codesecurity / dependabot alerts

Dependabot Alerts

dependabot_alerts

Retrieves Dependabot vulnerability alerts for a GitHub repository. Shows CVE IDs, severity, affected package, and available fix versions. Requires GitHub connector with a token that has 'security_events' or 'repo' scope. Use when: user asks about Dependabot alerts, GitHub security tab findings, vulnerable dependencies in a remote GitHub repo. Scope: remote GitHub API only — requires GITHUB_TOKEN. Not for local project scanning. Not for: scanning a local project for vulnerable deps (use dependency_audit), local secret scanning (use repo_scanner), or GitHub code scanning SARIF findings (use code_scanning_alerts).

How to use dependabot_alerts

Provide only the required inputs below. Start with the smallest scope that answers the task, then review the risk properties before an agent executes the call.

Risk and execution properties

Read only: yes

Destructive: no

Idempotent: yes

Open world: yes — can reach external systems

Inputs

repostringrequired

GitHub repo in 'owner/repo' format. Example: 'myorg/myrepo'

statestring

Filter by alert state. Default: 'open'.

Allowed: "open""dismissed""fixed""auto_dismissed"

Default: "open"

severitystring

Filter by minimum severity level. Optional — omit to return all severities.

Allowed: "critical""high""medium""low"

Example input

{
  "repo": "<string>",
  "state": "open",
  "severity": "critical"
}

Browse or search the full 74-tool reference to choose the smallest suitable capability.

Browse all tools →