Setup Guide

Protect your dependencies from supply chain attacks. Pick the integration that fits your workflow.

Pick your tool

Pick the setup that fits your workflow.

Command Line Free & Open Source

The GardWatch CLI is free and open source. No Gardera account or API key required. See the GitHub repo for installation and usage instructions.

AI Assistants

GardWatch connects to your AI assistant as an MCP server. Once set up, it works the same way across all clients:

1. When the AI runs a package manager command (e.g. npm install, pip install, cargo add), GardWatch is automatically triggered
2. Package identifiers are extracted and sent to GardWatch for scoring
3. If any package is flagged CRITICAL or SUSPICIOUS, the AI warns you before continuing

You can also ask your AI assistant directly:

"Is event-stream 3.3.6 safe to install?"

All integrations require a Gardera account. Pick your assistant below for setup instructions.

Claude Code

One command sets up OAuth login, local lockfile parsing, and automatic scanning:

npx @gardera/gardwatch-mcp setup-claude

Then open Claude Code and run /mcp to complete the browser login with your Gardera account.

Uninstall

claude mcp remove gardera

Remove the hook manually from ~/.claude/settings.json if needed.

Codex

Add the Gardera MCP server to Codex with one command:

codex mcp add gardera --url https://mcp.gardera.io/mcp

The first time you use it, Codex will open your browser to complete the OAuth login with your Gardera account.

Uninstall

codex mcp remove gardera

Cursor

Add the Gardera MCP server to your Cursor config at ~/.cursor/mcp.json:

{
  "mcpServers": {
    "gardera": {
      "url": "https://mcp.gardera.io/mcp"
    }
  }
}

Open Cursor's Settings > MCP panel and enable the gardera server. Cursor will open your browser to complete the OAuth login with your Gardera account.

Uninstall

Remove the gardera entry from ~/.cursor/mcp.json.

Gemini

Add the Gardera MCP server to Gemini with one command:

gemini mcp add gardera https://mcp.gardera.io/mcp -t http

Then open Gemini and run /mcp auth gardera to complete the OAuth login with your Gardera account in your browser.

Uninstall

gemini mcp remove gardera

Other MCP clients

GardWatch runs as a local MCP server that works with any MCP-compatible AI assistant.

1. Get an API key

Go to app.gardera.io/settings/ and create a new key. Copy it. It's only shown once.

2. Add to your MCP config

{
  "mcpServers": {
    "gardera-gardwatch": {
      "command": "npx",
      "args": ["-y", "@gardera/gardwatch-mcp"],
      "env": {
        "GARDERA_API_KEY": "your-api-key"
      }
    }
  }
}

Add this to your assistant's MCP configuration file. Refer to your assistant's documentation for the config file location.

VS Code (IDE Extension)

Requires a Gardera account. The Gardera VS Code extension adds real-time dependency scoring directly in your editor.

Install

Search for Gardera in the Extensions marketplace, or:

code --install-extension gardera.gardera-vscode

Setup

1. Install the extension
2. Enter your API key when prompted (or go to Settings > Gardera > Write API Key)
3. Open or modify a lockfile. Scanning runs automatically and issues are flagged inline

Get an API key at app.gardera.io/settings/.

Features

• Inline scores. Every dependency is annotated with its GardWatch score (e.g. requests 95/100 SAFE)
• Problems panel. Critical and suspicious packages appear as errors and warnings
• Sidebar dashboard. Scan status, flagged package counts, and results
• Automatic scanning. Lockfiles are scanned when opened, saved, or modified

Cursor (IDE Extension)

Requires a Gardera account. The same Gardera extension is available for Cursor via Open VSX.

Install

Search for Gardera in Cursor's Extensions panel, or install manually:

1. Open Cursor
2. Go to Extensions (Cmd+Shift+X / Ctrl+Shift+X)
3. Search for Gardera Security and click Install

Setup

Same as VS Code. See the VS Code section for full details.

Scoring

GardWatch scores every package from 0 to 100:

Scores are based on multiple signals:

• Malware database. Known malicious packages (instant CRITICAL)
• Typosquatting. Names similar to popular packages
• Age & popularity. Download counts, package maturity
• Namespace squatting. Patterns like "popular-js" or "node-popular"
• OpenSSF Scorecard. Security best practices
• Metadata quality. Repository links, descriptions
• Version anomalies. Suspicious version spikes, 0.0.0 releases
• Homoglyphs. Non-ASCII characters in package names
• Empty metadata. Packages with no description

Comparison