Supply-Chain Guard, explained for beginners

Supply-Chain Guard stops AI coding agents from installing fake or look-alike software and from switching off their own safety prompts.

What it is

Modern software is built from thousands of free building blocks called packages, downloaded from public libraries. AI coding agents install packages for you. Two problems: AI models sometimes recommend packages that do not exist (attackers then publish malware under those names), and attackers publish look-alikes of popular packages with one letter changed.

Supply-Chain Guard checks every install and every change to the agent's own settings before it happens. Invented names, look-alikes, untrusted download sources, install-and-run commands copied from a README, and tricks that switch off the agent's safety prompts are refused. When it cannot tell (for example no registry to check), it asks a person rather than allowing. Ordinary installs go through.

An everyday comparison

A pharmacist who checks every prescription: the medicine must exist, come from a licensed supplier, and not be a look-alike name.

How it works, in 4 steps

1. The coding agent wants to install a package or change a settings file.
2. The guard checks the name, the source and the change.
3. Fakes, look-alikes and setting tampering are refused; unclear cases wait for a person.
4. Ordinary work is allowed.

Try it now

Open the six live demo tools → Every button sends a real request to the live product and shows the real answer.

See it on the homepage: Supply-Chain Guard section →

Who it is for

Every company whose developers use AI coding agents, and security teams responsible for what gets installed.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.