About pkguard
pkguard is a free, open-source command-line tool. It audits every package manager in a folder of repos. It reads the settings you keep in git, then runs each manager's own audit. You get one report instead of one per project.
Last updated . Current version 1.2.0.
The project, in plain terms
pkguard is open source. One person maintains it in the open, and every release is public. Read the code, file a bug, or send a patch.
| Price | Free. No paid tier, no account, no telemetry. |
|---|---|
| License | MIT |
| Latest version | 1.2.0 |
| Maintainer | Jack McNicol |
| Written in | Rust. One binary, no runtime to install. |
| Config file | .pkguard.toml |
| Release notes | CHANGELOG.md |
| Support | GitHub issues |
Why it exists
Most audit tools work on one project at a time. If you keep twenty repos in one folder, you have to open each one and run its own audit by hand. Some use npm, some use uv, some use cargo. pkguard walks the folder once and reports on all of them.
It also checks the config files that live in git. Those files decide whether install scripts run, whether a lockfile is required, and where the cache sits. A bad setting is a risk even when no advisory exists. So pkguard checks settings first and advisories second.
Who builds it
pkguard is written and maintained by Jack McNicol . It is not a company product. Work happens in the open on GitHub, and pull requests are welcome.
Price and licence
pkguard is free. There is no paid tier, no account, and no telemetry. It is released under the MIT license , so you can use it at work, fork it, and ship it inside your own tools.
Your data
pkguard runs on your machine. It does not upload your code, your lockfiles, or your config. The only network traffic comes from the package managers themselves when they fetch advisories, and --no-audit turns that off. This website sets no cookies and runs no analytics.
Contact
The fastest way to reach the project is GitHub.
- Bugs and feature requests GitHub issues
- Questions GitHub discussions
- Source code https://github.com/jackmcpickle/pkguard
- Maintainer Jack McNicol
Releases
Every version is tagged on GitHub. Read the release notes or the full changelog .