Refuse
Refuse is an open-source shim designed to intercept package installation requests from various package managers and block those identified as vulnerable.
Our verdict
Who it's for
Block vulnerable package installs across your dev and CI/CD
Who should look elsewhere
Requires an additional step in the package installation workflow, which might introduce a slight overhead.
Pros
- +Significantly enhances software supply chain security by preventing vulnerable package installations.
- +Supports a broad range of package managers and development environments.
- +Offers flexible deployment options including a free self-hosted solution and a generous free hosted tier.
- +Provides specific safe version suggestions when blocking vulnerable packages.
- +Easy to install and integrate into existing workflows (shell, CI/CD, agents).
Cons
- −Requires an additional step in the package installation workflow, which might introduce a slight overhead.
- −The hosted Pro tier with higher scan limits is planned for future release.
Key features
- ✓Vulnerable package blocking
- ✓Support for 21 package ecosystems (npm, pip, cargo, gem, go, composer, dotnet, etc.)
- ✓Dockerfile dependency scanning (apt, apk, dnf)
- ✓GitHub Actions workflow integration
- ✓Linux distro-specific advisory checking (Debian, Ubuntu, Alpine, Red Hat)
- ✓CLI for easy installation and configuration
- ✓Self-hosted server option (Apache-2.0 licensed Docker image)
- ✓Hosted SaaS with free tier and upgrade options
Pricing
| Plan | Price | Billing | Notes |
|---|---|---|---|
| OSS / Self-host | $0 | month | Apache-2.0 CLI + server; Unlimited scans; All ecosystems |
| Hosted Free | $0 | month | 100,000 scans / 30 days; Hosted MCP at mcp.refuse.dev; All ecosystems |
| Hosted Pro | $5 | month | 5,000,000 scans / 30 days; Everything in Hosted Free; Email support |