Marshal

Spec sheet

Purpose

Marshal scans Maven and Gradle dependencies for behavioral signs of supply-chain attacks and can block risky updates at pull-request time.Read 8 Oct 2026 · marshalhq.dev

Integrations

The GitHub Action checks pull requests, and Slack webhook alerts are available for critical findings.Read 7 Oct 2026 · marshalhq.dev

License

The CLI and GitHub Action are open source under Apache 2.0.Read 8 Oct 2026 · marshalhq.dev

Headquarters

Tilburg, NetherlandsRead 28 Sep 2026 · marshalhq.dev

Maker

The founder identifies himself as Usman and says he is building Marshal solo from Tilburg.Read 8 Oct 2026 · marshalhq.dev

Availability

The hosted watcher is described as upcoming, and the maker says no price is set yet for the planned Team and Enterprise tiers.Read 8 Oct 2026 · marshalhq.dev

CLI requirement

The CLI requires Java 21 or later; the GitHub Action bundles its own runtime.Read 8 Oct 2026 · github.com

CLI requirements

The CLI requires Java 21 or later; the GitHub Action bundles its own runtime.Read 7 Oct 2026 · github.com

CVE scanners

Marshal is designed to complement CVE scanners and does not replace them.Read 8 Oct 2026 · marshalhq.dev

CVE scanning

Marshal does not look up known vulnerabilities and is intended to run alongside existing CVE scanners.Read 7 Oct 2026 · github.com

Detection signals

Signals include maintainer changes, signature drops, dependency surface growth, repository changes, and version jumps.Read 8 Oct 2026 · marshalhq.dev

Not supported

Android AGP and Kotlin Multiplatform are not supported in v1.Read 8 Oct 2026 · github.com

Notifications

The GitHub Action includes Slack webhook alerts for critical findings.Read 8 Oct 2026 · marshalhq.dev

Offline use

The open-source CLI and GitHub Action can run fully offline for cached packages.Read 7 Oct 2026 · marshalhq.dev

Registry coverage

Marshal monitors Maven Central for new versions of project dependencies.Read 7 Oct 2026 · marshalhq.dev

Risk scoring

Each dependency update receives a 0–100 risk score based on seven behavioral rules.Read 8 Oct 2026 · marshalhq.dev

Scope

The detection engine covers Maven Central with seven behavioral rules.Read 8 Oct 2026 · github.com

Security limitation

The maker says static behavioral analysis only partially detects slow, long-running social-engineering attacks such as XZ-style attacks.Read 7 Oct 2026 · marshalhq.dev

Support and maturity

Marshal is described as being in early development, and the maker directs users to GitHub Issues for issues.Read 7 Oct 2026 · github.com

Support channel

The maker’s GitHub repository links to GitHub Issues for issue reporting.Read 8 Oct 2026 · github.com

Supported build tools

Marshal supports JVM projects built with Maven or Gradle.Read 8 Oct 2026 · github.com

Unsupported projects

Android (AGP) and Kotlin Multiplatform are not supported in v1.Read 7 Oct 2026 · github.com

Plans and prices

Every Marshal plan and price →

Where Specifiction places it

• Dependency Management Software#11 of 278.1