# Dependency Audit — CVE, License & EOL Check for AI (`haketa/dependency-audit`) Actor

Audit any software dependency for vulnerabilities (CVE), license, deprecation, end-of-life and health scores in one call. Supports npm, PyPI, crates, Go, Maven, NuGet, RubyGems. Supply-chain security grounding for AI coding agents & SCA.

- **URL**: https://apify.com/haketa/dependency-audit.md
- **Developed by:** [Haketa](https://apify.com/haketa) (community)
- **Categories:** Developer tools, AI, Agents
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.40 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Dependency Audit — CVE, License, Deprecation & EOL for AI Agents

Audit any software dependency in one call. Give this Actor a list of packages and it returns, for each one: **known vulnerabilities (CVE) with severity, license, whether it's outdated or deprecated, end-of-life status, an OpenSSF health score, GitHub stars** — plus a clean **Markdown audit report**.

Supports **npm, PyPI, crates.io, Go, Maven, NuGet and RubyGems**. Built for **AI coding agents, supply-chain security (SCA), and dependency review**. No API key, no setup.

***

### Why this Actor?

Coding agents and developers constantly need to answer: *"Is this package safe to add? Is my version vulnerable? Is it still maintained?"* That data is scattered across vulnerability databases, package registries, scorecards and end-of-life trackers — and an LLM's training data is months out of date on all of it. New CVEs land daily.

This Actor consolidates it. Point it at a package (or a whole lockfile's worth) and get back a single, current, structured verdict — the exact grounding an AI agent needs before it recommends or upgrades a dependency.

- **AI coding agents** — a tool the agent calls on every "add/upgrade this package" decision to check for CVEs, license and maintenance.
- **Supply-chain security (SCA)** — screen a dependency list for known vulnerabilities and risky licenses.
- **Dependency review in CI** — audit what a PR adds or bumps.
- **Tech-debt & maintenance** — find deprecated, outdated or end-of-life dependencies across a project.

Because it merges several sources, one call gives you what would otherwise take five.

***

### What you get

For every package, one record:

| Field | Description |
| --- | --- |
| `package` | `ecosystem:name@version` |
| `ecosystem`, `name`, `version` | Identity |
| `latestVersion` | Latest available version |
| `isOutdated` | Whether a newer version exists |
| `isDeprecated` | Whether the package/version is deprecated |
| `license` | License(s) |
| `riskLevel` | `none` / `low` / `medium` / `high` / `critical` |
| `vulnerabilityCount` | Number of known vulnerabilities |
| `maxSeverity` | Highest severity found |
| `vulnerabilities` | Full list: CVE, severity, title, link |
| `scorecardScore` | OpenSSF Scorecard (0–10) |
| `stars` | GitHub stars |
| `repo` | Source repository |
| `eolStatus` | End-of-life status (for known runtimes/frameworks) |
| `downloads` | Monthly downloads (optional, npm/PyPI) |
| `markdown` | A ready-to-read audit report |
| `scrapedAt` | Timestamp |

***

### Example output

```json
{
  "package": "npm:lodash@4.17.15",
  "ecosystem": "npm",
  "name": "lodash",
  "version": "4.17.15",
  "latestVersion": "4.17.21",
  "isOutdated": "true",
  "isDeprecated": "false",
  "license": "MIT",
  "riskLevel": "high",
  "vulnerabilityCount": "6",
  "maxSeverity": "HIGH",
  "vulnerabilities": [
    { "cve": "CVE-2021-23337", "severity": "HIGH", "title": "Command Injection in lodash", "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm" }
  ],
  "scorecardScore": "7.7",
  "stars": "61240",
  "markdown": "# lodash@4.17.15 (npm)\n\n**License:** MIT · **Latest:** 4.17.21 ⚠️ outdated · ...",
  "scrapedAt": "2026-07-06T15:00:00.000Z"
}
```

A clean, current package returns `riskLevel: "none"`, `vulnerabilityCount: "0"`.

***

### Input

| Field | Type | Default | Description |
| --- | --- | --- | --- |
| `packages` | array | — | **Required.** Packages to audit. |
| `ecosystem` | string | `npm` | Default ecosystem for packages without a prefix. |
| `includeScorecard` | boolean | `true` | Fetch OpenSSF Scorecard + GitHub stars. |
| `includeDownloads` | boolean | `false` | Fetch monthly downloads (npm/PyPI). |

#### Package format

Each entry can be:

- `"express"` — latest version, default ecosystem
- `"express@4.18.2"` — a specific version
- `"pypi:django@3.0.0"` — an explicit ecosystem
- `"@babel/core@7.0.0"` — scoped npm packages work too

Ecosystems: `npm`, `pypi`, `cargo`, `go`, `maven`, `nuget`, `rubygems` (aliases like `pip`, `crates`, `gem` are accepted).

#### Example input

```json
{
  "packages": [
    "express@4.18.2",
    "lodash@4.17.15",
    "pypi:django@3.0.0",
    "cargo:tokio@1.0.0",
    "react"
  ],
  "includeScorecard": true
}
```

***

### Risk levels

`riskLevel` reflects the most severe issue found:

- **critical / high / medium / low** — driven by the highest-severity known vulnerability (by CVSS).
- **low** — also used when there are no CVEs but the package is deprecated or end-of-life.
- **none** — no known vulnerabilities, not deprecated, not EOL.

Always read `vulnerabilities`, `isDeprecated` and `eolStatus` together for the full picture.

