security_fetch_dependency_graph
Fetch full transitive dependency tree for a given package version across ecosystems like npm, PyPI, Maven. Use to assess supply chain exposure by identifying all direct and indirect dependencies.
Instructions
Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns all direct and transitive dependencies with version constraints. Use this to understand full supply chain exposure. Use security_fetch_package_vulnerabilities instead when you only need CVEs for a single package. Verified source: deps.dev (Google). 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_dependency_graph", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | Package name e.g. requests. Required. | |
| version | Yes | Package version e.g. 2.28.0. Required. | |
| ecosystem | Yes | Package ecosystem: npm, pypi, cargo, go, maven, nuget. Required. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||