Takumi Guard now rewrites tarball download URLs for npm v11.15.0 and later, keeping installs working with npm's new supply chain protections. Users on these npm versions will see Takumi Guard's registry URL in their package-lock.json files.
Takumi Guard now supports Packagist alongside npm, PyPI, RubyGems, and Go.
PHP projects using Composer can now route composer install and composer update through Takumi Guard to block known-malicious packages before they reach your CI or development environment.
Anthropic's new Mythos-class model, Claude Fable 5, was released today, June 10, 2026. Here we share how Takumi byGMO, our AI agent for security assessment and penetration testing, will support this model.
Takumi Guard admin deployment now supports configuring WSL (Windows Subsystem for Linux). The wrapper script for the logged-on user configures Guard on the Windows host and on all of the user's registered WSL distributions with the same organization user token.
Takumi Guard admin deployment now offers a direct-write mode that writes each config file directly. Setup runs without depending on the package-manager CLI, and it can also configure Guard in advance for package managers that are not installed yet.
Takumi Guard admin deployment now configures Go modules on every target machine, alongside npm, PyPI, and RubyGems.
Takumi Guard now lets you send a test breach notification from the settings page, so you can verify that your webhook endpoints and email addresses actually receive notifications before a real malicious-package advisory ever lands.
Takumi Guard now supports Go modules alongside npm, PyPI, and RubyGems.
Go projects can now route go get, go mod download, and go build through Takumi Guard to block known-malicious modules before they reach your CI or development environment.
We've published flatt-security/takumi-guard-portal-example, an open-source example portal that lets your developers self-mint Takumi Guard organization user tokens (tg_org_) behind your own identity provider, without ever distributing a shared bot credential to developer machines.
You can now issue, list, revoke, and probe Takumi Guard organization user tokens (tg_org_) through bot-authenticated endpoints on the Takumi API. CI/CD pipelines, onboarding scripts, MDM tooling, and other automation can manage Guard tokens programmatically without going through the console.