Home / Docs / Reference

Limits

What DepWall does not do. Install time is not runtime, and command reading is not shell emulation.

• Install time, not runtime. A package clean at install that misbehaves later is out of reach.
• No live MCP inspection. A server that only sends malicious tool descriptions once connected cannot be checked in advance.
• Not a sandbox. It protects against an assistant being tricked, not one already compromised.
• Command reading is not shell emulation. eval, variable indirection and xargs can evade it; the install gate still catches the package.
• Skill vetting reads the skill file, not the bundle. A skill whose SKILL.md is unremarkable and whose bundled helper script does the stealing is not caught — only SKILL.md and MCP configs are opened.
• npm tarballs are not opened. A package whose payload sits in index.js behind preinstall is held for review, not blocked — pip and cargo get their build scripts read, npm does not yet.
• No detection rate is published, and none should be inferred. See the evidence page for why.