agent-dependency-auditor

A dependency audit scans lockfiles and registry metadata to identify CVEs, license issues, and maintenance signals across direct and transitive packages. It outputs a structured findings report with severity classifications and recommended remediation steps.

Supply-chain risk auditing is the process of triaging lockfiles and registry metadata to identify vulnerabilities, license issues, and maintenance signals across direct and transitive dependencies. It prevents risky deployments by informing upgrade decisions and governance reviews without inspecting application code.

Yes, multi-ecosystem projects are supported. The auditor scans lockfiles and registry metadata to surface vulnerabilities, license risks, and maintenance signals for both direct and transitive dependencies across different ecosystems simultaneously.

No, the audit is read-only and does not inspect application code. It solely scans lockfiles and registry metadata to produce a findings report, ensuring application source code remains untouched while informing upgrade decisions.

The best way to generate a remediation report for risky packages is to run an audit on your project root. This surfaces affected packages with severity classifications and provides recommended remediation steps for engineers and governance reviews.

Lockfile scanning should not be your only governance step when you need deep application code analysis or runtime behavior monitoring. This audit strictly covers registry metadata and lockfiles, producing findings for upgrades without inspecting how code actually executes.