clidey/deptrustCLI and MCP server that checks package versions for known vulnerabilities across 14+ ecosystems including npm, PyPI, crates.io, Go modules, and GitHub Actions. Integrates with AI agents via hooks and skills.
__ __ __
___/ /___ ___ / /________ _______/ /_
/ _ / __ \/ _ \/ __/ ___/ / / / ___/ __/
/ __/ /_/ / __/ /_/ / / /_/ (__ ) /_
\__,_/\____/ .___/\__/_/ \__,_/____/\__/
/_/
deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more.
It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service to trust or configure.
This tool was born out of the frustration that is AI agents constantly using old versions.
Supported ecosystems:
@clidey/uxgroupId:artifactId package namesvendor/package package namesowner/repo package names and tags, branch refs, or commit SHAs as versionsdeptrust currently reports known vulnerabilities and gives a simple recommendation:
| Highest known severity | Recommendation |
|---|---|
| critical | block |
| high | block |
| medium / unknown | review |
| low | allow |
| none found | allow |
allow means no blocking known vulnerability was found in the public data sources. It does not prove that a package is safe.
deptrust also emits risk signals that are not CVEs. For example, a version published in the last 72 hours is marked for review so an agent does not blindly install a brand-new release.
Advisory providers are queried in parallel:
Provider coverage varies by ecosystem. If deptrust can resolve registry metadata but no configured vulnerability provider supports that ecosystem, it returns unknown instead of treating the package as safe.
Provider coverage:
| Ecosystem | Registry metadata | OSV | GitHub Advisory DB |
|---|---|---|---|
| npm | yes | yes | yes |
| PyPI | yes | yes | yes |
| Cargo / crates.io | yes | yes | yes |
| Go modules | yes | yes | yes |
| RubyGems | yes | yes | yes |
| NuGet | yes | yes | yes |
| Maven | yes | yes | yes |
| Packagist / Composer | yes | yes | yes |
| pub.dev | yes | yes | yes |
| CocoaPods | yes | no | yes |
| Hex.pm | yes | yes | yes |
| Hackage | yes | yes | no |
| GitHub Actions | yes | yes | yes |
The JSON output includes advisory coverage fields:
checked_providers: vulnerability providers deptrust actually queriedskipped_providers: configured providers skipped because the ecosystem is unsupportedadvisory_coverage: full, partial, none, or erroradvisory_coverage_reason: short explanation for the coverage valueregistry_verification: verified when registry metadata confirmed the version, or unverified when an exact-version check continued after a transient registry failureregistry_verification_reason: the registry error when verification was unavailableAn exact-version check still queries advisory providers when registry verification is temporarily unavailable. That result is always non-installable and never receives an allow recommendation. Checks for latest, unknown packages, and definitively nonexistent versions still require successful registry resolution.
HTTP requests retry 429, 502, 503, and 504 responses up to three total attempts. Retries use short exponential delays and honor Retry-After values up to two seconds; longer server-requested waits fail fast so the CLI does not hang. Exhausted advisory retries make the result incomplete and prevent an allow recommendation.
GitHub Advisory Database and GitHub Actions API requests can use a short-lived, least-privilege GitHub App token. In CI, pass it through DEPTRUST_GITHUB_TOKEN:
DEPTRUST_GITHUB_TOKEN="$GITHUB_APP_TOKEN" deptrust check npm lodash 4.17.20
The credential precedence is DEPTRUST_GITHUB_TOKEN, GITHUB_TOKEN, then GH_TOKEN. For local use, the optional GitHub CLI fallback is enabled explicitly with DEPTRUST_GITHUB_AUTH=gh deptrust check ...; it runs gh auth token without prompting. If no credential is available, DepTrust continues unauthenticated. A GitHub API rate-limit or permission failure produces unknown with diagnostics and is never treated as an OSV-only success.
DepTrust never stores, bundles, caches, logs, telemeters, or emits GitHub tokens. Authentication headers are sent only to https://api.github.com.
Check an exact version:
deptrust check npm lodash 4.17.20
Example normal response:
npm [email protected]: 2 known vulnerabilities found
recommendation: block
risk_score: 80
Check the latest version:
deptrust check pypi requests latest
Return JSON:
deptrust check --json cargo serde latest
Check a Go module:
deptrust check go golang.org/x/crypto latest
Check RubyGems, NuGet, or Maven:
deptrust check rubygems rails latest
deptrust check nuget Newtonsoft.Json latest
deptrust check maven org.apache.logging.log4j:log4j-core latest
Check Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, or GitHub Actions:
deptrust check packagist monolog/monolog latest
deptrust check pub http latest
deptrust check cocoapods AFNetworking latest
deptrust check hex plug latest
deptrust check hackage aeson latest
deptrust check github-actions actions/checkout v7.0.0
deptrust check github-actions actions/checkout main
For GitHub Actions, full commit SHAs are treated as pinned. Full semver tags such as v4.2.2 are accepted without an extra pinning signal. Major-only tags such as v4 and branch refs such as main are valid refs, but deptrust adds a review signal because they can move.
Example JSON response:
{
"ecosystem": "npm",
"package": "lodash",
"version": "4.17.20",
"latest_version": "4.17.21",
"known_vulnerabilities_found": true,
"safe_to_use": false,
"should_install": false,
"risk_score": 80,
"recommendation": "block",
"classification": "vulnerable",
"reason": "Found 2 known vulnerability records.",
"next_action": "do_not_install; use suggest_safe_version or compare_versions to choose a safer version",
"summary": "lodash 4.17.20 has 2 known vulnerabilities, including high severity. Block this exact version and prefer a fixed release.",
"signals": [],
"checked_providers": [
"OSV",
"GitHub Advisory DB"
],
"skipped_providers": [],
"advisory_coverage": "full",
"advisory_coverage_reason": "all configured vulnerability providers were checked",
"registry_verification": "verified",
"vulnerabilities": [
{
"id": "GHSA-35jh-r3h4-6jhm",
"aliases": [
"CVE-2021-23337"
],
"cve_ids": [
"CVE-2021-23337"
],
"ghsa_ids": [
"GHSA-35jh-r3h4-6jhm"
],
"summary": "Command Injection in lodash",
"severity": "high",
"source": "OSV",
"advisory_url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"affected_ranges": [
"SEMVER: introduced 0, fixed 4.17.21"
],
"fixed_versions": [
"4.17.21"
],
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
}
]
}
],
"provider_errors": []
}
Suggest the latest version only when no known vulnerabilities are found:
deptrust suggest npm lodash