Install from release (community)

Release assets are named stepsecurity-dev-machine-guard-<version>-<os> (for example, stepsecurity-dev-machine-guard-1.12.0-darwin). Rather than hardcoding a version, discover the latest asset dynamically so the command keeps working across releases.

macOS:

```bash

Build from source

git clone https://github.com/step-security/dev-machine-guard.git
cd dev-machine-guard
make build
./stepsecurity-dev-machine-guard

Requires Go 1.26+. The binary has zero external dependencies.

Enterprise: install scheduled scanning (launchd / systemd / schtasks)

./stepsecurity-dev-machine-guard install

Enterprise Setup

```bash

2. Install scheduled scanning (launchd on macOS, systemd on Linux, schtasks on Windows)

./stepsecurity-dev-machine-guard install

4. Uninstall scheduled scanning

./stepsecurity-dev-machine-guard uninstall ```

Open-source commitment: StepSecurity enterprise customers use the exact same binary from this repository. There is no separate closed-source version — all scanning capabilities are developed and maintained here in the open. Enterprise mode adds centralized infrastructure (dashboard, policy engine, alerting) on top of the same open-source scanning engine.

Building from Source

```bash

Build

make build

Clean build artifacts

make clean ```

Quick Start

The steps below install the binary directly and are intended for community users evaluating Dev Machine Guard on a single machine.

Enterprise customers should not install the binary manually. Deploy Dev Machine Guard across your fleet using the loader script through your MDM or EDR tooling. See the Installation Script documentation for the supported, auto-updating deployment flow.

Usage

stepsecurity-dev-machine-guard [COMMAND] [OPTIONS]

Examples

```bash

Options

Check for MCP configs (exit 1 if any found — useful in CI)

count=$(./stepsecurity-dev-machine-guard --json | jq '.summary.mcp_configs_count') [ "$count" -gt 0 ] && echo "MCP servers detected!" && exit 1

Enterprise: configure all settings interactively

./stepsecurity-dev-machine-guard configure

Enterprise: view saved configuration (API key masked)

./stepsecurity-dev-machine-guard configure show

Configuration

Run configure to set up enterprise credentials and default search directories:

./stepsecurity-dev-machine-guard configure

This interactively prompts for all configurable settings:

View current settings:

./stepsecurity-dev-machine-guard configure show

Configuration (~/.stepsecurity/config.json):

  Customer ID:             my-company
  API Endpoint:            https://api.stepsecurity.io
  API Key:                 ***a1b2
  Scan Frequency:          4 hours
  Search Directories:      $HOME, /Volumes/code
  Enable NPM Scan:         auto
  Enable Brew Scan:        auto
  Enable Python Scan:      auto
  Color Mode:              auto
  Output Format:           pretty
  Log Level:               error

Configuration is saved to ~/.stepsecurity/config.json with 0600 permissions (owner read/write only).

CLI flags always override config file values — this matches the shell script behavior. For example, if your config has output_format: json, running ./stepsecurity-dev-machine-guard --pretty uses pretty output. To clear a value during configuration, enter a single dash (-).

Save log level in config so it persists across runs

./stepsecurity-dev-machine-guard configure ```

In enterprise mode (send-telemetry, install), progress is always shown regardless of the log level — the output is captured as execution logs and sent to the backend for debugging.

Package Configs & Suspicious Files

Beyond inventorying what is installed, Dev Machine Guard inspects how each machine is configured to pull packages, and whether any files associated with known attacks are present.

Package-manager config auditing

Compromised packages most often reach a machine because that machine resolves directly from a public registry with no cooldown window against freshly published versions. Dev Machine Guard audits the package-manager configuration on each machine across every scope (project, user, and global) and resolves three things per package manager:

• Effective registry — the registry packages actually resolve from, accounting for configuration precedence, so you can confirm machines route through StepSecurity Secure Registry or an internal artifact manager rather than straight to the public registry.
• Cooldown policy — whether a cooldown window against newly published packages is in effect.
• Authentication surface — what credentials are configured against the registry.

Configuration is read from .npmrc (npm), pnpm config, bunfig.toml (bun), .yarnrc / .yarnrc.yml (yarn classic and berry), and pip.conf (pip). In enterprise mode this rolls up into the Package Configs view in the dashboard, where you can spot machines that are unprotected or pointed at the wrong registry.

1. Configure credentials (interactive)

./stepsecurity-dev-machine-guard configure

Verbose scan with npm packages — shows progress spinners and timing

./stepsecurity-dev-machine-guard --verbose --enable-npm-scan

Count IDE extensions

./stepsecurity-dev-machine-guard --json | jq '.summary.ide_extensions_count'

Run integration smoke tests

make smoke

Community vs Enterprise

Enterprise mode requires a StepSecurity subscription. Start a 14-day free trial by installing the StepSecurity GitHub App.

How It Compares

Dev Machine Guard is not a replacement for dependency scanners, vulnerability databases, or endpoint security tools. It covers a different layer — the developer tooling surface — that these tools were never designed to inspect.

Dev Machine Guard fills the gap by inventorying what is actually running in your developer environment. Deploy it alongside your existing security stack for complete coverage.