dependency-advisor
Dependency Underuse & Replacement Advisor — Audits the dependencies of a public GitHub repo, commit or pull request (or uploaded manifests and sources) and returns a pass/warn/fail verdict, a 0-100 risk score, the top findings with manifest file:line and the fix, and a SARIF 2.1.0 log for GitHub code scanning. Parses JS/TS, Python and Rust imports with a tokenizer-level scanner and maps them to declared npm, PyPI and crates.io dependencies.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "dependency-advisor"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | Branch, tag or commit; defaults to the default branch. | |
| mode | No | deterministic makes no model call; auto makes at most one, only for symbols the curated table cannot decide. | |
| repo | No | Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head). | |
| files | No | Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths. | |
| ecosystems | No | Restrict the analysis; default all detected. | |
| repoLicense | No | SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent. |