Tools Reference

📄 Prefer offline? Download this guide as a PDF.

DepCheck exposes five tools. All are read-only — they look data up and return it; none mutate your project, your manifests, or any server-side state.

Tool	One-liner
check_package	Is this one version of a package vulnerable?
scan_dependencies	Which packages in this whole manifest are vulnerable?
suggest_safe_version	What is the newest version with zero known advisories?
get_advisory	Full detail (CVSS, ranges, refs) for one advisory ID.
get_cve_intel	Is this CVE exploited in the wild (KEV / EPSS)?

The response examples below are illustrative — real output reflects live advisory data at the moment of the call.

---

check_package

Check one package version against the advisory databases. This is the tool to call before adding or pinning a dependency.

Parameters

Name	Required	Description
ecosystem	✅	npm, Go, PyPI, crates.io, Maven, RubyGems, Packagist, NuGet, Hex, Pub. Aliases python, rust, java are accepted.
name	✅	Exact published name — lodash, @scope/pkg, github.com/gin-gonic/gin, org.apache.logging.log4j:log4j-core.
version	✅	Concrete version (4.17.20, v1.9.0). Range operators (^, ~, >=) are reduced to their lower bound.

Example

{ "ecosystem": "npm", "name": "lodash", "version": "4.17.20" }

Returns — the advisories affecting exactly that version, plus the minimum safe version to move to. When exploitation intel is available, advisories on the CISA KEV list or with a high EPSS score are flagged exploited and sorted first.

{
  "package": "[email protected] (npm)",
  "vulnerable": true,
  "advisories": [
    {
      "id": "GHSA-29mw-wpgm-hmr9",
      "aliases": ["CVE-2021-23337"],
      "summary": "Command injection in lodash",
      "severity": "High",
      "exploited": false,
      "fixed": "4.17.21"
    }
  ],
  "min_safe_version": "4.17.21"
}

---

scan_dependencies

Scan an entire manifest in one call. Use it when reviewing a service, after adding several dependencies, or to answer "are our deps safe?". Only the vulnerable packages come back (each with an upgrade target); clean packages are just counted.

Parameters (hosted endpoint)

The hosted server has no access to your filesystem, so your agent reads the file and passes its text:

Name	Required	Description
manifest_content	✅	The full text of the manifest file.
manifest_name	✅	The file name, which selects the parser: go.mod, package.json, package-lock.json, requirements.txt, pyproject.toml, Cargo.toml, Cargo.lock, pom.xml, composer.json.

Scan the lockfile for installed truth

A manifest with ranges (^4.17.0) is checked at the lower bound. To catch what is actually resolved, scan the lockfile (package-lock.json, Cargo.lock, poetry.lock-style pyproject, …) instead of, or in addition to, the manifest.

Local stdio mode

When you run DepCheck locally, scan_dependencies also accepts a manifest_path (a filesystem path) as an alternative to manifest_content + manifest_name.

Returns

{
  "manifest": "package.json",
  "total_dependencies": 42,
  "clean": 39,
  "vulnerable": [
    {
      "name": "minimist",
      "current": "1.2.5",
      "advisories": ["GHSA-xvch-5gv4-984h"],
      "highest_severity": "Critical",
      "exploited": true,
      "upgrade_to": "1.2.8"
    }
  ]
}

Fix the exploited: true findings first — those are being actively attacked. Upgrade each vulnerable package to its upgrade_to version.

---

suggest_safe_version

Get the newest version of a package that has zero known advisories. Use it to choose which version to add, or to pick the upgrade target for a vulnerable dependency — never hand-pick a version that might carry its own advisories.

Parameters

Name	Required	Description
ecosystem	✅	Same values as check_package.
name	✅	Exact published package name.
include_prerelease	➖	Also consider alpha/beta/rc releases. Default false.

Supported ecosystems for this tool: npm, Go, PyPI, crates.io, Maven, RubyGems, NuGet. It probes the latest releases (via deps.dev) against OSV until it finds a clean one.

Returns

{
  "package": "express (npm)",
  "safe_version": "4.21.2",
  "checked_latest_first": true
}

---

get_advisory

Full detail for one advisory ID returned by the other tools — GHSA-…, CVE-…, RUSTSEC-…, GO-…, or PYSEC-…. Use it to decide whether a reported vulnerability actually matters for how your code uses the package.

Parameters

Name	Required	Description
id	✅	Advisory ID, e.g. GHSA-29mw-wpgm-hmr9 or CVE-2021-23337.

Returns — description, CVSS vector and score, affected version ranges, and reference links.

{
  "id": "GHSA-29mw-wpgm-hmr9",
  "aliases": ["CVE-2021-23337"],
  "summary": "Command injection in lodash",
  "details": "lodash versions prior to 4.17.21 are vulnerable to command injection via template.",
  "cvss": { "score": 7.2, "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" },
  "affected": [{ "introduced": "0", "fixed": "4.17.21" }],
  "references": ["https://github.com/lodash/lodash/commit/..."]
}

---

get_cve_intel

Exploitation intelligence for a CVE, from the Cert-IX threat data: CISA KEV (known exploited in the wild) status, EPSS exploitation-probability score/percentile, and NVD CVSS + CWE. Use it to prioritise — a KEV-listed or high-EPSS CVE is under active attack and should jump the queue over a higher-CVSS-but-unexploited one.

Accepts a CVE ID, or a GHSA/GO/RUSTSEC advisory ID (its CVE aliases are resolved automatically).

Parameters

Name	Required	Description
id	✅	CVE ID (CVE-2021-44228) or an advisory ID (GHSA-jfh8-c2jp-5v3q).

Returns

{
  "cve": "CVE-2021-44228",
  "kev": { "listed": true, "date_added": "2021-12-10" },
  "epss": { "score": 0.975, "percentile": 0.99997 },
  "cvss": 10.0,
  "cwe": ["CWE-502", "CWE-917"]
}

Availability

get_cve_intel is enabled when DepCheck is backed by the Cert-IX Elasticsearch mirror (KEV/EPSS indices) — which the hosted mcp.cert-ix.com/depcheck endpoint is. A fully offline local instance without the mirror exposes the other four tools.

---

Prioritisation, in one rule

When several things are vulnerable, DepCheck's ordering encodes the priority:

1. exploited / KEV-listed / high EPSS — actively attacked. Fix first, even over a higher raw CVSS.
2. Critical / High severity — fix next.
3. Medium / Low — schedule.

Then move each package to the upgrade_to / min_safe_version / safe_version the tools give you. See Agent workflows for how to wire this into an agent's editing loop.