Dependency Checker

Dependency Checker

Overview

Dependency Checker offers a comprehensive solution for performing repository dependency audits through its check-dependencies Agent Skill. This tool is equipped with powerful MCP tools and a depcheck CLI, which utilize a scanning mechanism to gather essential data such as declarations, locked versions, and source usage. The tool enables users to inspect packages, understand their impact, and preview supported updates based on empirical evidence.

Key Features

• Data Parsing: The repository files are parsed into actionable data, ensuring efficient dependency analysis without importing project code or executing package managers.
• Enhanced Reporting: Reports highlight missing, unused, unpinned, conflicting, and scope-mismatched dependencies, contingent on the evidence collected.
• Compatibility Queries: Facilitates exact-version OSV queries for qualified PyPI, npm, and crates.io records, while supporting advisory queries for other ecosystems.
• Output Formats: Outputs are available in various formats including text, JSON, SARIF 2.1.0, and CycloneDX 1.7, catering to different reporting preferences and requirements.
• Dependency Maintenance Workflow: Leverage static evidence for informed decision-making in updates and maintain a structured workflow for dependency maintenance operations.

Ecosystem Coverage

Dependency Checker supports a variety of ecosystems, allowing for flexible integration with numerous project setups:

• Python / PyPI: Supports pyproject.toml, requirements files, and more.
• JavaScript / npm: Works with package.json, npm locks, and other JS-specific configurations.
• Go modules: Handles minimum requirements, exclusions, and checks against direct imports.
• Java/Kotlin / Maven/Gradle: Analyzes POM properties and Gradle configurations effectively.
• C/C++ / Conan or vcpkg: Integrates with supported manifest files and installation hints.
• Rust / Cargo: Supports Cargo.toml and its associated inventory attestations.
• Bazel / Bzlmod: Parses top-level bazel_dep calls and other configuration particulars.

Example Usage

To initiate a scan for dependencies in a given directory, the following command can be utilized:

depcheck scan . --offline --format json

This command scans the current directory and generates a JSON report, illustrating the dependencies in use. Furthermore, users can leverage other commands for specific needs, such as:

depcheck scan . --security --compatibility --python-version 3.12

This command performs a detailed scan including security and compatibility analysis.

Getting Started

To use the Dependency Checker, download the latest Agent Skill bundle from the GitHub Releases, ensuring to verify against SHA-256 checksums provided. A Python 3.11 environment is necessary, and the installation can be initiated via the following commands:

python -m venv .venv
.venv/bin/python -m pip install -e .
.venv/bin/depcheck --version

Conclusion

Dependency Checker is a robust and essential tool for maintaining healthy dependency management within projects. It provides thorough insights into package usages and advisories, ensuring that developers can make informed decisions for their projects. For further exploration, refer to the detailed documentation available in the repository.