Deptrust: Package Vulnerability Checker
The Neuron
Deptrust is a CLI tool that checks package versions across 13 major package ecosystems (npm, PyPI, Cargo, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, and GitHub Actions) for known vulnerabilities by querying public registries and OSV APIs directly. The tool queries multiple vulnerability providers in parallel, including OSV and GitHub Advisory Database, and returns a recommendation ranging from "block" for critical vulnerabilities to "allow" when no known issues are found. Deptrust integrates with AI agents like Codex and Claude Code via MCP servers or CLI skills to automatically prevent agents from installing vulnerable package versions before they execute install or update commands.
Why it matters
Deptrust checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, and GitHub Actions.
