Marshal

Marshal checks Maven and Gradle dependency updates for behavioral signs of software supply-chain attacks and can block risky changes at pull-request time. It monitors Maven Central for new project dependency versions and scores each update from 0 to 100 across seven behavioral rules. These rules look for signals such as maintainer or repository changes, dropped signatures, dependency growth, version jumps, and yanked versions. The GitHub Action checks pull requests and can send Slack webhook alerts for critical findings. The open-source CLI and GitHub Action are self-hostable and can run offline when packages are cached. The CLI requires Java 21 or later; the GitHub Action includes its own runtime. Marshal supports Maven and Gradle projects, including Spring Boot, Spring, and plain JVM libraries, but does not support Android AGP or Kotlin Multiplatform in v1. It does not check for known vulnerabilities, so it is intended to complement CVE scanners. Marshal is in early development, with GitHub Issues listed for issue reporting. The CLI and GitHub Action are free under Apache 2.0; hosted and enterprise offerings are described as coming soon, with no price set.

Marshal focuses on behavioral indicators in Maven Central dependency updates, with a pull-request workflow and offline options. Its narrow ecosystem coverage and lack of CVE scanning mean it is a supplementary check rather than a standalone vulnerability scanner.

Marshal suits teams maintaining Maven or Gradle JVM projects that want behavioral checks on dependency updates. It is designed to complement, not replace, a CVE scanner.

Overview

Marshal is a self-hosted tool for checking Maven and Gradle dependency updates for behavioral signs of supply-chain risk. It is best suited to JVM teams that want a focused check in their pull-request workflow. Its value is the early warning on suspicious changes; it cannot replace a CVE scanner.

Key features

Marshal monitors Maven Central for new project dependency versions and assigns each update a score from 0 to 100 across seven behavioral rules. The signals include maintainer or repository changes, dropped signatures, dependency growth, version jumps and yanked versions. For teams reviewing dependency updates, this offers a way to flag unusual changes before they enter a build, though a score is a screening aid rather than a guarantee of safety.

A GitHub Action checks pull requests and can send Slack webhook alerts for critical findings. The CLI and Action can run fully offline when packages are cached, a practical advantage for restricted build environments. The CLI requires Java 21 or later; the GitHub Action bundles its own runtime.

Marshal does not look up known vulnerabilities, so teams must keep a separate CVE scanner in their pipeline. Its static behavioral analysis can also partially miss slow, long-running social-engineering attacks such as XZ-style attacks. It supports Maven and Gradle projects, including Spring Boot, Spring and plain JVM libraries, but not Android projects using AGP or Kotlin Multiplatform in v1.

Pricing

The CLI and GitHub Action plan costs nothing, is open source under Apache 2.0 and can be self-hosted. That is a useful fit for teams able to operate their own checks, but it does not include the hosted watcher. Team, the planned hosted-watcher tier, and Enterprise, the planned self-hosted tier, are both coming soon with custom pricing.

Platforms

Marshal is self-hosted. Its available CLI and GitHub Action support Maven and Gradle workflows; the CLI needs Java 21 or later, while the Action carries its own runtime. Android AGP and Kotlin Multiplatform projects are outside the v1 scope.

Who it's for

Marshal makes the most sense for JVM teams using Maven Central that want behavioral checks on dependency updates at pull-request time, especially where offline operation matters. It is not a fit as a standalone vulnerability-management tool, or for teams whose projects rely on Android AGP or Kotlin Multiplatform. The project is in early development, with issue reporting directed to GitHub Issues, so teams that need a mature hosted service or established support path should look elsewhere.

Pros and cons

• Pros: Free, Apache 2.0-licensed CLI and GitHub Action allow self-hosting; offline operation for cached packages suits isolated build environments.
• Pros: Pull-request checks and Slack alerts for critical findings put behavioral warnings near the update decision.
• Cons: Maven Central coverage and Maven/Gradle support leave other ecosystems and Android AGP or Kotlin Multiplatform out of scope.
• Cons: No CVE lookup and partial limits against slow social-engineering attacks mean Marshal cannot serve as a complete security check.
• Cons: Early development and upcoming hosted tiers may not suit teams seeking a mature managed offering.

Alternatives

Dependency Management Software is the broader category to browse when Marshal’s narrow security focus does not match the need.

Choose ActiveState Platform if a freemium service with a free organization plan for public projects and a free trial better fits your setup. Depfu is another option if you want a free personal or open-source plan with unlimited dependency updates, or a paid Starter plan at $29 a month.

Sonatype Nexus Repository may suit teams looking for repository management, with a free Community Edition and a paid Pro Edition. DepsHub offers a free Open Source plan with unlimited public repositories, team members and security alerts; consider it when those limits matter.

Endor Labs is worth considering for individual developers seeking free local scans without an account, while FOSSA has a free plan capped at five projects and ten contributing developers. Kusari is another freemium alternative for teams comparing supply-chain security options. Renovate offers free cloud or self-hosted community options for dependency updates.

Verdict

Choose Marshal if your team builds JVM software with Maven or Gradle and wants a free, self-hosted behavioral check on dependency updates before pull requests merge. Its focused signals and offline support are useful additions, but its Maven Central scope, early maturity and lack of CVE scanning make it a poor choice as your only dependency security tool.