Docs/Config

User file, then scan root, then each repo.

Reads the user config, then .pkguard.toml at the scan root and in each repo. Closer wins; flags win over files.

Search order

Config is TOML, layered field by field. Later layers win, and flags win over files. Unknown keys are rejected, so a typo fails the run.

user

~/.config/pkguard/config.toml on Linux; ~/Library/Application Support/dev.pkguard.pkguard/config.toml on macOS

scan or repo

.pkguard.toml

Example

Every key the binary accepts. Advisory results are cached by lockfile digest in the platform cache dir; override the location withPKGUARD_CACHE_DIR.

.pkguard.toml

preset = "standard"          # relaxed | standard | strict
managers = ["npm", "cargo"]  # limit which managers are audited
jobs = 8
audit = true                 # set false to skip live package-manager audits

[policy]                     # overrides the preset's defaults
ignore_scripts = true
min_release_age_days = 3
require_lockfile = true
require_pm_pin = true
audit_level = "high"         # advisory gate: info | low | moderate | high | critical
registry = "https://npm.corp.example/"

[agentic]
enabled = true               # report agentic-hygiene findings (default: true)
apply = false                # let a future fix command write them (default: false)

[manager.npm]                # per-manager override, beats [policy]
audit_level = "critical"

Edit this page on GitHub