The request is a generic dependency audit with no named product or platform. Several candidates check dependencies for known vulnerabilities: Contrastcyber's check_dependencies action audits npm, PyPI, Maven and RubyGems packages against a CVE database 111, pip-audit scans Python dependencies via a GitHub Action 212, and Trail of Bits' supply-chain-risk-auditor covers lockfile trees and advisories 313. Which ecosystem and platform you use would decide the best fit.
A question back: Which language ecosystem and platform does the project use (for example npm, Python, Maven, or containers), and do you want a CLI, a GitHub Action or an MCP tool?
- 1
Contrastcybercontrastcyber.comverified and signed
Its check_dependencies action audits project dependencies for npm, PyPI, Maven, RubyGems and similar ecosystems against a CVE database to find known vulnerabilities 11.
official:MCP server · ContrastAPI
for agents: check_dependencies · Dependency Check · Domain Audit
- 2
- 3
Trail of Bits supply-chain-risk-auditortrailofbits.comverified and signed
Its supply-chain-risk-auditor audits a project's direct dependencies and full lockfile tree for version-matched advisories and supply-chain risk 13.
for agents: supply-chain-risk-auditor · substrate-vulnerability-scanner · ton-vulnerability-scanner
- 4
Sources
- 1ContrastCyber Products for Humans and AI Agentscontrastcyber.com · read 2026-10-29
- 2Python Packaging Authority — PyPA documentationpypa.io · read 2026-10-29
- 3Trail of Bits: Security Research, Audits, and Toolstrailofbits.com · read 2026-10-29
- 5Depwire — The Missing Context Layer for AI Coding Assistantsdepwire.dev · read 2026-10-29
- 11ContrastAPI: declares "check_dependencies" (the record we read and signed)unfragile.ai · read 2026-10-24
- 12gh-action-pip-audit: declares "pypa/gh-action-pip-audit" (the record we read and signed)unfragile.ai · read 2026-10-24
- 13supply-chain-risk-auditor: declares "supply-chain-risk-auditor" (the record we read and signed)unfragile.ai · read 2026-10-24
- 15depwire-cli: declares "security_scan" (the record we read and signed)unfragile.ai · read 2026-10-24
For agents: the 10 actions behind this answer
check_dependencies · ContrastAPI verified and signed
Audit project dependencies (npm/PyPI/Maven/RubyGems/etc.) against CVE database: find known vulnerabilities in your package list. Bulk query up to 50 packages per call (same for Free and Pro). Use for dependency security scanning; use cve_lookup for single CVE. Free: 30/hr (1 per package), Pro: 500/h
pypa/gh-action-pip-audit · gh-action-pip-audit verified and signed
Use pip-audit to scan Python dependencies for known vulnerabilities
supply-chain-risk-auditor · supply-chain-risk-auditor verified and signed
Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-pa
fetch_dependency_source · xpsd found in code, not yet checked
Fetch the source of a dependency that is NOT vendored in /src — e.g. one a
security_scan · depwire-cli verified and signed
Scan the codebase for security vulnerabilities using deterministic checks + graph-aware severity scoring. No API key required. Checks: dependency CVEs, shell injection, hardcoded secrets, path traversal, auth bypass, input validation, information disclosure, cryptography weaknesses, frontend XSS, ar
· Vibgrate website read, tools not yet checked
Vibgrate scans your repository on your machine. It shows how far your stack has fallen behind, finds dependencies with known vulnerabilities, and gives your coding agent focused context from the code you actually run. Free, no account, raw source is not uploaded.
sonatype-guide · sonatype-guide verified and signed
Sonatype Guide MCP server for software supply chain intelligence and dependency security. Analyze dependencies for vulnerabilities, get secure version recommendations, and check component quality metrics.
snyk/actions · Snyk verified and signed
Check your applications for vulnerabilities using Snyk
· Trivy website read, tools not yet checked
Trivy is the most popular open source security scanner for Vulnerability &, IaC, SBOM discovery, cloud scanning and Kubernetes security
ship_safe_audit · ship-safe verified and signed
Run a Ship Safe security audit on a local codebase directory.
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.