Dependency Underuse & Replacement Advisor
Audits the dependencies of a public GitHub repo, commit or pull request (or uploaded manifests and sources) and returns a pass/warn/fail verdict, a 0-100 risk score, the top findings with manifest file:line and the fix, and a SARIF 2.1.0 log for GitHub code scanning. Parses JS/TS, Python and Rust imports with a tokenizer-level scanner and maps them to declared npm, PyPI and crates.io dependencies. Flags unused, dev-only, undeclared and trivially used packages; checks deps.dev, the npm registry and OSV for deprecation, advisories, staleness and OpenSSF Scorecard; matches a cited table of platform replacements (fetch, crypto.randomUUID, optional chaining) and ranks alternatives in code by Scorecard, recency, dependents, size and license compatibility. Reads repos through GitHub's API and falls back to the source archive when the API is rate limited; when some lookups still fail, it returns a signed partial result that lists what is missing. At most one optional model call maps used symbols to a replacement; deterministic mode makes none. Advisory data comes from OSV and deps.dev and can lag; findings are leads to verify, not a certification.
What you get
A CI-ready dependency gate: fails the build on known high-severity advisories and lists the packages a repo no longer needs, has outgrown, or should replace, with proof from its own imports.
Call it
Send the JSON body below to https://agents.writerslogic.com/api/v1/audit-dependencies. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.
curl -i -X POST https://agents.writerslogic.com/api/v1/audit-dependencies \
-H 'content-type: application/json' \
-d '{"repo":"star7th/htq","mode":"auto"}'
Input
| Field | Type | Required | Description |
|---|---|---|---|
repo | string; length 3..200 | no | Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head). |
ref | string; length 0..200 | no | Branch, tag or commit; defaults to the default branch. |
files | array<object>; max 600 items | no | Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths. |
ecosystems | array<string; one of "npm", "pypi", "cargo">; max 3 items | no | Restrict the analysis; default all detected. |
mode | string; one of "auto", "deterministic" | no | deterministic makes no model call; auto makes at most one, only for symbols the curated table cannot decide. |
repoLicense | string; length 0..100 | no | SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent. |
Example request body
{
"repo": "star7th/htq",
"mode": "auto"
}
Result
The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.
| Field | Type | Required | Description |
|---|---|---|---|
verdict | string; one of "fail", "warn", "pass", "inconclusive" | no | fail: a declared package has a high or critical known advisory. warn: high or medium priority findings. pass: none. inconclusive: nothing found but coverage was partial. |
riskScore | integer | no | 0-100, computed in code from the top finding scores. |
verdictReason | string | no | |
status | string; one of "complete", "partial" | no | partial when source or registry lookups failed or were capped; the result is still signed and lists what is missing. |
missing | array<string> | no | What a partial result could not read or look up. |
topFindings | array<object> | no | |
nextStep | string | no | |
sarif | object | no | SARIF 2.1.0 log, one result per finding located at its manifest line; uploads to GitHub code scanning as-is. |
source | object | no | Repo, pinned commit, tree size, files read, bytes, skipped files, license and where it came from. |
ecosystems | array<object> | no | |
summary | object | no | Counts of declared and flagged packages, findings by category (underused, outgrown, replace) and kind, high-severity count. |
findings | array<object> | no | |
replacements | array<object> | no | |
dependencies | array<object> | no | |
coverage | object | no | complete, notes, files scanned, health checked/skipped, upstream calls, failed sources. |
llmCalls | integer | no | 0 in deterministic mode or when the curated table decided every symbol; otherwise 1. |
decidedBy | object | no | findings: code. replacementCoverage: symbol counts decided by the curated table, by the model, or left unreviewed. |
versions | object | no | Version of the curated replacements table. |
thresholds | object | no | The numeric thresholds the findings were computed with. |
wouldChangeVerdict | array<string> | no | Evidence that would raise confidence or change a finding. |
Pay and connect
Available through: x402 (USDC on Base), MCP, RapidAPI, Apify.
Machine-readable
- This agent as JSON (schemas, example, OpenAPI operation)
- Free signed sample response
- OpenAPI 3.1 · Catalog · Index of every agent