Step-by-step guide

The five-minute start lists the commands; this guide goes through them once, in a repository you know, with what to look at in each step.

1. See what is missing. Run npx depcurfew doctor in the root of the repository. Without depcurfew.json it compares the repository with the policy init would write and lists, under "Compared with the default policy (no depcurfew.json):", every file apply would create or change and why: a package manager that installs new versions without a release-age delay, dependencies whose install scripts would run, an update bot that proposes versions sooner than the package manager would install them. Nothing fails yet; these are notes.
2. Write the policy. npx depcurfew init writes depcurfew.json and says what it found. Read its notes: it keeps a longer release-age delay the repository already has, puts well-known packages whose install scripts are not needed into installScripts.deny, and lists the packages with install scripts to review. Allow the ones the project needs in installScripts.allow; every other entry of the policy file has a safe default.
3. Look before writing. npx depcurfew explain shows the tools it detected and what the policy means for each one, including the tools that cannot enforce a part of it. npx depcurfew apply --dry-run prints the changes as a diff.
4. Apply and commit. npx depcurfew apply writes the configuration into the files each tool reads, keeps their comments and formatting, and marks the parts it manages. Commit depcurfew.json and the changed files together: from now on the team and CI get the protection from those files, whether or not they run depcurfew.
5. Check that it works. npx depcurfew doctor now compares the repository with depcurfew.json. Fix what it reports; each finding says where it is and how to fix it, and doctor rules explains every rule. A typical first finding is a CI job or Dockerfile that installs with an older package manager than the one the setting needs.
6. Block known malicious versions. npx depcurfew osv update downloads the public OSV.dev data of known malicious packages for npm, PyPI and Packagist; check, the hook, depcurfew mcp and doctor then block those versions offline. Run it again regularly; doctor says when the copy is more than a week old.
7. Keep it in CI. Add the GitHub Action, pinned to a release commit, so that doctor runs on every push and pull request and reports to code scanning. On other CI systems, run the project's own copy (see Other CI systems).
8. Guard installs by coding agents. With Claude Code, add the hook, which checks every install command before it runs; for other agents, add the MCP server.
9. Protect the whole machine (optional). npx depcurfew init --user and npx depcurfew apply --user give every project on the computer the same release-age delay and script blocking, also projects without depcurfew: see Protecting the whole machine.

When depcurfew.json changes later, run npx depcurfew apply again and commit the result; a second run with the same policy changes nothing.