Commands
Every DepWall command: monitor and enforce modes, doctor, check, scan, and the MCP server.
| Command | What it does |
|---|---|
depwall mode monitor | Record every verdict but block nothing — for rolling DepWall out without breaking builds on day one. depwall mode enforce turns the gate back on; depwall mode prints the current one. Deliberately not an environment variable: an env prefix travels inside the command being gated, so it would be a one-line disarm. While monitoring, doctor reports the gate as not protecting you and exits non-zero. |
depwall doctor | Verify the gate is actually blocking installs right now. Exits non-zero if it is not. |
depwall check <eco> <pkg> | Check one package. depwall check npm [email protected] |
depwall scan <path|url> | Scan a repo or directory for prompt-injection and risky agent artifacts. |
depwall init | Install shims, shell config and the Claude Code hook. |
depwall install-hook | PATH shims only. |
depwall install-claude-hook | Print the Claude Code PreToolUse hook snippet. |
depwall mcp | Run the MCP server on stdio. |
depwall keygen | Generate a signing keypair for a self-hosted cache. Not the release-signing key — those are separate on purpose. |