Deptrust: Package Vulnerability Checker

Anyone who has watched an AI coding assistant casually run npm install on a package last updated in 2019 knows the specific dread deptrust is trying to fix. The tool, from developer shop Clidey, is a command-line utility and MCP server that queries public vulnerability databases directly before an agent — or a human — commits to a version. No hosted backend, no account, no middleman service to trust. It just calls OSV and the GitHub Advisory Database in parallel and hands back a verdict.

The ecosystem coverage is the real headline here. Deptrust doesn't just handle npm and PyPI, the usual suspects; it reaches into crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, and even GitHub Actions references by tag, branch, or commit SHA. Run a check and you get a risk score, a plain-English recommendation of block, review, or allow, and a note on which advisory providers were actually consulted versus skipped because that ecosystem lacks support. Ask it about lodash 4.17.20, for instance, and it'll flag two known vulnerabilities, including a high-severity command injection bug, and tell you to block it outright.

What's more interesting than the vulnerability lookup itself is the philosophy baked into an "allow" result: it explicitly does not mean the package is safe, only that nothing bad turned up in the sources checked. Packages published in the last 72 hours get flagged for review automatically, on the theory that brand-new releases haven't had time to accumulate scrutiny, malicious or otherwise. If a provider simply doesn't cover an ecosystem, like CocoaPods missing OSV support or Hackage missing GitHub Advisory data, deptrust reports