| name | pre |
| description | Use when installing, configuring, or troubleshooting pre, the security proxy that scans packages against the OSV database before package managers install them.
|
pre
Run pre setup once to install shell hooks in ~/.zshrc or ~/.bashrc.
Run pre status for read-only install state, managers, and cache info.
Run pre teardown to remove shell hooks.
After setup, npm install, pip install, brew install, and friends are
scanned automatically — no wrapper commands needed.
Supported managers: brew, npm, pnpm, bun, go, pip, pip3, uv, poetry.
Emergency bypass
Never edit shell files to bypass pre. Use:
PRE_DISABLE=1 npm install react
export PRE_DISABLE=1
pre teardown
Runtime switches
| Env var | Effect |
|---|
PRE_DISABLE=1 | Skip all scans, run the package manager directly |
PRE_QUIET=1 | Hide progress and clean summaries; CVEs still print |
PRE_NO_BACKGROUND=1 | Disable detached background scans |
PRE_MAX_PACKAGES=N | Skip scanning past N packages |
PRE_CACHE_TTL=0s | Bypass cache for one install |
Package commands
pre installed
pre install <mgr> <pkg>
pre update <mgr> [pkg]
pre downgrade <mgr> <pkg> <ver>
pre uninstall <mgr> <pkg>
pre scan system
pre manage opens an interactive TUI — avoid it in non-interactive agent
sessions; use the flag form instead:
pre manage --package <pkg> --manager <mgr> --upgrade [version]
Agent Setup
pre skills add
pre skills add --global
pre skills show
Config
pre config shows config; pre config set <key> <value> updates it.
Keys: api.endpoint, cache.ttl, systemScan, systemTTL, managers.
Agent loop
- Run
pre status to check install state.
- If hooks are missing and interception is wanted, run
pre setup.
- Run installs normally; only high/critical CVEs block with a Y/N prompt.
- In non-interactive sessions, expect blocked installs to fail — inspect
the printed CVE details and choose a safe version instead.
- Report scan results and any bypasses used.
