Firewall
Package Firewall with OPA Policies and MCP Support
Last verified:
What is Firewall?
Hextrap Firewall is a package security tool that protects your software supply chain by scanning every package installation in real-time. It acts as a transparent proxy between your package manager (pip, npm, go) and public registries like PyPI, npm, and Go Modules, inspecting package names, versions, author metadata, and contents against security policies before allowing them to reach your system.
Key features include real-time malware detection using seven automated analyzers, typosquatting protection with fuzzy name matching against 500K+ PyPI, 2M+ npm, and 1M+ Go packages, allow/deny lists for fine-grained control, configurable soak time (1-30 days) to delay new package versions, automatic blocking of unmaintained packages, custom policies using the OPA Rego policy engine, and complete activity logging with audit trails. The firewall evaluates security policies in strict order: allow list match, deny list match, threat detection signals, soak time window, and unmaintained package status.
Hextrap Firewall is designed for development teams, security teams, and CI/CD pipelines who need to secure dependencies across Python, JavaScript/npm, and Go ecosystems. It works seamlessly with popular package managers including pip, Poetry, Pipenv, uv, npm, yarn, bun, and Go modules, requiring only a single configuration line change with no SDK, wrapper, or code changes needed.
Firewall pricing
Pricing model: Freemium
Free for open source projects. The website states 'Free for open source projects' but does not provide detailed pricing tiers, paid plan names, or specific costs for enterprise or private projects.
Firewall pros
- Real-time threat blocking before packages install
- Works with pip, npm, yarn, bun, and Go without code changes
- Seven automated threat analyzers for multi-signal detection
- Typosquat detection with 90% similarity fuzzy matching against 500K+ PyPI packages
- Typosquat detection against 2M+ npm packages
- Typosquat detection against 1M+ Go packages
- Allow lists lock production to approved dependencies only
- Deny lists block known malware and deprecated packages
- Configurable soak time delays new versions 1-30 days
- Automatic unmaintained package blocking with configurable thresholds
- OPA Rego custom policy engine for license/score/dependency blocking
- Complete activity logging with real-time dashboard
- SIEM integration for compliance exports
- Clear error messages explaining exactly why packages are blocked
- Exception system for overriding blocks without support tickets
- CACached decisions zero overhead for repeat installs
- Independent firewalls per team with separate rules
- MCP-compatible AI assistant integration for firewall management
- Bootstrap allow lists from requirements.txt or package.json
Firewall cons
- Only supports Python, npm, and Go ecosystems
- Allow list requires manual curation or AI bootstrap
- Soak time delays urgent security patch installations
- Custom OPA Rego policies require learning Rego language
- No Windows-specific configuration documentation
- Exception overrides could weaken security if misused
- Threat detection may flag legitimate packages as typosquats
- No real-time vulnerability database integration mentioned
Frequently asked questions about Firewall
What is Hextrap Firewall and what does it do?
Hextrap Firewall is a package security tool that serves as your first line of defense against malicious packages. It protects every pip install, npm install, and go get command with intelligent filtering and real-time threat detection. The firewall acts as a transparent proxy between your package manager and public registries, inspecting package names, versions, author metadata, and contents against security policies before allowing installation.
How do I set up Hextrap Firewall for my package manager?
Setup requires changing a single configuration line with no SDK, wrapper, or code changes. For pip: use pip config set global.index-url https://$HEXTRAP_USER:[email protected]/simple/. For npm: set registry=https://npm.hextrap.com/ in .npmrc with auth token. For Go: export GOPROXY=https://$HEXTRAP_USER:[email protected]. Works with pip, Poetry, Pipenv, uv, npm, yarn, bun, and Go modules.
What are the seven threat detection signals?
The seven automated analyzers are: Typosquat Detection (fuzzy matching against 500K+ PyPI, 2M+ npm, 1M+ Go packages), Dependency Confusion (detects internal-looking names on public registries), Version Anomaly (flags unusually high first versions), Code Obfuscation (scans for base64 payloads, eval() with decode chains), Install Hook Analysis (inspects npm preinstall/postinstall scripts and Python setup.py), Star-Jacking (identifies packages claiming popular GitHub repos they don't own), and Coordinated Burst (flags 5+ packages from same author within 30 minutes).
What is soak time and how does it work?
Soak time delays installation of newly released package versions for 1-30 days, giving the security community time to discover issues before they reach production. You can configure the delay duration, create exception lists for urgent updates, and set per-package soak time rules. The average time to detect malicious packages after publication is 48 hours.
How do allow lists and deny lists work?
Allow lists define exactly which packages your team can install, locking production environments to approved dependencies only with version constraints for precise control. You can whitelist specific packages and versions, block everything else by default, and import from requirements.txt or package.json. Deny lists block known malicious packages, deprecated libraries, or packages not meeting security standards, with custom deny rules supporting wildcards.
What is typosquatting protection and how does it detect impostor packages?
Typosquatting protection detects and blocks packages impersonating popular libraries with subtle name variations using fuzzy name matching algorithms, Levenshtein distance analysis, and homoglyph/unicode detection. Names exceeding 90% similarity are flagged automatically, such as requ3sts which is 95% match to requests.
Can I write custom security policies for Hextrap Firewall?
Yes, you can write custom security policies using the Open Policy Agent Rego language. Policies deny by default and you define allow rules that evaluate package metadata, scores, dependencies, and community signals. You can block by license, security score, quality score, maintenance score, or dependency count. The interface includes a built-in editor with syntax highlighting and full access to package metadata and community data.
How does activity logging work and what compliance features are included?
Activity logging provides a complete audit trail of every package installation attempt, showing who installed what, when, and whether it was allowed or blocked. Features include a real-time activity dashboard, ability to export logs for compliance, and integration with SIEM tools. Every exception is also logged in the activity feed with who created it and when.
What happens when a package is blocked and how do I create an exception?
When a package is blocked, the developer sees a clear error message explaining exactly why it was blocked—no ambiguous failures or silent drops. If a legitimate package gets flagged by automated detection, you can create an exception to override the block for your firewall. The package is immediately unblocked without support tickets or waiting. Exceptions are scoped to individual firewalls so one team's override doesn't change another team's security posture.
Which package ecosystems does Hextrap Firewall support?
Hextrap Firewall protects Python/PyPI (500K+ packages monitored with full support for requirements.txt, Poetry, and Pipenv), JavaScript/npm (2M+ packages monitored, works with npm, yarn, package.json and lock files), and Go Modules (1M+ modules monitored with GOPROXY support and full compatibility with go.mod).