Dependency Auditor

Dependency Auditor

A multi-language toolkit for analyzing, auditing, and managing dependencies. It scans manifests and lockfiles across 8+ ecosystems to surface vulnerabilities, classify licenses, detect bloat, and produce safe, phased upgrade plans — giving teams visibility into security, legal, and maintenance risk hidden in their dependency trees.

Core Capabilities

• Vulnerability scanning & CVE matching — match direct/transitive deps against a built-in CVE database with CVSS scoring across Node, Python, Go, Rust, Ruby, Java, PHP, .NET.
• License compliance — classify into permissive / weak-copyleft / strong-copyleft / proprietary / unknown tiers and detect incompatible combinations (e.g. GPL contamination).
• Outdated & maintenance detection — categorize updates by patch/minor/major severity; flag abandoned or end-of-life packages.
• Dependency bloat analysis — find unused, redundant, or oversized packages and consolidation opportunities.
• Upgrade path planning — semver breaking-change prediction, risk matrix, prioritization, rollback strategies.
• Supply chain security — provenance checks, typosquatting/malicious-package detection, transitive risk scoring.
• Lockfile analysis — validate freshness, integrity hashes, and cross-environment consistency for deterministic builds.

When to Use

• Auditing a project's dependencies for vulnerabilities or supply-chain risk.
• Checking license compliance before distribution or M&A due diligence.
• Planning safe, phased dependency upgrades.
• Adding a dependency security gate to CI/CD.
• Cleaning up unused or redundant dependencies.

Clarify First

Before running the audit, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Project & ecosystem — the project path and which manifests/lockfiles (the input the scanner parses)
• Audit focus — vulnerabilities, license compliance, or upgrade planning (selects dep_scanner.py vs license_checker.py vs upgrade_planner.py)
• Policy & gate — license policy strictness and fail-on-severity threshold (sets --policy, --fail-on-high, and the CI verdict)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Tools