{"id":"dependency-advisor","title":"Dependency Underuse & Replacement Advisor","description":"Audits the dependencies of a public GitHub repo, commit or pull request (or uploaded manifests and sources) and returns a pass/warn/fail verdict, a 0-100 risk score, the top findings with manifest file:line and the fix, and a SARIF 2.1.0 log for GitHub code scanning. Parses JS/TS, Python and Rust imports with a tokenizer-level scanner and maps them to declared npm, PyPI and crates.io dependencies. Flags unused, dev-only, undeclared and trivially used packages; checks deps.dev, the npm registry and OSV for deprecation, advisories, staleness and OpenSSF Scorecard; matches a cited table of platform replacements (fetch, crypto.randomUUID, optional chaining) and ranks alternatives in code by Scorecard, recency, dependents, size and license compatibility. Reads repos through GitHub's API and falls back to the source archive when the API is rate limited; when some lookups still fail, it returns a signed partial result that lists what is missing. At most one optional model call maps used symbols to a replacement; deterministic mode makes none. Advisory data comes from OSV and deps.dev and can lag; findings are leads to verify, not a certification.","roi":"A CI-ready dependency gate: fails the build on known high-severity advisories and lists the packages a repo no longer needs, has outgrown, or should replace, with proof from its own imports.","audience":"developer","channels":["x402","mcp","rapidapi","apify"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/audit-dependencies","path":"/api/v1/audit-dependencies","contentType":"application/json"},"price":{"amount":"0.40","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"properties":{"repo":{"type":"string","minLength":3,"maxLength":200,"description":"Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head)."},"ref":{"type":"string","maxLength":200,"description":"Branch, tag or commit; defaults to the default branch."},"files":{"type":"array","maxItems":600,"description":"Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths.","items":{"type":"object","additionalProperties":false,"required":["path","content"],"properties":{"path":{"type":"string","minLength":1,"maxLength":300},"content":{"type":"string","maxLength":400000}}}},"ecosystems":{"type":"array","maxItems":3,"items":{"type":"string","enum":["npm","pypi","cargo"]},"description":"Restrict the analysis; default all detected."},"mode":{"type":"string","enum":["auto","deterministic"],"description":"deterministic makes no model call; auto makes at most one, only for symbols the curated table cannot decide."},"repoLicense":{"type":"string","maxLength":100,"description":"SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent."}}},"resultSchema":{"type":"object","properties":{"verdict":{"type":"string","enum":["fail","warn","pass","inconclusive"],"description":"fail: a declared package has a high or critical known advisory. warn: high or medium priority findings. pass: none. inconclusive: nothing found but coverage was partial."},"riskScore":{"type":"integer","description":"0-100, computed in code from the top finding scores."},"verdictReason":{"type":"string"},"status":{"type":"string","enum":["complete","partial"],"description":"partial when source or registry lookups failed or were capped; the result is still signed and lists what is missing."},"missing":{"type":"array","items":{"type":"string"},"description":"What a partial result could not read or look up."},"topFindings":{"type":"array","items":{"type":"object","description":"Up to 5, highest priority first: rank, id, package, ecosystem, kind, severity, score, confidence, file, line (in the manifest), summary, fix."}},"nextStep":{"type":"string"},"sarif":{"type":"object","description":"SARIF 2.1.0 log, one result per finding located at its manifest line; uploads to GitHub code scanning as-is."},"source":{"type":"object","description":"Repo, pinned commit, tree size, files read, bytes, skipped files, license and where it came from."},"ecosystems":{"type":"array","items":{"type":"object","description":"Per ecosystem: manifests (path, lockfile kind, minimum runtime, declared count) and source files scanned."}},"summary":{"type":"object","description":"Counts of declared and flagged packages, findings by category (underused, outgrown, replace) and kind, high-severity count."},"findings":{"type":"array","items":{"type":"object","description":"id, kind (unused, dev-only-in-dependencies, dev-dependency-in-production, undeclared, trivial-use, native-replacement, redundant-dependency, deprecated, superseded, overlap, stale, vulnerable, behind-major), category, severity, score 0-100 (computed in code), confidence, ecosystem, package, manifest, summary, evidence, action, migrationEffort, citations."}},"replacements":{"type":"array","items":{"type":"object","description":"Per flagged package: symbols the repo imports, the curated table entry with citations and runtime applicability, ranked alternatives (Scorecard, recency, dependents, size, license compatibility), and a per-symbol coverage check. coverage.status is FULL_COVERAGE only when every used symbol is accounted for and covered; decidedBy is table, model or none."