DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to scan project dependencies for risks before release with Forge Guardian

Run one local scan to list dependency findings with severity and fix versions, without sending data out.

Remote script. The install command pipes a script from GitHub directly into bash, so review install.sh first if your policy requires it.

Who it is forA developer preparing a release who wants to know which dependencies carry known CVEs or suspicious install scripts.

The problemDependency lists grow quietly, and it is hard to see which packages have known vulnerabilities or malicious behavior.

The outcomeA list of findings for the project with severity and fix versions, produced entirely on the local machine.

What you need first

  • A terminal (bash on Linux or macOS, or PowerShell on Windows), or Docker
  • A project directory with dependencies to scan
  • Git and make only if building from source

Steps

  1. Install Forge Guardian with curl -sSfL https://raw.githubusercontent.com/Mah3Sec/ForgeGuardian/main/install.sh | bash
  2. Run fgctl update to refresh the community signatures
  3. Change into your project folder and run fgctl scan .
  4. Read the findings, noting severity and the fix version listed for each
  5. If an optional engine such as Grype, Trivy, or Semgrep is missing, run fgctl doctor --fix, then scan again

Prompt for your agent

Using the repo Mah3Sec/ForgeGuardian, install the CLI and run `fgctl scan .` on <project-path>. Report the findings with severity and fix versions. Verify that the scan ran offline by confirming the output lists engine results for the project's packages.

Caveat. Grype, Trivy, and Semgrep are optional and only run when installed, so the default scan covers the five always-on engines.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for Mah3Sec/ForgeGuardian and "Scan project dependencies for risks before release"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer