codesecurity / dependency audit

Dependency Audit

dependency_audit

Checks third-party packages for known CVEs and outdated versions using the OSV vulnerability database. Supports Python (requirements.txt, pyproject.toml, Pipfile), JavaScript (package.json), Go (go.mod), Java (pom.xml, build.gradle), and C++ (conanfile, vcpkg.json). No API key required. Use when: user asks about vulnerable packages, CVEs, supply chain risk, or outdated dependencies. Scope: local project directory — reads dependency files on disk. Not for: secrets leaked in source code (use repo_scanner), code quality issues (use python_lint_checker), or GitHub Dependabot alerts from a remote repo (use dependabot_alerts).

How to use dependency_audit

Provide only the required inputs below. Start with the smallest scope that answers the task, then review the risk properties before an agent executes the call.

Risk and execution properties

Read only: yes

Destructive: no

Idempotent: yes

Open world: yes — can reach external systems

Inputs

pathstringrequired

Absolute or relative path to the project directory to scan. Example: '/Users/me/my-project'

Example input

{
  "path": "<string>"
}

Browse or search the full 74-tool reference to choose the smallest suitable capability.

Browse all tools →