Dev tools · alternatives · 2026

24 alternatives to Refuse

Block vulnerable package installs for you and your AI

Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Prices are shown for the 1 we have checked on their own sites, 1 of them free or with a free tier.

1
Veln — every package, verified▲17
Block bad npm and pip packages. Before they download.
May 2026 · veln.sh · its alternatives →
2
npm install actual-malware▲55
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com · its alternatives →
3
Drop – a rootless Linux sandbox with gVisor support▲193
Drop: a rootless Linux sandbox for developers. It isolates coding agents and third-party packages while preserving your work environment.
29d ago · droprun.sh · its alternatives →
4
Bumplyfree tier, from $27.24/mo▲113
Update your dependencies and undo anything
Aug 2026 · bumply.app · its alternatives →
5
Safe-install – safer NPM installs with trusted build dependencies▲19
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com · its alternatives →
6
CLI that helps AI agents avoid vulnerable dependencies▲26
deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service. I built this because AI coding agents kept suggesting outdated or vulnerable package versions. I kept having to manually tell tools like Claude and Codex to use newer, safer versions. deptrust gives the agent a quick way to verify whether a…
Jul 2026 · github.com · its alternatives →
7
zero▲94
One command to deploy Docker containers to your own server
Apr 2026 · shipzero.sh · its alternatives →
8
Packagr.app – a private package repository with security scanning▲43
Host private Python, Docker, NPM, Debian, and Conda packages. Private package registry with 4.5x faster installs, CVE scanning, and SSO. Up to 80% cheaper than Cloudsmith. Free tier available.
2019 · packagr.app · its alternatives →
9
Livinity▲90
Open-source homeserver OS with a built-in AI agent
Jul 2026 · livinity.io · its alternatives →
10
AI Hive ▲53
Build, deploy, and run all your AI agents in one platform.
May 2026 · app.aihive.global · its alternatives →
11RL
Running LLMs in one line of Python without Docker▲68
Hello Hacker News! We're Yangqing, Xiang and JJ from lepton.ai. We are building a platform to run any AI models as easy as writing local code, and to get your favorite models in minutes. It's like container for AI, but without the hassle of actually building a docker image. We built and contributed to some of the world's most popular AI software - PyTorch 1.0, ONNX, Caffe, etcd, Kubernetes, etc. We also managed hundreds of thousands of computers in our previous jobs. And we found that the AI software stack is usually unnecessarily complex - and we want to change that. Imagine if you are a…
2023 · lepton.ai · its alternatives →
12
Run LLMs in Docker for any language without prebuilding containers▲26
I've been looking for a way to run LLMs safely without needing to approve every command. There are plenty of projects out there that run the agent in docker, but they don't always contain the dependencies that I need. Then it struck me. I already define project dependencies with mise. What if we could build a container on the fly for any project by reading the mise config? I've been using agent-en-place for a couple of weeks now, and it's working great! I'd love to hear what y'all think
Jan 2026 · github.com · its alternatives →
13
The Missing Open Source Package Manager for Kubernetes Beyond Helm▲20
Hi, we are a small team from Vienna and today released our first version of a Package Manager similar to apt, Homebrew, or Chocolatey, but specifically tailored for Kubernetes environments and cloud-native software. Originally, we wanted to contribute to the Kubernetes ecosystem with a different idea; however, after talking to the community, we uncovered that package management is an even bigger problem at the moment. We are now looking for as much feedback as possible, so we would really appreciate it if you could check it out and let us know what you think! Thanks!
2024 · github.com · its alternatives →
14
PackGuard▲3
Block AI config leaks before npm publish fires
May 2026 · packguard.kartikshukla.dev · its alternatives →
15
DepsGuard▲10
Configure once, prevent the next compromised package install
May 2026 · depsguard.com · its alternatives →
16
StableBuild – make any Docker container deterministic▲8
Hi HN! I've posted this a few weeks back without much HN traction - today we've added a free community tier, so anyone can try it out. TL;DR: We’ve launched StableBuild, a new tool to easily freeze and pin Docker images, operating system packages, Python packages, and arbitrary build dependencies; in 5 lines of code: https://stablebuild.com . As the CTO at an ML startup w/ 75 people (https://edgeimpulse.com/) I’ve grown incredibly frustrated with non-deterministic builds. Last year basically every week one of our containers (we have 40+ unique ones in prod)…
2024 · stablebuild.com · its alternatives →
17
Agentinel▲18
Stop AI agents from installing malicious packages.
Jul 2026 · agentinel.habitwala.in · its alternatives →
18DP
Docker pulls more than it needs to - and how we can fix it▲8
Hi all! I've built a small tool to visualize how inefficient `docker pull` is, in preparation for standing up a new Docker registry + transport. It's bugged me for a while that updating one dependency with Docker drags along many other changes. It's a huge problem with Docker+robotics. With dozens or hundreds of dependencies, there's no "right" way to organize the layers that doesn't end up invalidating a bunch of layers on a single dependency update - and this is ignoring things like compiled code, embedded ML weights, etc. Even worse, many robotics deployments are on terrible internet,…
Mar 2026 · dockerpull.com · its alternatives →
19
Auto-Unpublish NPM Packages Published Outside CI▲6
A lot of vendors and open-source projects shared guidance on protecting users from downloading malicious NPM packages after the Shai-Hulud campaign — but almost nothing focused on protecting maintainers from accidentally (or maliciously) publishing them. So we built a small tool that continuously monitors your NPM packages and automatically unpublishes any version not produced by your CI workflow.
Nov 2025 · github.com · its alternatives →
20
I built a firewall for agents because prompt engineering isn't security▲7
Hi HN, I’m the creator of Cordum. I’ve been working in DevOps and infrastructure for years (currently in the fintech/security space), and as I started playing with AI agents, I noticed a scary pattern. Most "safety" mechanisms rely on system prompts ("Please don't do X") or flimsy Python logic inside the agent itself. If we treat agents as autonomous employees, giving them root access and hoping they listen to instructions felt insane to me. I wanted a way to enforce hard constraints that the LLM cannot override, no matter how "jailbroken" it gets. So I built Cordum. It’s an open-source…
Jan 2026 · github.com · its alternatives →
21
cmd-ai▲7
AI for your terminal/command-line
2025 · github.com · its alternatives →
22
Packagr – private Python package repository and Docker registry▲15
Host private Python, Docker, NPM, Debian, and Conda packages. Private package registry with 4.5x faster installs, CVE scanning, and SSO. Up to 80% cheaper than Cloudsmith. Free tier available.
2020 · packagr.app · its alternatives →
23
Deterministically install Linux packages with apt-lock▲18
Deterministically install Linux packages (think package-lock.json). - TrevorSundberg/apt-lock
2019 · github.com · its alternatives →
24
Dependency Guardian▲4
Supply chain protection that blocks malware at install
Jun 2026 · westbayberry.com · its alternatives →

Also compare

Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →