Check any GitHub repo for vulnerable dependencies

30 lockfile formats and 7 manifest formats, in 14 ecosystems. Every folder counts, monorepos and workspaces included. Where a project has no lockfile, it reads the exact versions its manifests pin. A lockfile it cannot check, like a CocoaPods or Conan one, is named on the repo's page, never silently skipped.

JavaScript, TypeScriptnpm

package-lock.jsonnpm-shrinkwrap.jsonpnpm-lock.yamlyarn.lockbun.lockdeno.lockpackage.json

PythonPyPI

uv.lockpoetry.lockPipfile.lockpdm.lockpylock.tomlrequirements.txtrequirements.lockpixi.lockconda-lock.ymlpyproject.toml

Rustcrates.io

Cargo.lockCargo.toml

GoGo modules

go.mod

Java, KotlinMaven

gradle.lockfilemaven_install.jsonpom.xmllibs.versions.toml

.NETNuGet

packages.lock.jsonpackages.configpaket.lock.csproj.fsproj.vbprojDirectory.Packages.props

RubyRubyGems

Gemfile.lockgems.locked

PHPPackagist

composer.lock

Dart, FlutterPub

pubspec.lock

SwiftSwiftPM

Package.resolved

Elixir, ErlangHex

mix.lockrebar.lock

HaskellHackage

cabal.project.freeze

RCRAN

renv.lock

JuliaJulia

Manifest.toml

Dashed: manifests, read only where no lockfile covers them.

1. 1

   It reads the lockfiles at the latest commit

   Every lockfile in every folder, read from GitHub at the exact commit: each package at the version it pins, and whether only dev tools use it. Your source code is never read.

2. 2

   It checks each version against every known flaw

   Each version is looked up in OSV, which gathers the public advisory databases (GitHub's, PyPI's, RustSec, Go's and more), and in CISA's list of flaws attackers already use.

3. 3

   It says what to update first

   What touches your users comes first, the gravest at the top: the package to update, often the direct dependency that brings the flaw in, and the version that fixes it. Tests, examples, docs and dev tools are listed apart and never counted.

4. 4

   It says what a flaw can do, not that it does

   It does not check whether your code calls the vulnerable part of a package. A flaw on the page is a version to update, not proof that the project is open to attack.

5. 5

   It stays current

   A new commit is read on the next visit. A new advisory reaches every repo it touches within minutes of OSV publishing it.

Every repo's page gives you a badge that shows its answer and changes with it. Put your repo in place of owner/repo:

The same answer as JSON, with no key, at /v1/repos/owner/repo. Or as the MCP tool check_repo, at https://istheinternetok.com/mcp. Everything an agent needs to know is in /skill.md.