Install from release (recommended)

Download the latest binary for your platform from GitHub Releases:

macOS:

```bash

Build from source

git clone https://github.com/step-security/dev-machine-guard.git
cd dev-machine-guard
make build
./stepsecurity-dev-machine-guard

Requires Go 1.24+. The binary has zero external dependencies.

Enterprise: install scheduled scanning (launchd / systemd / schtasks)

./stepsecurity-dev-machine-guard install

Enterprise Setup

```bash

2. Install scheduled scanning (launchd on macOS, systemd on Linux, schtasks on Windows)

./stepsecurity-dev-machine-guard install

4. Uninstall scheduled scanning

./stepsecurity-dev-machine-guard uninstall ```

Open-source commitment: StepSecurity enterprise customers use the exact same binary from this repository. There is no separate closed-source version — all scanning capabilities are developed and maintained here in the open. Enterprise mode adds centralized infrastructure (dashboard, policy engine, alerting) on top of the same open-source scanning engine.

Building from Source

```bash

Build

make build

Clean build artifacts

make clean ```

Quick Start

Usage

stepsecurity-dev-machine-guard [COMMAND] [OPTIONS]

Examples

```bash

Options

Check for MCP configs (exit 1 if any found — useful in CI)

count=$(./stepsecurity-dev-machine-guard --json | jq '.summary.mcp_configs_count') [ "$count" -gt 0 ] && echo "MCP servers detected!" && exit 1

Enterprise: configure all settings interactively

./stepsecurity-dev-machine-guard configure

Enterprise: view saved configuration (API key masked)

./stepsecurity-dev-machine-guard configure show

Configuration

Run configure to set up enterprise credentials and default search directories:

./stepsecurity-dev-machine-guard configure

This interactively prompts for all configurable settings:

View current settings:

./stepsecurity-dev-machine-guard configure show

Configuration (~/.stepsecurity/config.json):

  Customer ID:             my-company
  API Endpoint:            https://api.stepsecurity.io
  API Key:                 ***a1b2
  Scan Frequency:          4 hours
  Search Directories:      $HOME, /Volumes/code
  Enable NPM Scan:         auto
  Enable Brew Scan:        auto
  Enable Python Scan:      auto
  Color Mode:              auto
  Output Format:           pretty
  Log Level:               error

Configuration is saved to ~/.stepsecurity/config.json with 0600 permissions (owner read/write only).

CLI flags always override config file values — this matches the shell script behavior. For example, if your config has output_format: json, running ./stepsecurity-dev-machine-guard --pretty uses pretty output. To clear a value during configuration, enter a single dash (-).

Save log level in config so it persists across runs

./stepsecurity-dev-machine-guard configure ```

In enterprise mode (send-telemetry, install), progress is always shown regardless of the log level — the output is captured as execution logs and sent to the backend for debugging.

1. Configure credentials (interactive)

./stepsecurity-dev-machine-guard configure

Verbose scan with npm packages — shows progress spinners and timing

./stepsecurity-dev-machine-guard --verbose --enable-npm-scan

Count IDE extensions

./stepsecurity-dev-machine-guard --json | jq '.summary.ide_extensions_count'

Run integration smoke tests

make smoke

Community vs Enterprise

Enterprise mode requires a StepSecurity subscription. Start a 14-day free trial by installing the StepSecurity GitHub App.

How It Compares

Dev Machine Guard is not a replacement for dependency scanners, vulnerability databases, or endpoint security tools. It covers a different layer — the developer tooling surface — that these tools were never designed to inspect.

Dev Machine Guard fills the gap by inventorying what is actually running in your developer environment. Deploy it alongside your existing security stack for complete coverage.