Vetgate

The research confirms enterprise-oriented package scanning, a major supply-chain scanner, an open egress proxy, and free vulnerability and dependency metadata interfaces. It did not find a reviewed product that gates the local install moment across package and extension ecosystems for a solo developer. One of three proposed interfaces remains unverified and no structural incumbent copying cost is evidenced.

Vetgate cannot intercept every install path or prove a package safe. Vulnerability databases are incomplete and delayed; maintainer reputation is contextual; static rules and behavior detonation produce false positives and false negatives; a clean install script does not establish runtime safety; and signatures prove origin or integrity only within their trust model. Local-first processing reduces selected egress but does not prove device-wide no-egress.

The product should begin with one package manager and explicit invocation. It resolves a lockable artifact before install, shows provenance and requested behavior, evaluates deterministic customer policy, uses an isolated synthetic environment for permitted observation, and leaves the developer an authenticated, reasoned, expiring override with recovery instructions.

Solo developers and small engineering teams that allow coding agents to propose dependency changes but want a controlled install boundary.