analyze_reachability
Determine if a package is actually imported in your project by statically scanning source files, classifying usage as production or test-only for Python, npm, Maven, and Gradle.
Instructions
Analyze a project to determine whether a package is actually imported.
Statically scans source files for imports of the given package and
classifies each usage as production or test-only. Supports Python
(PyPI), JavaScript/TypeScript (npm), and Java (Maven/Gradle).
Args:
project_path: Absolute path to the project root directory.
package_name: Package name to look for. Use groupId:artifactId for Maven/Gradle.
ecosystem: One of PyPI, npm, Maven, or Gradle. Determines which scanner to use.
import_names: Override the import name when it differs from the package name
(e.g. ["bs4"] for beautifulsoup4, or a Java package prefix).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ecosystem | No | PyPI | |
| import_names | No | ||
| package_name | Yes | ||
| project_path | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| used_in | No | ||
| ecosystem | Yes | ||
| test_only | Yes | ||
| limitations | No | ||
| usage_found | Yes | ||
| build_system | No | unknown | |
| import_names | Yes | ||
| package_name | Yes | ||
| reachability | Yes | ||
| dependency_type | No | unknown | |
| internet_facing | No | ||
| dependency_evidence | No | ||
| vulnerable_api_used | No | ||
| production_usage_found | Yes |