Your dependencies
deserve a health check
Scan. Score. Decide. One platform to audit every package you use.
Your biggest blind spot
From risk to remediation
- Map your entire dependency surface: direct and transitiveDeptools generates a full, interactive dependency graph with direct and transitive. Instantly spot high-risk nodes and hidden exposure across your entire stack.
- Detect and remediate vulnerabilities at scaleEvery dependency is checked against the latest security advisories. You get the severity, the scope across transitives, and clear remediation guidance not just a list.
- Eliminate update drift before it becomes a crisisTrack how outdated your dependencies are, detect version conflicts, and understand the real maintenance burden so your team focuses on features, not drift.
- Automated license compliance before legal flags itEvery license is categorized and checked for compatibility. Copyleft and commercial risks are flagged automatically and your SBOM is one click away.
Full-stack dependency intelligence
Eight specialized analyzers. One unified dashboard.
Patch what matters, ignore the noise
Every dependency continuously checked against the latest security advisories with severity, exposed scope and clear remediation paths.
Gate your deploy on dependency health
Trigger scans on every push using the GitHub Actions or a simple HTTP call from any CI system. Automatically block builds when dependency health drops below your thresholds.
Quality gates
# .github/workflows/deptools.yml
name: Dependency scan
on:
push:
branches: [main]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: deptools-io/scan-action@v1
with:
project-id: ${{ vars.DEPTOOLS_PROJECT_ID }}
api-key: ${{ secrets.DEPTOOLS_API_KEY }}
wait-for-result: true # block until completed (default: false)
fail-on-cvss: HIGH # optional: CRITICAL | HIGH | MODERATE | LOW
min-score: 7 # optional: fail if score below this value (0–10)
fail-on-strong-copyleft: true # optional: fail if strong copyleft license detected
min-up-to-date: 80 # optional: fail if direct deps up-to-date % below this (0–100)Pricing
Start free. Scale as you grow. No hidden fees.
Get started with dependency analysis on public repositories.
- All features
- Up to 10 public projects
- 3-hour scan cooldown per project
Unlimited dependency analysis for open-source maintainers and organizations.
- Unlimited public projects
- Unlimited scans
- Community support
Advanced dependency analysis for private repositories, teams, and companies.
- 5 private repositories included, +$5/mo per extra
- Unlimited public projects
- Unlimited scans
- Priority commercial support
Prices shown exclude applicable taxes.
Custom solutions for teams with specific security, compliance, or operational requirements.
- Personalized dependency audit
- Custom VCS & build integration
- Self-hosted deployment
- Custom contract & invoicing
Deptools started as
a research question.
How can we measure and assess the health of software dependency graphs?
Four years later, that question became a product.
Learn more about usFrequently asked questions
Get clarity before you commit.
Deptools connects to your GitHub repositories and scans your manifest files (pom.xml, build.gradle, etc.) to build a complete dependency graph enriched with security metrics, version data, and ecosystem intelligence. Connect your account, click Scan, and get actionable results in minutes.
No. Deptools only reads your dependency manifest files (e.g. pom.xml, build.gradle) via the GitHub API. Your actual source code is never transmitted or stored on our servers. All analysis is performed on metadata and publicly available package information.
CVE data is refreshed continuously from the National Vulnerability Database (NVD) and multiple security advisory feeds. Ecosystem signals, such as new releases, dependent counts or GitHub stars are refreshed weekly.
Deptools currently supports Maven Central and Google's Maven Repository, covering Java, Kotlin, and Android projects. Analysis requires manifest files (pom.xml, build.gradle, etc.). Support for npm (Node.js / JavaScript / TypeScript) and PyPI (Python) is on the roadmap. Check the Integrations section for the latest status.
Yes. Reach us at support@deptools.io. Response time is prioritized based on your plan. Pro users receive faster, dedicated support.
Each repository you scan becomes a project in Deptools. For multi-module repositories, you can create one project per module. Free plan: up to 10 public projects, with one scan per project every 3 hours. Open Source Max: no limits on public projects or scan frequency. Pro: adds support for private repositories.