Getting Started

Point your package managers at Chainsaw — managed or self-hosted — issue credentials, and get to your first blocked install.

How to Set Up Chainsaw as Your Organization's Package Proxy Walk through initial deployment, creating a workspace, configuring upstream repositories, and routing your first package install through Chainsaw. Beginner 30 minutes DevOps / Platform Engineers How to Configure Your Package Manager to Use Chainsaw Per-ecosystem guides for pointing npm, pip, Maven, Gradle, CocoaPods, Swift Package Manager, NuGet, Cargo, Composer, Go, Docker, RubyGems, APT, and Yum at your Chainsaw instance. Beginner 15 minutes per ecosystem Developers / DevOps Engineers How to Create and Manage Client Credentials for Your Team Create end-user, service-token, and AI-agent credentials, set expiry dates, authorize specific repositories, and rotate secrets. Beginner 15 minutes DevOps / Platform Engineers How to Block Malicious and Typosquatted Packages at Install Time with the Chainsaw CLI Run npm, pip, or go through the free Chainsaw CLI so malicious and typosquatted packages are refused before they enter your build — entirely on your machine, no server, nothing leaves the box. Beginner 10 minutes Developers / Platform Engineers How to Install the Chainsaw CLI Unattended (CI, Fleet/MDM, Golden Images) A single non-interactive flow to install the Chainsaw CLI, authenticate with a pre-minted token, and wire package managers — no browser, no shell-rc edits, no prompts. Built for CI runners, MDM-managed fleets, and golden images. Intermediate 15 minutes Platform Engineers / DevOps How to Update or Uninstall the Chainsaw CLI Update the Chainsaw CLI to a new version in place, pin a specific version, check what you're running, and cleanly uninstall — binary, shell hooks, PATH, and local state — all without sudo. Beginner 5 minutes Developers / Platform Engineers How to Deploy Chainsaw in an Air-Gapped Environment Stand Chainsaw up on a network with no outbound internet: bundle the binary, Trivy vuln DB, and upstream artifacts on an online staging box, transfer them across, and run the proxy offline with OpenSSF / Billy / telemetry cleanly disabled. Advanced 45–60 minutes (first time); 15 minutes for subsequent upgrades Platform / Security Engineers in regulated environments What Chainsaw Sees: Data Handling & Trust Chainsaw is a self-hosted proxy: packages and source code stay in your network. This page covers what the proxy reads, what it never reads, what (if anything) is sent to Chainsaw, and where the engine is open source. Beginner 10 minutes AppSec / DevSecOps / Procurement

Chainsaw is an install-path package firewall. It sits between your developers (and CI) and the upstream registries — npm, PyPI, Maven, Go, NuGet, Cargo, Composer, RubyGems, Docker/OCI, APT, RPM, and Hugging Face — and inspects every package before it reaches a machine. This section gets you from nothing to packages flowing through an enforced proxy.

Managed or self-hosted. Open-source engine. First block in minutes.

  • Run it your way. Point your package managers at the managed service, run it in your own VPC, or self-host it fully air-gapped. Self-hosted and VPC keep tenant data on your side of the wire; the managed service runs the proxy for you. Either way, Chainsaw inspects package metadata and artifacts in-line at the proxy — no agent on developer machines and no source-code upload, just the one choke point.
  • The engine is open source. The CLI and the decision engine live in a public repository at github.com/chain305/chainsaw-core. Read exactly how a block decision is made before you route a single install through it.
  • Time to first blocked install: minutes. The fastest path is the free CLI — install it and refuse a malicious package in about ten minutes, entirely on your machine. Standing up the org-wide proxy — managed or self-hosted — takes about half an hour.

What Chainsaw sees — and what stays on your side of the wire — is laid out in What Chainsaw Sees: Data Handling & Trust.

The guides below walk this path in order — from connecting to (or deploying) the proxy and pointing a package manager at it, through issuing credentials, to the free CLI on-ramp and air-gapped deployment.

A fast path: block a package in minutes

If you want to see Chainsaw refuse a package before committing to a deployment, start with the free CLI. It wraps npm, pip, or go, evaluates each package on your machine — no server, no infrastructure — and refuses anything malicious or typosquatted before it enters your build. See Block Malicious and Typosquatted Packages at Install Time (about 10 minutes). Then graduate to the org-wide proxy below when you’re ready.

Where to next

Once installs flow through the proxy, write your first policy in Policy & Enforcement, or wire Chainsaw into pipelines in Integrations & Automation.