDep vet require an account?
No. The CLI can operate without an account and sends package ecosystem, name, and version to retrieve package data, not source code.
Which platforms and deployment options are listed?
Linux, macOS, and self-hosted deployment are listed. Installation is documented through Homebrew, mise, Go install, and a container image.
What does the Free plan include?
Free costs nothing, allows up to three endpoints, has no expiry or card requirement, keeps seven days of findings history, and provides community support.
Can vet generate SBOM reports?
Yes. It can create CycloneDX and SPDX SBOMs, as well as CycloneDX xBOM and CBOM reports.
What integrations are documented?
The project documents GitHub pull-request checks and report support for GitLab and Bitbucket. SARIF output is available from a saved scan for GitHub code scanning.
What license does the repository use?
The GitHub repository identifies vet as licensed under Apache-2.0.
Facts from SafeDep vet's own pages
- CI integrations
- The project documents a GitHub Action for pull request checks and report support for GitLab and Bitbucket. · github.com, 10 Oct 2026
- Ecosystems
- It reads manifests and lockfiles for npm, PyPI, Go, Maven, Gradle, Cargo, RubyGems, NuGet, Packagist, Pub and other ecosystems. · github.com, 10 Oct 2026
- Install options
- The repository lists installation through Homebrew, mise, Go install and a container image. · github.com, 10 Oct 2026
- Inventory
- vet inventories AI libraries and crypto algorithms called by code and can create CycloneDX xBOM and CBOM reports. · github.com, 10 Oct 2026
- License
- The GitHub repository identifies vet as licensed under Apache-2.0. · github.com, 10 Oct 2026
- No-account operation
- The vet CLI needs no account and sends no source code; it sends package ecosystem, name and version to SafeDep to retrieve package data. · github.com, 10 Oct 2026
- Output formats
- The CLI can write SARIF from a saved scan, and the project describes SARIF for GitHub code scanning. · github.com, 10 Oct 2026
- Policy
- CEL policy rules determine when a scan fails, and users can test rules against a saved scan. · github.com, 10 Oct 2026
- Privacy and security
- SafeDep's privacy policy says it uses TLS 1.2 or higher in transit and AES-256 encryption at rest, with SOC 2 Type II controls in progress. · safedep.io, 10 Oct 2026
- Purpose
- vet finds malicious packages, known vulnerabilities, risky CI workflows, lockfile tampering and fresh dependency versions before they reach production. · github.com, 10 Oct 2026
- Release status
- The repository says the v2 branch is in alpha and that vet v1 on main remains the latest release. · github.com, 10 Oct 2026
- Scanning targets
- vet scans directories, Git repositories, container images, SBOMs, individual packages and tools installed on a machine. · github.com, 10 Oct 2026
- Support
- The project directs users to Discord and GitHub Discussions for questions, and its pricing page lists Community support for Free and Email support for Team. · github.com, 10 Oct 2026
- Threat intelligence
- vet checks packages against SafeDep Threat Intel, which the README says analyzes new package versions when registries publish them. · github.com, 10 Oct 2026