Use this tool when the user asks whether a Python, npm, Maven,
or Gradle dependency version is vulnerable.

For Gradle JVM dependencies, use the Maven ecosystem and provide
the package as groupId:artifactId.

Args:
    package_name: Package name, or groupId:artifactId for Maven. Example: django, org.apache.logging.log4j:log4j-core
    version: Exact installed dependency version. Example: 2.2.0, 2.14.1
    ecosystem: One of PyPI, npm, or Maven.

Analyze a project to determine whether a package is actually imported.

Statically scans source files for imports of the given package and
classifies each usage as production or test-only. Supports Python
(PyPI), JavaScript/TypeScript (npm), and Java (Maven/Gradle).

Args:
    project_path: Absolute path to the project root directory.
    package_name: Package name to look for. Use groupId:artifactId for Maven/Gradle.
    ecosystem: One of PyPI, npm, Maven, or Gradle. Determines which scanner to use.
    import_names: Override the import name when it differs from the package name
                  (e.g. ["bs4"] for beautifulsoup4, or a Java package prefix).

Accepts aggregated results from check_package and
analyze_reachability, and produces a self-contained HTML
report with executive summary, sortable vulnerability table,
risk gauge, and actionable recommendations.

The report is saved to disk and the path is returned.

Args:
    results: List of PackageReport objects, each combining
        a PackageCheckResult with an optional
        ReachabilityResult.
    project_name: Human-readable project name for the
        report header.
    ecosystem: One of PyPI, npm, Maven, or Gradle.
    output_dir: Directory to save the report into.
        Created if it does not exist.