deptrust
A CLI tool that checks package versions for known vulnerabilities across npm, PyPI, and many other ecosystems, designed for AI agents to avoid using outdated packages.
deptrust
What is deptrust?
deptrust vs Similar AI Tools
| Pricing Model | Free | Free | Free | Free |
| Free Credits | ||||
| Key Features |
|
|
|
|
| Pros |
|
|
|
|
| Cons |
|
|
|
|
| Best For |
|
|
|
|
How to use deptrust?
- 1Install with npx @clidey/deptrust install. Run checks like 'deptrust check npm lodash 4.17.20' or 'deptrust check pypi requests latest'. For AI agent integration, configure MCP with 'deptrust mcp'. Use JSON output with '--json' flag.
deptrust Key Features
- Checks packages across 15+ ecosystems including npm, PyPI, Cargo, Go, RubyGems, NuGet, Maven, and more
- Reports known vulnerabilities with severity, recommendation, and risk score
- Suggests safe versions by checking provider-reported fixes and version history
- Compares two versions to show risk improvement
- Integrates as MCP server for AI agents (Codex, Claude Code)
- Runs entirely locally with no external service dependency
- Outputs JSON with advisory coverage details
deptrust Use Cases
- AI agents checking package versions before recommending updates
- Developers auditing project dependencies for vulnerabilities
- CI/CD pipelines enforcing package version policies
- Security teams reviewing dependency risk scores
deptrust Pricing & Free Credits
deptrust currently operates on a Free model.
This tool is completely free to use
deptrust Pros & Cons
Pros
- Supports a wide range of package ecosystems
- Runs locally with fast parallel queries to public APIs
- Integrates seamlessly with AI agents via MCP protocol
- Provides clear recommendations (allow/block/review) and risk scores
- Open source and no need for account or API keys
Cons
- Only checks known vulnerabilities, does not perform code analysis
- Requires MCP setup for AI agent integration, which may be complex
- Depends on OSV and GitHub Advisory Database coverage per ecosystem
- Some ecosystems have partial advisory coverage (e.g., CocoaPods, Hackage)
What is deptrust best for?
- AI developers building agentic workflows
- Developers who want to prevent vulnerable dependency picks
- DevSecOps teams needing a lightweight vulnerability checker
- Anyone using package managers in automated environments
deptrust FAQ
Top free alternatives to deptrust
A voice-controlled IDE that enables developers to initiate AI coding sessions with Codex or Claude Code, approve commands, and review diffs from their phone.
SureWire is a specialized QA platform that stress-tests AI agents for safety, reliability, and compliance using purpose-built testing agents.
Browser infrastructure platform for AI agents to run on the internet at speed with cloud browser sessions, agents, and serverless functions.
An agent-first file transfer tool that enables secure, encrypted file sharing between AI agents via MCP calls without human involvement.
Manifest converts any URL into a structured JSON map of what AI agents can interact with on a page—buttons, forms, inputs, and required fields.
A cooperative gate for shell commands that AI agents run, providing previews, backups, policy enforcement, and audit for tools like Claude Code and Cursor.
Agentcard provides agent-friendly card issuing and payment infrastructure for AI agents, enabling 5-minute setup and autonomous purchases.
Best alternatives AI Tools to deptrust
A collection of deliberately vulnerable MCP servers for training in agentic security, mapped to the OWASP Top 10 for Agentic Applications.
Open-source AI tool for deep infrastructure research, running frontier models across code, cloud, and runtime to deliver verified answers.
Magpie is an opinionated accounting CLI for humans and AI agents, providing double-entry bookkeeping with RBAC and immutable event storage on Jaybase.
Terminal UI to manage AI coding-agent sessions (Claude Code, OpenCode, Codex, Grok Build) in tmux with live status, group tree, and diff review.
A voice-controlled IDE that enables developers to initiate AI coding sessions with Codex or Claude Code, approve commands, and review diffs from their phone.
Zero-config, single-binary software catalog with auto-discovery, dependency visualization, compliance scorecards, and native MCP integration for AI agents.
Browser automation CLI for AI agents to bypass anti-bot walls, hand off to humans, and run parallel tasks.
An AI-powered shopper assistant that provides a live cursor to guide website visitors, point out products, and display price calculations.