Deputy is a new open-source, CLI-first security toolchain from Temporal's security team designed to address the fragmented, noisy state of software supply chain security. It inventories and scans dependencies across repositories, container images, VM disk images, SBOMs, and individual packages. A key feature is its YAML/CEL-based policy system that travels with the work — usable locally, in CI, and at download time — enabling precise rules like exploit-signal gating (CISA KEV, EPSS), vulnerability SLAs with grace periods, and typosquatting detection for npm packages. Deputy also includes `deputy exec` for sandboxed package manager commands and `deputy proxy` for enforcing policies at download time across Go, npm, PyPI, RubyGems, and OCI registries. It exposes an MCP server for integration with AI coding agents. Built under Apache 2.0 and installable via `go install github.com/temporalio/deputy@latest`.
