phi is install-time interception for software supply chains. Every dependency — transitives included — gets scanned in memory before any code reaches disk. Lifecycle scripts off by default. Single Go binary. One tool, two ecosystems: npm packages and Go modules, same scan engine, same audit trail.
curl -sSL https://phi.philtechs.org/install.sh | sh
iwr -useb https://phi.philtechs.org/install.ps1 | iex
node_modules
The line at step 03 is the architectural moat. Bytes never touch your disk before the verdict.
Each detector hit adds points. Sum < 20 installs silently. 20–59 prompts. 60+ refuses, writes a report, exits non-zero. Pick a real package — watch the needle move.
phi audit, phi install,
phi outdated, phi why,
phi check — same shape
as your existing tooling, with the safety baked into the
install path. Auto-detects whether you're in a Node.js or
Go project from the manifest in cwd
(package.json or go.mod) and
dispatches the matching pipeline.
phi create <framework> bootstraps React,
Next, Express, Fastify, or Nest projects;
phi init --go <path> scaffolds a new Go
module. phi x <pkg> is a drop-in
replacement for npx on the Node side;
phi install <tool>@latest is the
scan-then-install analog of go install.
phi ci is the one-line non-interactive install
for Docker / GitHub Actions on the Node side;
phi audit --strict is the CI gate on the Go
side, refusing builds when phi.lock has un-overridden
BLOCKED entries. Trust a flagged package? --force
records the override; .phi-allow commits a
project-level allowlist. Keep phi current with
phi self-update — verifies the new binary's
sha256 against checksums.txt before swapping
itself.
ecosystems shipped: npm · Go modules · ecosystems queued: PyPI · crates.io · same pipeline, different parsers
Single binary. No daemon. No telemetry. No registry account required. MIT licensed.