Install-path firewall

Chainsaw How-To Guides

How to deploy and run Chainsaw — the install-path firewall for npm, pip, Maven, Docker, and 12 more.

Start here

Chainsaw is a policy proxy in front of npm, PyPI, Maven, RubyGems, Go, NuGet, Cargo, Composer, Docker/OCI, APT, RPM, and Hugging Face. Point your package managers at it, start in monitor mode, then flip to enforce once you’ve seen the data. Whether you use the managed service, run it in your own VPC, or self-host it, these guides cover getting set up, hardening, and running it in production — the rest is reference.

The engine is open source; the server is the paid tier. The Chainsaw CLI and decision engine — proxy, policy, trust scoring, typosquat, malware, provenance, SBOM — are free and open source at github.com/chain305/chainsaw-core, no account required. The multi-tenant server — dashboard, SSO/SCIM, hardening, policy signing, and SIEM export — is the paid tier. Most guides here assume you’re using that server — the managed service, your own VPC, or self-hosted.

Pick the row that matches your job. Each path is three to five tutorials and ends with packages flowing through an enforced proxy.

I’m a Platform Engineer — I want to deploy and integrate Chainsaw

You own the proxy config, the credentials, and the CI/CD wiring — whether Chainsaw is managed for you or you run it yourself. You don’t decide which CVE score is too risky; you just need installs to keep working.

Recommended path

  1. Set up Chainsaw as your organization’s package proxy — deploy and verify traffic flow. (30 min, Beginner)
  2. Configure your package manager for Chainsaw — point npm / pip / Maven / etc. at the proxy. (15 min per ecosystem)
  3. Create and manage client credentials — issue service tokens for pipelines and humans. (15 min)

Also useful: integrate with CI/CD pipelines · manage repositories and upstream mirrors · cache and build performance · YAML imports for config-as-code · custom hook scripts · traffic patterns

I’m a Security Engineer — I want to block bad packages and triage violations

You write the policies that decide what ships. Start with the highest-signal threats, then widen out to the slower-burn risks.

Recommended path

  1. Block vulnerable packages using CVSS and EPSS — the single highest-ROI policy. (20 min, Intermediate)
  2. Block typosquatted packages — refuse lookalike-name attacks before they install. (20 min)
  3. Block known malware on the install path — match against published malware feeds and refuse the install. (20 min)
  4. Protect against dependency confusion — reserve your internal namespaces. (20 min)
  5. Monitor violations and respond to blocked installs — close the loop when a developer is blocked. (20 min)

Supply-chain-integrity conditions (refuse on the install path): block install-script exfiltration · refuse compromised-package campaigns · block hidden Unicode homoglyphs · quarantine publish-velocity anomalies · reserved-namespace packs · checksum fail-closed · refuse when a required signal could not be evaluated · OS package hash-chain provenance · container image layer scanning

Also useful: license compliance · SLSA provenance · trust scores · release freshness · monitor mode before enforcing · quarantine triage · policy precedence and exceptions · country / IP access policies · AI/ML models from Hugging Face · Billy — AI policy assistant

I’m a DevOps Operator / Org Admin — I want to run Chainsaw in production

You own identity, access, audit, and compliance. Most of the work is one-time setup, then ongoing governance.

Recommended path

  1. Set up Chainsaw as your organization’s package proxy — if it’s not already deployed. (30 min, Beginner)
  2. Invite team members and assign roles — Owner / Admin / Manager / Member. (10 min)
  3. Set up two-factor authentication — for every human account. (10 min)
  4. Configure SSO — OIDC or SAML — pick one based on your IdP. (30 min)
  5. Map SSO groups to Chainsaw roles — let your IdP drive who gets Admin. (15 min)
  6. Configure SCIM provisioning — auto-deprovision leavers. (25 min)
  7. Use audit logs to track consumption — evidence for SOC 2 / ISO / internal reviews. (15 min)

Also useful: dashboard — supply chain KPIs · export SBOM (CycloneDX) · export BOM (CSV)

Browse by workflow

Every guide lives in one of eleven workflow sections. Start at a section Overview for the recommended setup-to-troubleshooting path, or jump straight to a guide.

Each guide lists its persona, difficulty, estimated_time, and (where applicable) prerequisites in its frontmatter.

Recently updated

All guides
How to Refuse Installs When a Required Signal Could Not Be Evaluated Turn on the optional fail-closed coverage gate: declare the data sources that must be evaluable, measure in warn mode, then refuse instead of allowing unchecked. Off by default. 30 minutes Advanced How to Install the Chainsaw CLI Unattended (CI, Fleet/MDM, Golden Images) A single non-interactive flow to install the Chainsaw CLI, authenticate with a pre-minted token, and wire package managers — no browser, no shell-rc edits, no prompts. Built for CI runners, MDM-managed fleets, and golden images. 15 minutes Intermediate YAML Conditions vs the Rego Policy DSL Chainsaw has two policy surfaces — the built-in YAML / dashboard conditions and the signed Rego DSL. When to reach for each, and how they relate. 10 minutes Intermediate How to Author, Sign, and Load Signed Policy Bundles Ship custom Rego rules as a cosign-signed bundle that the server verifies at load — author, sign, verify-at-load, promote — with the same signed bundle enforced at PR, install, K8s admission, and runtime, and the bundle digest stamped on each policy decision and carried into the audit trail. 30 minutes Advanced Policy DSL Reference (Rego / OPA Authoring Surface) Author custom org-specific rules in Rego against the chainsaw.policy entrypoint: the input fields a rule can read, the decision shape it returns, the supported actions, and which inputs are populated at which enforcement surface. 30 minutes Advanced What Chainsaw Sees: Data Handling & Trust Chainsaw runs as managed SaaS, in your VPC, or fully air-gapped. This page covers what the proxy reads, what it never reads, what (if anything) is sent to Chainsaw, and where the engine is open source. 10 minutes Beginner