}},"dependencies":{"type":"array","items":{"type":"object","description":"Every declared package: sections, range, resolved version and its source, usage footprint, and registry health."}},"coverage":{"type":"object","description":"complete, notes, files scanned, health checked/skipped, upstream calls, failed sources."},"llmCalls":{"type":"integer","description":"0 in deterministic mode or when the curated table decided every symbol; otherwise 1."},"decidedBy":{"type":"object","description":"findings: code. replacementCoverage: symbol counts decided by the curated table, by the model, or left unreviewed."},"versions":{"type":"object","description":"Version of the curated replacements table."},"thresholds":{"type":"object","description":"The numeric thresholds the findings were computed with."},"wouldChangeVerdict":{"type":"array","items":{"type":"string"},"description":"Evidence that would raise confidence or change a finding."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"verdict":{"type":"string","enum":["fail","warn","pass","inconclusive"],"description":"fail: a declared package has a high or critical known advisory. warn: high or medium priority findings. pass: none. inconclusive: nothing found but coverage was partial."},"riskScore":{"type":"integer","description":"0-100, computed in code from the top finding scores."},"verdictReason":{"type":"string"},"status":{"type":"string","enum":["complete","partial"],"description":"partial when source or registry lookups failed or were capped; the result is still signed and lists what is missing."},"missing":{"type":"array","items":{"type":"string"},"description":"What a partial result could not read or look up."},"topFindings":{"type":"array","items":{"type":"object","description":"Up to 5, highest priority first: rank, id, package, ecosystem, kind, severity, score, confidence, file, line (in the manifest), summary, fix."}},"nextStep":{"type":"string"},"sarif":{"type":"object","description":"SARIF 2.1.0 log, one result per finding located at its manifest line; uploads to GitHub code scanning as-is."},"source":{"type":"object","description":"Repo, pinned commit, tree size, files read, bytes, skipped files, license and where it came from."},"ecosystems":{"type":"array","items":{"type":"object","description":"Per ecosystem: manifests (path, lockfile kind, minimum runtime, declared count) and source files scanned."}},"summary":{"type":"object","description":"Counts of declared and flagged packages, findings by category (underused, outgrown, replace) and kind, high-severity count."},"findings":{"type":"array","items":{"type":"object","description":"id, kind (unused, dev-only-in-dependencies, dev-dependency-in-production, undeclared, trivial-use, native-replacement, redundant-dependency, deprecated, superseded, overlap, stale, vulnerable, behind-major), category, severity, score 0-100 (computed in code), confidence, ecosystem, package, manifest, summary, evidence, action, migrationEffort, citations."}},"replacements":{"type":"array","items":{"type":"object","description":"Per flagged package: symbols the repo imports, the curated table entry with citations and runtime applicability, ranked alternatives (Scorecard, recency, dependents, size, license compatibility), and a per-symbol coverage check. coverage.status is FULL_COVERAGE only when every used symbol is accounted for and covered; decidedBy is table, model or none."}},"dependencies":{"type":"array","items":{"type":"object","description":"Every declared package: sections, range, resolved version and its source, usage footprint, and registry health."}},"coverage":{"type":"object","description":"complete, notes, files scanned, health checked/skipped, upstream calls, failed sources."},"llmCalls":{"type":"integer","description":"0 in deterministic mode or when the curated table decided every symbol; otherwise 1."},"decidedBy":{"type":"object","description":"findings: code. replacementCoverage: symbol counts decided by the curated table, by the model, or left unreviewed."},"versions":{"type":"object","description":"Version of the curated replacements table."},"thresholds":{"type":"object","description":"The numeric thresholds the findings were computed with."},"wouldChangeVerdict":{"type":"array","items":{"type":"string"},"description":"Evidence that would raise confidence or change a finding."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"repo":"star7th/htq","mode":"auto"},"openapiOperation":{"operationId":"dependency_advisor","summary":"Dependency Underuse & Replacement Advisor","description":"Audits the dependencies of a public GitHub repo, commit or pull request (or uploaded manifests and sources) and returns a pass/warn/fail verdict, a 0-100 risk score, the top findings with manifest file:line and the fix, and a SARIF 2.1.0 log for GitHub code scanning. Parses JS/TS, Python and Rust imports with a tokenizer-level scanner and maps them to declared npm, PyPI and crates.io dependencies. Flags unused, dev-only, undeclared and trivially used packages; checks deps.dev, the npm registry and OSV for deprecation, advisories, staleness and OpenSSF Scorecard; matches a cited table of platform replacements (fetch, crypto.randomUUID, optional chaining) and ranks alternatives in code by Scorecard, recency, dependents, size and license compatibility. Reads repos through GitHub's API and falls back to the source archive when the API is rate limited; when some lookups still fail, it returns a signed partial result that lists what is missing. At most one optional model call maps used symbols to a replacement; deterministic mode makes none. Advisory data comes from OSV and deps.dev and can lag; findings are leads to verify, not a certification.