vetcode
Free and open source · v0.8.6
Agents install packages in a second and run cloned repositories without reading them. vetcode reads first: packages before they install, repositories after they are cloned, MCP servers before they are added.
claude plugin marketplace add openyard-cloud/vetcode && claude plugin install vetcode@openyard
malicious npm packages caught, with 26 false alarms on 1,000 clean ones. GuardDog: 903 and 43.
malicious PyPI packages caught. GuardDog on the same packages: 241.
times Claude Code installed the settled release instead of one only hours old.
open-source applications wrongly called dangerous.
In Claude Code the guard runs on its own, as a hook. Other agents call the same checks as a tool, or load the review procedure as a skill.
Before an install
npm, pnpm, yarn, bun, pip, uv, cargo and go. A name that does not exist, a look-alike of a popular one, a malware advisory, malicious code in the archive (downloaded and read, never run), a release only hours old. It answers allow, ask or deny before the command runs.
After a clone
Before the agent builds or runs anything from it: install scripts that decode and run code, instructions planted in agent files such as CLAUDE.md, hooks and auto-approved MCP servers in project settings.
Before it is added
Whether added with claude mcp add or written into a config file: the package the server would start, and an address behind a tunnel or on plain HTTP.
When you ask
"Is this repo safe to run?" or "review this before I deploy": a scan for malware, supply-chain tricks, leaked keys and risky CI and server config, and a procedure that has the agent confirm each finding by reading the code.
Every number comes from a script in the repository, run on samples its rules were not tuned on unless the source says so.
| Question | vetcode | For comparison |
|---|---|---|
| Malicious npm packages caught, of 1,000 (false alarms on 1,000 clean ones) | 947 (26) | GuardDog: 903 (43) |
| Malicious PyPI packages caught, of 300 (false alarms on 210 clean ones) | 262 (16) | GuardDog: 241 (48) |
| Asked to add a package whose newest release was hours old, 3 tries | installed the previous, settled version 3 times | Claude Code alone installed the new release 3 times |
| Malicious agent skills it had never seen, of 157 (false alarms on 1,029 clean ones) | 91 (1) | Cisco skill-scanner: 101 (56) |
| Open-source applications wrongly called dangerous, of 72 | 1 | |
| Real injection bugs where it points, of 480 advisories | 55 (11%) |
It lists the dangerous calls in web code as places to read. They stand at about one real injection bug in ten.
It does not make your agent better at finding missing authorization or business-logic flaws.
New malware can still slip through. A clean report means nothing obvious was found.
Methods, samples and every run: bench/README.md
Needs Node.js 18 or newer and nothing else. vetcode is not on npm: every command runs it from the repository, pinned to a release.
The plugin: the guard on every install, clone and MCP server, plus the review skill.
claude plugin marketplace add openyard-cloud/vetcode && claude plugin install vetcode@openyard
Codex, Gemini CLI, GitHub Copilot, Cursor, Amp, Goose, opencode and any agent that loads Agent Skills.
npx skills add openyard-cloud/vetcode
For any client that speaks MCP. In Claude Desktop, open vetcode.mcpb from the latest release instead. Listed in the MCP Registry as io.github.openyard-cloud/vetcode.
{
"mcpServers": {
"vetcode": { "command": "npx", "args": ["-y", "-p", "github:openyard-cloud/vetcode#v0.8.6", "vetcode-mcp"] }
}
}No agent at all: scan a project, a package or a cloned repository.
npx github:openyard-cloud/vetcode#v0.8.6 .
Reviews every pull request and comments on the lines it adds. On the GitHub Marketplace.
- uses: openyard-cloud/vetcode@v0.8.6
with:
fail-on: highOnly package names leave your machine, to the package registry and OSV.dev; no code, no account, no telemetry. Privacy
False alarms and anything it lets through are the reports that make it better.