Meet developers where they work
Use the MCP bridge with Copilot, Claude Code or Codex, and apply the same policy automatically to changed dependencies in GitHub pull requests.
DEPENDENCY GOVERNANCE FOR AI-ASSISTED DEVELOPMENT
Catch dependency policy issues.
Before the security scan.
Check exact package versions against your organization’s license and vulnerability rules before adoption. Give developers a clear decision and give security teams the evidence behind it.
Designed to complement existing tools such as Black Duck and Fortify. A discovery call does not require production access.
ONE POLICY, EARLIER IN THE WORKFLOW
Make every dependency decision reviewable.
Check the exact version
Compare declared licenses and known advisories with an agreed policy. Missing or uncertain evidence returns review instead of silently approving the dependency.
Turn findings into next steps
Retain the evidence behind every decision. For review and deny outcomes, an optional Gemini brief can translate the fixed evidence into a cited checklist without changing the policy result.
For engineeringLess dependency rework after code has already been written.
For platform teamsOne policy service across multiple coding assistants.
For AppSecEvidence-backed decisions without replacing downstream scanners.
SECURITY AND DATA HANDLING
A narrow data surface with fail-closed decisions.
Evaluation requests contain the package ecosystem, name and exact version. ossfind does not require source code for an exact-version evaluation. Package coordinates can still be confidential, so hosting and retention are agreed before a pilot.
Read the security overview →Implemented controls
- Hashed service credentials and evaluator, auditor and administrator roles
- Persistent decision history and policy fingerprints
- Bounded requests, per-principal quotas and supplier cooldowns
- Short-lived evidence caching with no stale approval fallback
The pilot is not certified under SOC 2, ISO 27001 or another independent assurance framework.
FOCUSED PRODUCT SCOPE
Keep your scanners.
Test an earlier checkpoint.
Start with one team experiencing dependency-related remediation during security review. Compare ossfind decisions with the existing workflow before expanding.
Included today
Direct exact versions, license and advisory policy, npm/PyPI/Maven evaluation, a GitHub pull-request gate, roles, audit history, optional AI review briefs and one organization per pilot instance.
Not included today
Transitive or runtime scanning, malware detection, application-code scanning, SSO, Black Duck/Fortify connectors or an uptime SLA.
FOUR-WEEK ASSISTED PILOT
Prove the value on one repository.
One team of up to ten developers, one repository and one supported ecosystem. The engagement includes assisted setup, an agreed policy, weekly review and a final results report.
- Verify the selected coding-agent workflow and access controls.
- Measure actionable findings, false positives and setup effort.
- Document remediation time saved where the evidence supports it.
CURRENT VERIFICATION
Working software, with explicit limits.
Hosted serviceHTTPS readiness, authenticated roles and audit persistence verified.
Real dependency evidenceKnown vulnerable Pillow and Log4j versions denied using live registry and OSV evidence.
Agent interfaceA real MCP client and the CLI produced centrally recorded decisions.
Pull-request gateA committed mixed npm, Python and Maven change produced allow, review and deny decisions from the live policy service.
Provider controlsDuplicate suppression, caching, cooldowns and quotas tested under simulated pressure.
FREQUENTLY ASKED QUESTIONS
Before we start
Does a coding agent always call ossfind?
No. Tool availability alone does not guarantee invocation. The included GitHub gate checks supported changed direct dependencies independently and can become a protected blocking check after an observation period.
Does ossfind replace Black Duck, Fortify or Snyk?
No. The current product adds an earlier direct-dependency checkpoint. Existing scanners continue to cover broader code, runtime and supply-chain risks.
Do you need our source code?
Exact-version evaluation requires the ecosystem, package name and version. Source code is not required. Package coordinates may still be sensitive and are covered during data-handling review.
Does AI decide whether a dependency is allowed?
No. The policy engine records its deterministic allow, review or deny result first. When explicitly enabled, Gemini can explain a review or deny and suggest cited follow-up steps; its output cannot modify the decision.
Is this ready for an enterprise-wide rollout?
The current offer is an assisted pilot. Multi-tenant isolation, SSO, enterprise scanner connectors and an uptime SLA are not included yet.
A PRACTICAL FIRST STEP
Bring one recent dependency rejection.
We’ll use a 20-minute discovery call to understand the failure, your current controls and whether a focused pilot can measure useful improvement.
Ask for a 20-minute call →