depgaze

depgaze is an AI security tool that vets software dependencies by watching how they behave during installation, making it the best AI for catching supply-chain attacks before code reaches production. Rather than scanning source, it installs each package in a disposable sandbox with no host access and monitors OS-level activity: process spawns, file writes, and network connections. That behavioral view is what lets it flag malicious, abandoned, or typo-squatted packages and even zero-day threats at install time, before they land in a build. It plugs into CI/CD as a simple CLI with pass/fail exit codes, so a compromised dependency can break the pipeline automatically. Analysis is LLM-powered and works with existing providers including OpenAI, Anthropic, and AWS Bedrock, and depgaze can be called directly by AI coding agents such as Claude Code and Codex to vet dependencies as they are added. It runs locally on Linux or remotely with Windows support, and every plan includes unlimited seats and usage. For BestAIFor readers on engineering teams, depgaze is aimed at sitting alongside existing vulnerability scanners to add runtime, install-time behavioral detection. Pricing is published and annual, starting at EUR 5,000 per year.

Vetting open-source dependencies at install time to block supply-chain attacks, typo-squatting, and zero-day threats in CI/CD pipelines.