Fetch the SPDX licence identifier for an open source package version to verify licence compatibility before adding a dependency. Supports PyPI, npm, Maven, Go, Cargo, NuGet, and RubyGems.
Get the full dependency tree for a package version, including transitive dependencies, to assess supply chain exposure. Lists direct and transitive deps with version constraints.
Retrieve public details about a software package, including its description, latest version, license, repository links, homepage, and malicious status. Supported types: PyPI, npm, Maven, Golang, NuGet, Huggingface, RubyGems.
Builds a depth-bounded transitive caller/callee graph for a method symbol, with cycle detection. Returns adjacency lists for callers, callees, or both, marking external dependencies as leaves.
Determine which exceptions can escape a method by tracing throw sites through call chains and try/catch handlers, reporting escape paths and catch locations.
Find Docker images and packages hosted on GitHub for specific users or organizations. Use this tool to discover available packages when you know the owner but need to locate their hosted resources.
Retrieve specific sections of FOSSA organization settings, including project defaults, registry configurations, notifications, privacy, and authentication. Request only needed sections to reduce API requests.
Search and inspect software packages across seven ecosystems to retrieve version history, licenses, security advisories, dependency graphs, OpenSSF Scorecards, and SLSA provenance data.
Check any software package for known CVEs and security advisories by querying the OSV database, with support for version-specific and ecosystem-aware searches.
Find every call site to obsolete symbols, grouped by deprecation message and severity, to prioritize migration. Includes source and NuGet deprecations; errors appear first.