Install-path firewall

Guides by Workflow

Overview
How to Set Up Chainsaw as Your Organization's Package Proxy
How to Configure Your Package Manager to Use Chainsaw
How to Create and Manage Client Credentials for Your Team
How to Block Malicious and Typosquatted Packages at Install Time with the Chainsaw CLI
How to Install the Chainsaw CLI Unattended (CI, Fleet/MDM, Golden Images)
How to Update or Uninstall the Chainsaw CLI
How to Deploy Chainsaw in an Air-Gapped Environment
What Chainsaw Sees: Data Handling & Trust

Overview
How to Manage Repositories and Upstream Mirrors
How to Manage Cache and Optimize Build Performance
How to Point npm at Chainsaw
How to Point pip / PyPI at Chainsaw
How to Point Maven at Chainsaw
How to Point RubyGems at Chainsaw
How to Point Go Modules at Chainsaw
How to Point NuGet at Chainsaw
How to Point Cargo at Chainsaw
How to Point Composer at Chainsaw
How to Point Docker / OCI at Chainsaw
How to Point APT at Chainsaw
How to Point RPM (Yum / DNF) at Chainsaw
How to Point Hugging Face at Chainsaw

Overview
Foundation
Known-malicious blocks
Foundation
How to Manage Policy Precedence and Exception Workflows
Authoring — what to refuse
How to Block Vulnerable Packages Using CVSS and EPSS Score Policies
How to Enforce License Compliance Across Your Supply Chain
How to Set Up Release Freshness Guards to Block New Packages
How to Use Country and IP-Based Access Policies
Operations — running policies safely
How to Enable Monitoring for a Single Policy
How to Enable Checksum Fail-Closed Enforcement
How to Tune Risk Signal Weights via /settings/risk-weights
How to Route Violations to CODEOWNERS-Resolved Owners with ActionNotifyOwner
Policy DSL Reference (Rego / OPA Authoring Surface)
How to Author, Sign, and Load Signed Policy Bundles
YAML Conditions vs the Rego Policy DSL
How to Refuse Installs When a Required Signal Could Not Be Evaluated

Overview
Classic attacks — name & namespace
How to Detect Known Malware in Your Supply Chain
How to Detect and Prevent Typosquatting Attacks
How to Protect Against Dependency Confusion Attacks
How to Apply Reserved-Namespace Starter Packs
Behavioral & payload signals
How to Detect Install-Script Exfiltration
How to Detect Compromised Packages with publisherChanged and versionAnomaly
How to Detect Hidden Unicode Payloads (GlassWorm / Trojan Source)
How to Detect Shai-Hulud-Style Worm Bursts
How to Scan Container Image Layers and the Docker Malware Feed
Detect bypasses
How to Detect Bypass Attempts with `chainsaw doctor --bypass-check`
Concept
How to Use Trust Scores to Assess Package Risk

Overview
How to Secure AI/ML Model Downloads with Hugging Face Proxying
How to Scan ML Model Artifacts for Unsafe Pickle Opcodes
How to Detect Prompt-Injection in Model Cards and Prompt Templates
How to Verify MCP-Server Provenance for Claude / GPT Agent Dependencies
How to Track Agent-Tool Capability Declarations

Overview
How to Verify Package Provenance with SLSA Attestations
How to Detect Mirror Tampering with APT, Yum, and DNF Hash-Chain Provenance
How to Export Your Software Bill of Materials (SBOM) in CycloneDX Format
How to Export and Analyze Your BOM as CSV
How to Investigate a Violation in the BOM Inspector

Overview
How to Use the Patch Priority Leaderboard
How to Run the Patch Simulator
How to Generate a Hardening Bundle from the Admin Wizard
How to Answer "Are We Affected by CVE-X?" Using the Inventory Dashboard

Overview
How to Use the Dashboard to Track Supply Chain Health KPIs
How to Monitor and Analyze Traffic Patterns
How to Monitor Supply Chain Violations and Respond to Blocked Packages
How to Review and Manage Quarantined Packages
How to Use Audit Logs to Track Package Consumption and Policy Changes
How to Send Violations to Splunk HEC, Microsoft Sentinel, or IBM QRadar
How to Send HMAC-Signed Outbound Webhooks to Slack, Teams, PagerDuty, and Jira
How to Enforce Chainsaw Org-Wide

Overview
How to Invite Team Members and Assign Roles
How to Set Up Two-Factor Authentication for Your Organization
How to Configure SSO/OIDC for Your Organization
How to Configure SAML 2.0 SSO
How to Set Up SSO Group-to-Role Mappings
How to Configure SCIM Provisioning

Overview
How to Use Billy to Investigate Packages and Draft Policies
How to Use Billy MCP Tools for Violation Triage
How to Connect Claude / Cursor / GPT to Chainsaw via the Built-in MCP Server
How to Issue and Rotate AI-Agent Client Credentials

Overview
How to Integrate Chainsaw with CI/CD Pipelines
How to Configure Chainsaw with YAML Configuration Files
How to Create Custom Hook Scripts for Package Validation
How to Route GitHub Actions Builds Through Chainsaw
How to Route GitLab CI Builds Through Chainsaw
How to Route Jenkins Builds Through Chainsaw
How to Route CircleCI Builds Through Chainsaw
How to Route Azure Pipelines Builds Through Chainsaw
Troubleshooting CI/CD Integration

Categories

Browse tutorials by categories.

Security & Policy (24) Getting Started (20) Advanced Configuration (16) AI Assistant (4) AI-ML Supply Chain (4) Monitoring & Compliance (11) Remediation & Patching (2) Deployment (1) Enterprise (1) Team & Access Management (6) Dashboard & Analytics (2) Audit & Findings (4) Authentication & Authorization (46) Client Input (209) Config & Auth (13) Debug & Diagnostics (5) Guard (Install-Time) (9) Intelligence (5) Internal / Storage (82) Other (13) Policy & Enforcement (3) Policy Enforcement (11) Target & Scan (7) Upstream Registry (14)

© 2026 Chainsaw. Built with Hugo.

Esc

No guides found

↑↓ navigate Enter open Esc close

We use consent-gated analytics (Google Analytics) to improve these docs. Nothing runs until you choose. See our Privacy Policy.

Ask Billy

Hi! Ask me anything about the Chainsaw docs.

Don't enter secrets or personal data. Conversations may be logged to improve the docs. Privacy

Your question