***

### Use cases in detail

#### 1. AI coding agents

Wire this in as a tool so your agent checks a package before recommending it: "should I use `axios@0.21`?" → the agent sees the CVE and suggests a safe version instead. Every `import`/`require` suggestion can be grounded in current data.

#### 2. Supply-chain security / SCA

Feed a whole dependency list in one run and triage by `riskLevel`. Route `high`/`critical` to a human or block the build.

#### 3. CI dependency review

On each PR, audit the added or upgraded packages and comment the vulnerabilities, license changes and deprecations back on the PR.

#### 4. Tech-debt sweeps

List every dependency in a project and find the deprecated, end-of-life or badly-outdated ones to prioritise upgrades.

#### 5. License compliance

The `license` field lets you flag copyleft or non-standard licenses across your dependency tree.

***

### How to use it

1. Click **Try for free**.
2. Paste your packages into `packages`.
3. Click **Start**.
4. Read the results as **JSON, CSV, Excel**, or via the Apify API.

Audits run in parallel — a hundred packages finish in seconds.

***

### Calling from the API

```bash
curl -X POST "https://api.apify.com/v2/acts/YOUR_ACTOR_ID/runs?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "packages": ["express@4.18.2", "lodash@4.17.15", "pypi:django@3.0.0"] }'
```

Then fetch the dataset:

```bash
curl "https://api.apify.com/v2/acts/YOUR_ACTOR_ID/runs/last/dataset/items?token=YOUR_APIFY_TOKEN"
```

Works with webhooks, Zapier, Make and n8n — wire it straight into CI or an agent workflow.

***

### Frequently asked questions

**Which ecosystems are supported?**
npm, PyPI, crates.io, Go, Maven, NuGet and RubyGems.

**Where do the vulnerabilities come from?**
Public vulnerability and package databases are merged so each package gets CVEs, license, deprecation, scorecard and EOL in one record. Data is fetched live, so it reflects newly-published advisories.

**What if I don't specify a version?**
The Actor audits the latest version and tells you what it is.

**Does it handle scoped npm packages?**
Yes — `@babel/core@7.0.0` works.

**What is the health score?**
The OpenSSF Scorecard (0–10), a widely-used measure of a project's security practices, plus GitHub stars for popularity.

**Is EOL available for every package?**
End-of-life is reported for well-known runtimes and frameworks (Node, Python, Django, Rails, React, …). For other packages the field is empty.

**Can an AI agent call this automatically?**
Yes — it's keyless and returns structured JSON, ideal as an agent/MCP tool.

***

### Tips

- **Audit whole lockfiles.** Paste every dependency at once — it's far faster than one-by-one and gives you a single risk view.
- **Pin the version you actually ship.** Auditing `name@version` is precise; auditing just `name` checks the latest.
- **Use `riskLevel` to gate.** Sort or filter by it to surface the packages that need action first.
- **Keep the CVE links.** Each vulnerability has a URL for the full advisory.

***

### Notes

This Actor aggregates publicly available security and package metadata for informational and tooling purposes. Vulnerability data can lag real-world disclosure, and absence of a known CVE is not a guarantee of safety. Treat results as one input to your security process, not a substitute for a full security review. Verify critical findings against the official advisory.

***

### Support

Want another ecosystem, deeper vulnerability detail, or an extra field? Open an issue from the Actor's page. Ship secure.

# Actor input Schema

## `packages` (type: `array`):

Type the dependencies you want to check, one per line. Use "name", "name@version", or "ecosystem:name@version" (version is optional and defaults to the latest release). Leave this empty to get an instant sample audit across popular packages.

## `ecosystem` (type: `string`):

Package registry to assume for any entry above that does not specify one (for example a plain "lodash").

## `includeScorecard` (type: `boolean`):

Add each package's OpenSSF Scorecard health rating and GitHub star count so you can judge project maintenance at a glance.

## `includeDownloads` (type: `boolean`):

Add monthly download counts to gauge popularity (available for npm and PyPI packages).

## `maxPackages` (type: `integer`):

Upper limit on how many packages to audit in one run. Set to 0 for no limit.

## `proxyConfiguration` (type: `object`):

Apify Proxy settings. The data sources are public, so a proxy is not required by default.

## Actor input object example

```json
{
  "packages": [
    "express@4.18.2",
    "lodash@4.17.15",
    "pypi:django@3.0.0"
  ],
  "ecosystem": "npm",
  "includeScorecard": true,
  "includeDownloads": false,
  "maxPackages": 100,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `dataset` (type: `string`):

Open to view, filter and export all scraped results from this run (JSON, CSV, Excel).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "express@4.18.2",
        "lodash@4.17.15",
        "pypi:django@3.0.0"
    ],
    "maxPackages": 100
};

// Run the Actor and wait for it to finish
const run = await client.actor("haketa/dependency-audit").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "packages": [
        "express@4.18.2",
        "lodash@4.17.15",
        "pypi:django@3.0.0",
    ],
    "maxPackages": 100,
}

# Run the Actor and wait for it to finish
run = client.actor("haketa/dependency-audit").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "express@4.18.2",
    "lodash@4.17.15",
    "pypi:django@3.0.0"
  ],
  "maxPackages": 100
}' |
apify call haketa/dependency-audit --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=haketa/dependency-audit",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/i2fIRsS1B40WY6YlH/builds/3KT4g6orixsnVErSZ/openapi.json