Loading…
Open-Policy Exchange
~4 min to deploy
Cursor Dependency-Install Whitelist
Blocks an agent installing a package from an unapproved registry or adding a dependency with no lockfile entry.
For: Teams worried about agent-introduced supply-chain risk
SOC 2 CC7.1ISO 27001 A.8.9Supply-chain evidence
What it enforces
Registry whitelist
Blocks installs pointed at a registry outside the approved list.
Global install block
Blocks machine-wide (`-g`) installs — the agent stays inside the project.
Unpinned dependency escalation
Escalates a new dependency added without a resolved lockfile entry.
cursor-dependency-install-whitelist.yaml
# Cursor Dependency-Install Whitelist
# Fork: replace approved_registries with your own mirror / proxy.
apiVersion: decionis.dev/v1
kind: PolicyPack
metadata:
name: cursor-dependency-install-whitelist
surface: cursor
standards: [SOC2-CC7.1, ISO27001-A.8.9]
defaults:
mode: shadow
emit_dossier: true
fail_closed: true
approved_registries:
- "https://registry.npmjs.org"
- "https://pypi.org/simple"
rules:
- name: registry_whitelist
when: "tool == 'Bash' AND command matches '(npm|pnpm|yarn|pip) (install|add)'"
decision: |
BLOCK IF resolved_registry not in approved_registries
ALLOW OTHERWISE
reason_code: registry_not_approved
- name: global_install_block
when: "tool == 'Bash' AND command matches '(npm|pnpm|yarn) (install|add)'"
decision: |
BLOCK IF command matches '(\s-g\b|--global)'
ALLOW OTHERWISE
reason_code: global_install_blocked
- name: unpinned_dependency
when: "change.kind == 'dependency_add'"
decision: |
ESCALATE IF lockfile.entry_present == false
ALLOW OTHERWISE
reason_code: dependency_not_pinned
Fork it, change the thresholds to match your environment, and deploy in shadow mode first — it defaults to listen-only so nothing in your live pipeline changes.
How to install it
Follow the install path for this surface, then paste the forked YAML as your policy config.