FreemiumVisit Website
Tracked since2026
0 reviews trackedThe Bottom Line
Entry price
Free plan available, paid tiers above
Biggest pro
Significantly enhances software supply chain security by preventing vulnerable package installations.
Biggest con
Requires an additional step in the package installation workflow, which might introduce a slight overhead.
TL;DR - Refuse
- Blocks vulnerable package installations across 21 ecosystems.
- Offers both hosted and self-hosted deployment options.
- Integrates with shell, CI/CD, and AI coding agents to prevent security risks.
Pricing: Free plan available
Best for: Growing teams
What is Refuse?
Refuse is an open-source shim designed to intercept package installation requests from various package managers and block those identified as vulnerable. It acts as a protective layer, ensuring that your shell, agents, and CI/CD pipelines do not inadvertently install packages with known security advisories. By routing all installation attempts through Refuse, users can prevent the introduction of security risks into their development environments and production systems. The tool supports a wide array of ecosystems, including popular package managers like npm, pip, cargo, and gem, as well as Dockerfile dependencies and GitHub Actions workflows. It offers both a hosted SaaS option with a free tier and a self-hosted solution, providing flexibility for different operational needs. Refuse is ideal for developers, security teams, and organizations looking to enhance their software supply chain security by automatically filtering out vulnerable dependencies.
Pros & Cons
Pros
- Significantly enhances software supply chain security by preventing vulnerable package installations.
- Supports a broad range of package managers and development environments.
- Offers flexible deployment options including a free self-hosted solution and a generous free hosted tier.
- Provides specific safe version suggestions when blocking vulnerable packages.
- Easy to install and integrate into existing workflows (shell, CI/CD, agents).
Cons
- Requires an additional step in the package installation workflow, which might introduce a slight overhead.
- The hosted Pro tier with higher scan limits is planned for future release.
Key Features
Vulnerable package blockingSupport for 21 package ecosystems (npm, pip, cargo, gem, go, composer, dotnet, etc.)Dockerfile dependency scanning (apt, apk, dnf)GitHub Actions workflow integrationLinux distro-specific advisory checking (Debian, Ubuntu, Alpine, Red Hat)CLI for easy installation and configurationSelf-hosted server option (Apache-2.0 licensed Docker image)Hosted SaaS with free tier and upgrade options
Pricing Plans
Pricing checked Jul 8, 2026
OSS / Self-host
$0 / forever
- Apache-2.0 CLI + server
- Unlimited scans
- All ecosystems
- REST API; MCP on roadmap
Hosted Free
$0 / forever
- 100,000 scans / 30 days
- Hosted MCP at mcp.refuse.dev
- All ecosystems
- 90-day request logs
Hosted Pro
$5 / month
- 5,000,000 scans / 30 days
- Everything in Hosted Free
- Email support
How Refuse's pricing compares
At $5/mo, Refuse is the most affordable of its 4 direct competitors.
Entry paid plan, monthly. Pricing checked Jul 8, 2026.
Reviews
$99Free with your review
Write a reviewReview Refuse, get a free AI guide
Share your experience and we will send you Improve Your Thinking Patterns Using ChatGPT, free.
Best Refuse Alternatives
Top alternatives based on features, pricing, and user needs.
GitGuardianFreemium
Detect hardcoded secrets and exposed credentials in code and public repos
SnykFreemium
Secure your code, dependencies, containers, and IaC from dev to production
SemgrepFreemium
Static analysis for finding bugs
SocketFreemium
Secure your dependencies and ship with confidence.
GrypeFree
Vulnerability scanner for container images
CodeQLFreemium
Discover vulnerabilities across a codebase with industry-leading semantic code analysis.
Still deciding?
Most buyers shortlist 2 or 3 tools before committing. Pull a side-by-side comparison or browse the full alternatives shortlist below.
Explore More
Refuse FAQ
How does Refuse intercept package installations?
Refuse works by installing shims that wrap common package managers like npm, pip, and cargo. When an installation command is executed, the shim intercepts it, routes the package and version information to the Refuse backend for vulnerability checking, and only proceeds with the installation if the package is deemed safe.
What types of vulnerabilities does Refuse check for?
Refuse checks against a database of over 362,000 advisories, including malicious code, newly disclosed CVEs, and active threats. It also considers distro-specific advisories for Linux distributions, which can differ from generic CVE lookups.
Can Refuse be used within CI/CD pipelines?
Yes, Refuse is designed to integrate seamlessly into CI/CD pipelines, including GitHub Actions workflows. It checks every action and dependency used in your workflow against advisories before they are deployed or used.
What is the difference between a 'scan' and a 'package' in Refuse's pricing model?
One scan is defined as checking one (package, version) pair. For example, if your lockfile contains 1,000 dependencies, that would count as 1,000 scans. A Dockerfile installing 30 pinned packages would be 30 scans.
Does Refuse support private package registries or air-gapped environments?
Yes, for private registries or air-gapped environments, you can self-host the Refuse server. The self-hosted option ensures that no data leaves your network, providing full control over your security posture.
How does Refuse handle cases where a package is blocked?
When a vulnerable package is blocked, Refuse will refuse the installation and typically suggest a safe, non-vulnerable version of the package. This allows users to easily update their commands to install a secure alternative.
What are the infrastructure requirements for self-hosting Refuse?
Self-hosting Refuse is straightforward, requiring only Docker. The server ships as a single Docker image and can be run with a simple
docker run command. By default, it uses SQLite, but it can be configured for production setups as detailed in the self-host guide.Can Refuse be used with AI coding agents?
Yes, Refuse is designed to work with AI coding agents like Claude Code, Cursor, and Codex. Any package installation command issued by these agents, when routed through the shim, will be intercepted and checked for vulnerabilities.
Source: refuse.dev