dependency-decision-helper

You can check package version safety by analyzing risk evidence like malware, vulnerabilities, and license issues. The analysis returns a verdict such as SAFE, SAFE_WITH_CONDITIONS, NOT_RECOMMENDED, or BLOCKED to help you decide if a dependency is suitable for your project.

Dependency risk analysis evaluates signals like malware, vulnerabilities, license issues, and typosquatting across npm, pypi, and maven ecosystems. It returns a safety verdict and supporting evidence to guide software dependency management and compliance checks.

Yes, if a package version is risky, the analysis recommends safer alternative versions. It provides evidence-based verdicts and conditions so you can upgrade or replace dependencies that have vulnerabilities, malware, or license issues.

Yes, evaluating dependency safety requires access to Endor's API and MCP tools for evidence retrieval, along with the endorctl dependency. This environment queries risk evidence to return package version verdicts and conditions for security audits.

When data gaps exist, dependency risk analysis may return incomplete evidence, limiting the accuracy of safety verdicts like SAFE or BLOCKED. The analysis explicitly identifies these data gaps so users understand where risk evidence is missing for a given package version.