Enables AI agents and developers to score npm packages, PyPI packages, and GitHub repositories for maintenance health, producing A–F grades, per-signal details, and plain-language risk lists before adoption. It supports checking individual packages, scanning manifests or lock files for transitive dependencies, and comparing alternatives.
Enables auditing npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories to surface dependency vulnerabilities. Exposes a tool that supports severity thresholds, registry overrides, optional dev-dependency skipping, and text or JSON reports.
Enables AI coding agents to check package names and versions for allow/warn/deny verdicts, scan project lockfiles for known-malicious packages and critical advisories, and suggest safe versions across npm, PyPI, crates.io, and Go before manifests are edited.
Scores npm packages, PyPI packages and GitHub repositories 0-100 with an A-F grade and plain-language risks. Scans package.json, requirements.txt and lock files; no API key needed.
Enables coding agents to check npm packages, GitHub Action refs, and remote scripts before execution, returning deterministic ALLOW/DENY/REVIEW verdicts with evidence and a re-checkable manifest.