scalp policy check

Evaluates your policy against the current dependency tree without installing a single package. Useful for quick feedback in CI or during development — resolve, parse, evaluate, enforce, done.

Usage

scalp policy check [flags]

Flags

How it works

1. Loads policy (or defaults if missing)
2. Resolves dependencies (lockfile-only, no install)
3. Parses the lockfile → flat list of PackageNode
4. Evaluates policy rules: allow/deny, transitive max_depth
5. Evaluates trust scores (if min_score > 0 or require_hash)
6. Applies enforcement: block, warn, or log

No install, no hash sync, no audit — just evaluation.

Basic usage

scalp policy check

When policy passes:

policy check ok

When violations are found (warn mode):

! policy violations detected
policy violations detected:
- malicious-pkg@1.0.0 (denylist: denylist)

With CI enforcement

scalp policy check --ci

Forces on_violation to block. Exit code 1 on any violation.

Check a specific policy

scalp policy check --policy custom-policy.json

Why use policy check instead of ci?

policy check is faster because it skips the install and hash sync. Use it when you want policy feedback in seconds, not minutes.