Your dependencies
deserve a health check
Scan. Score. Decide. One platform to audit every package you use.
Your biggest blind spot
From risk to remediation
- Map your entire dependency surface: direct and transitiveDeptools generates a full, interactive dependency graph with direct and transitive. Instantly spot high-risk nodes and hidden exposure across your entire stack.
- Detect and remediate vulnerabilities at scaleEvery dependency is checked against the latest security advisories. You get the severity, the scope across transitives, and clear remediation guidance not just a list.
- Eliminate update drift before it becomes a crisisTrack how outdated your dependencies are, identify multiple versions of the same library, detect version conflicts, and understand the real maintenance burden so your team focuses on features, not drift.
- Automated license compliance before legal flags itEvery license is categorized and checked for compatibility. Copyleft and commercial risks are flagged automatically and your SBOM is one click away.
Full-stack dependency intelligence
Eight specialized analyzers. One unified dashboard.
Patch what matters, ignore the noise
Every dependency continuously checked against the latest security advisories with severity, exposed scope and clear remediation paths.
Gate your deploy on dependency health
Trigger scans on every push using our GitHub Action or a simple HTTP call from any CI system. Automatically block builds when dependency health drops below your thresholds.
Quality gates
# .github/workflows/deptools.yml
name: Dependency scan
on:
push:
branches: [main]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: deptools-io/scan-action@v1
with:
project-id: ${{ vars.DEPTOOLS_PROJECT_ID }}
api-key: ${{ secrets.DEPTOOLS_API_KEY }}
wait-for-result: true # block until completed (default: false)
fail-on-cvss: HIGH # optional: CRITICAL | HIGH | MODERATE | LOW
min-score: 7 # optional: fail if score below this value (0–10)
fail-on-strong-copyleft: true # optional: fail if strong copyleft license detected
min-up-to-date: 80 # optional: fail if direct deps up-to-date % below this (0–100)Pricing
Start free. Scale as you grow. No hidden fees.
Get started with dependency analysis on public repositories.
- All features
- Up to 10 public projects
- 3-hour scan cooldown per project
Unlimited dependency analysis for open-source maintainers and organizations.
- Unlimited public projects
- Unlimited scans
- Community support
Advanced dependency analysis for private projects, teams, and companies.
- 5 private projects included, +$5/mo per extra
- Scan from any CI, no GitHub needed
- Unlimited public projects
- Unlimited scans
- Priority commercial support
Prices shown exclude applicable taxes.
Custom solutions for teams with specific security, compliance, or operational requirements.
- Personalized dependency audit
- Custom VCS & build integration
- Self-hosted deployment
- Custom contract & invoicing
Deptools started as
a research question.
How can we measure and assess the health of software dependency graphs?
Four years later, that question became a product.
Learn more about usFrequently asked questions
Get clarity before you commit.
Deptools reads your build files to reconstruct your full dependency graph, direct and transitive, then enriches every package with security metrics, version data, and ecosystem intelligence. Connect a GitHub repository and click Scan, or push your build files from any CI pipeline if your code lives elsewhere. Either way, you get actionable results in minutes.
Vulnerability scanners answer one question: does this package have a known CVE. Deptools scores your entire transitive graph across five dimensions plus licensing, backed by four years of peer-reviewed research, so you also see which dependencies are stale, abandoned, losing ecosystem adoption, or legally risky. And it is built to be audited: interactive graph exploration, CSV audit reports, and SBOM in CycloneDX or SPDX, rather than a flat list of alerts.
No. When you connect GitHub, Deptools reads only your build files (pom.xml, build.gradle, package.json, etc.) through the GitHub API. When you upload from your CI instead, the archive is filtered on arrival: only build files are kept, anything else is discarded during extraction, and the retained files are deleted as soon as the analysis completes. Either way, your source code is never stored on our servers, and scoring runs on package metadata and publicly available ecosystem data.
Vulnerability data comes from OSV (Open Source Vulnerabilities), which aggregates the National Vulnerability Database (NVD) and the ecosystem advisory feeds, including GitHub Security Advisories. Our mirror is refreshed every 24 hours. Ecosystem signals, such as new releases, dependent counts or GitHub stars, are refreshed weekly.
Deptools covers the JVM ecosystem (Java, Kotlin, Scala) through Maven Central and Google's Maven Repository, and the JavaScript ecosystem (Node.js, TypeScript) through npm. Analysis reads your build files: pom.xml, build.gradle, build.gradle.kts, build.sbt, and package.json alongside npm, yarn, or pnpm lockfiles. Python (PyPI) and PHP (Composer) are on the roadmap. Check the Integrations section for the latest status.
No. Connecting GitHub is the fastest path, but you can also push your build files from any CI pipeline, GitLab, Jenkins, Bitbucket, or anything that can run a shell script, using a per-project API key. Organizations can be created without linking GitHub at all. CI upload is available on the Pro plan.
Yes. Every project exposes a REST API with its own key, so any pipeline can trigger a scan and poll the result. On GitHub, our published Action does it in a few lines. You can also fail a build on your own thresholds: CVE severity, minimum health score, strong copyleft licenses, or minimum up-to-date ratio.
Each repository you scan becomes a project in Deptools. For multi-module repositories, you can create one project per module. Free plan: up to 10 public projects, with one scan per project every 3 hours. Open Source Max: no limits on public projects or scan frequency. Pro: adds private projects, 5 included with more available as add-ons. A private project is either a private GitHub repository or a project fed by CI upload.
Yes. Reach us at support@deptools.io, with prioritized response times on the Pro plan. For anything beyond the standard plans, a personalized dependency audit, a self-hosted deployment, custom VCS or build integration, or specific contracting terms, contact michael@deptools.io to discuss a Custom plan.