deptrust
A CLI tool that checks package versions for known vulnerabilities across npm, PyPI, and many other ecosystems, designed for AI agents to avoid using outdated packages.
deptrust
What is deptrust?
deptrust vs Similar AI Tools
| Pricing Model | Free | Free | Custom Pricing | Free, Paid |
| Free Credits | ||||
| Key Features |
|
|
|
|
| Pros |
|
|
|
|
| Cons |
|
|
|
|
| Best For |
|
|
|
|
How to use deptrust?
- 1Install with npx @clidey/deptrust install. Run checks like 'deptrust check npm lodash 4.17.20' or 'deptrust check pypi requests latest'. For AI agent integration, configure MCP with 'deptrust mcp'. Use JSON output with '--json' flag.
deptrust Key Features
- Checks packages across 15+ ecosystems including npm, PyPI, Cargo, Go, RubyGems, NuGet, Maven, and more
- Reports known vulnerabilities with severity, recommendation, and risk score
- Suggests safe versions by checking provider-reported fixes and version history
- Compares two versions to show risk improvement
- Integrates as MCP server for AI agents (Codex, Claude Code)
- Runs entirely locally with no external service dependency
- Outputs JSON with advisory coverage details
deptrust Use Cases
- AI agents checking package versions before recommending updates
- Developers auditing project dependencies for vulnerabilities
- CI/CD pipelines enforcing package version policies
- Security teams reviewing dependency risk scores
deptrust Pricing & Free Credits
deptrust currently operates on a Free model.
This tool is completely free to use
deptrust Pros & Cons
Pros
- Supports a wide range of package ecosystems
- Runs locally with fast parallel queries to public APIs
- Integrates seamlessly with AI agents via MCP protocol
- Provides clear recommendations (allow/block/review) and risk scores
- Open source and no need for account or API keys
Cons
- Only checks known vulnerabilities, does not perform code analysis
- Requires MCP setup for AI agent integration, which may be complex
- Depends on OSV and GitHub Advisory Database coverage per ecosystem
- Some ecosystems have partial advisory coverage (e.g., CocoaPods, Hackage)
What is deptrust best for?
- AI developers building agentic workflows
- Developers who want to prevent vulnerable dependency picks
- DevSecOps teams needing a lightweight vulnerability checker
- Anyone using package managers in automated environments
deptrust FAQ
Top free alternatives to deptrust
A cooperative gate for shell commands that AI agents run, providing previews, backups, policy enforcement, and audit for tools like Claude Code and Cursor.
Agentcard provides agent-friendly card issuing and payment infrastructure for AI agents, enabling 5-minute setup and autonomous purchases.
Oodle AI provides agent observability with fast trace search, S3-based storage, and out-of-the-box insights to detect silent failures in AI agents.
Jacquard is a small programming language designed for running, reviewing, and trusting programs written by machine-learning models and reviewed by people.
Autonomous security testing platform that finds and fixes access control vulnerabilities in live AI-built apps.
AI-powered social listening tool that monitors Reddit, X, LinkedIn, and 10+ other platforms, filters mentions with AI, and delivers them to your stack via API, Slack, or webhooks.
A unified AI gateway providing access to 300+ leading models through one EU-hosted, GDPR-compliant API with an OpenAI SDK-compatible interface.
Best alternatives AI Tools to deptrust
DeepSQL is an AI DBA that monitors workloads, optimizes slow queries, and cuts database costs via a self-hosted agent with MCP and Slack integration.
Open-source platform for real-time AI agent security, auditing skills and runtime with community-driven threat rules.
OpenSEO is an open source SEO platform that integrates with AI agents via MCP to provide real SEO data for keyword research, competitor analysis, backlinks, and more.
SureWire Beta is an AI agent validation platform that helps ensure your AI agents are safe and reliable through comprehensive testing.
A deadline-aware LLM router that reduces AI inference costs by automatically finding cheaper service tiers within a user-specified time window.
Run multiple AI coding agents in parallel on isolated git worktrees with a full editor and built-in developer tools.
An open-source cost controller for AI agent loops that stops loops when converged and rolls back before degradation.