Install

Pick the channel you already use. Every surface runs the same CLI, so a scan gives the same findings wherever it runs. Channel status and listings are in Distribution status.

Coding agent? One command installs the Agent Skill, which teaches it to find, explain, and migrate findings. It is listed on skills.sh:

npx skills add velella-sh/offing

npm

Needs Node.js 22 or newer. No global install required:

npx @velella/offing scan .

To keep a pinned version on your PATH:

npm install -g offing
offing scan .

Verify. npx @velella/offing --version prints the published version (currently 0.7.1). npx @velella/offing demo reports findings for the demo project.

GitHub Action

Add the Action to a pull-request workflow:

- uses: actions/checkout@v7
- uses: velella-sh/offing@v0.7.1
  with:
    fail-on-severity: high

Verify. Open a pull request that changes a dependency. The job runs, writes annotations for findings, and exits non-zero when a finding meets the severity gate. Details: GitHub Action.

MCP

Start the local stdio server from the published package (no account or API key):

npx --yes @velella/offing mcp

Point your MCP host at that command. Example config shape:

{
  "mcpServers": {
    "offing": {
      "command": "npx",
      "args": ["--yes", "@velella/offing", "mcp"]
    }
  }
}

Verify. The host lists Offing tools including check_dependency. Call it for pkg:npm/request and confirm it reports the deprecation with a replacement and sources. Details and one-command installs per host: Local MCP server.

Plugins

Claude Code and Codex get the Skill, MCP server, and dependency guard in one install.

Claude Code:

claude plugin install offing --marketplace velella-sh/offing

Verify. claude plugin list shows offing@offing enabled. Details: Claude plugin.

Codex:

codex plugin marketplace add velella-sh/offing --ref main && codex plugin add offing@offing-codex

Verify. codex plugin list --json shows offing@offing-codex installed and enabled. Details: Codex plugin.

For the portable Skills alone (any skills.sh host):

npx skills add velella-sh/offing --skill offing --yes

Verify. The host lists offing. Details: Agent Skills. Other agent hosts: Offing for your agent.

Docker

The image is ghcr.io/velella-sh/offing (latest and each release tag). Mount the repository at /workspace; scans use no network:

docker run --rm --network none --read-only -v "$PWD:/workspace:ro" \
  ghcr.io/velella-sh/offing:latest scan /workspace

On Apple Silicon, pass --platform linux/amd64 because the image is published for that architecture.

Verify. docker run --rm ghcr.io/velella-sh/offing:latest --version prints the image's CLI version. A scan of a mounted repo returns the same finding schema as npm.

Standalone binaries

Each GitHub Release attaches binaries that need no Node.js. Download the asset for your OS, make it executable, and run it like the npm CLI. Details: Releasing — standalone binaries.

Verify. ./offing --version matches the release tag you downloaded.