\n\nPrice: 0.40 USDC on Base (x402).","x-x402-price-usdc":"0.40","x-x402-amount":"400000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.40"}},"x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/dependency-advisor","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"repo":{"type":"string","minLength":3,"maxLength":200,"description":"Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head)."},"ref":{"type":"string","maxLength":200,"description":"Branch, tag or commit; defaults to the default branch."},"files":{"type":"array","maxItems":600,"description":"Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths.","items":{"type":"object","additionalProperties":false,"required":["path","content"],"properties":{"path":{"type":"string","minLength":1,"maxLength":300},"content":{"type":"string","maxLength":400000}}}},"ecosystems":{"type":"array","maxItems":3,"items":{"type":"string","enum":["npm","pypi","cargo"]},"description":"Restrict the analysis; default all detected."},"mode":{"type":"string","enum":["auto","deterministic"],"description":"deterministic makes no model call; auto makes at most one, only for symbols the curated table cannot decide."},"repoLicense":{"type":"string","maxLength":100,"description":"SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent."}}},"example":{"repo":"star7th/htq","mode":"auto"}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"verdict":{"type":"string","enum":["fail","warn","pass","inconclusive"],"description":"fail: a declared package has a high or critical known advisory. warn: high or medium priority findings. pass: none. inconclusive: nothing found but coverage was partial."},"riskScore":{"type":"integer","description":"0-100, computed in code from the top finding scores."},"verdictReason":{"type":"string"},"status":{"type":"string","enum":["complete","partial"],"description":"partial when source or registry lookups failed or were capped; the result is still signed and lists what is missing."},"missing":{"type":"array","items":{"type":"string"},"description":"What a partial result could not read or look up."},"topFindings":{"type":"array","items":{"type":"object","description":"Up to 5, highest priority first: rank, id, package, ecosystem, kind, severity, score, confidence, file, line (in the manifest), summary, fix."}},"nextStep":{"type":"string"},"sarif":{"type":"object","description":"SARIF 2.1.0 log, one result per finding located at its manifest line; uploads to GitHub code scanning as-is."},"source":{"type":"object","description":"Repo, pinned commit, tree size, files read, bytes, skipped files, license and where it came from."},"ecosystems":{"type":"array","items":{"type":"object","description":"Per ecosystem: manifests (path, lockfile kind, minimum runtime, declared count) and source files scanned."}},"summary":{"type":"object","description":"Counts of declared and flagged packages, findings by category (underused, outgrown, replace) and kind, high-severity count."},"findings":{"type":"array","items":{"type":"object","description":"id, kind (unused, dev-only-in-dependencies, dev-dependency-in-production, undeclared, trivial-use, native-replacement, redundant-dependency, deprecated, superseded, overlap, stale, vulnerable, behind-major), category, severity, score 0-100 (computed in code), confidence, ecosystem, package, manifest, summary, evidence, action, migrationEffort, citations."}},"replacements":{"type":"array","items":{"type":"object","description":"Per flagged package: symbols the repo imports, the curated table entry with citations and runtime applicability, ranked alternatives (Scorecard, recency, dependents, size, license compatibility), and a per-symbol coverage check. coverage.status is FULL_COVERAGE only when every used symbol is accounted for and covered; decidedBy is table, model or none."}},"dependencies":{"type":"array","items":{"type":"object","description":"Every declared package: sections, range, resolved version and its source, usage footprint, and registry health."}},"coverage":{"type":"object","description":"complete, notes, files scanned, health checked/skipped, upstream calls, failed sources."},"llmCalls":{"type":"integer","description":"0 in deterministic mode or when the curated table decided every symbol; otherwise 1."},"decidedBy":{"type":"object","description":"findings: code. replacementCoverage: symbol counts decided by the curated table, by the model, or left unreviewed."},"versions":{"type":"object","description":"Version of the curated replacements table."},"thresholds":{"type":"object","description":"The numeric thresholds the findings were computed with."},"wouldChangeVerdict":{"type":"array","items":{"type":"string"},"description":"Evidence that would raise confidence or change a finding."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/dependency-advisor/","docsJson":"https://agents.writerslogic.com/docs/dependency-advisor.json","sample":"https://agents.writerslogic.com/api/v1/samples/dependency-advisor","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}