Audits your package-lock.json for supply-chain attacks before install. Cross-checks every resolved entry against the live npm registry to detect integrity mismatches, new install scripts, and other malicious signals.
Getting started
Add lockfile-guardian to your MCP-capable client — Claude Code, Cursor, Codex, and others — by following the setup at the source, which documents the exact command, configuration, and any required API keys.






