Unfragile

The request asks for a tool to detect static dependencies, which is most directly served by static analysis and dependency-scanning tools. Fallow 4 performs static analysis of dependencies and unused code for TypeScript/JavaScript, and its indexed action 'fallow_analyze' reports unused dependencies. For Python, PyPA 7 offers the pypa/gh-action-pip-audit action to scan dependencies. The activation prerequisite of detect-static-dependencies requires C#/.NET, and none of the candidate sources e

A question back: Which language or platform is the code in (for example C#/.NET, TypeScript/JavaScript, Python or Kotlin)?

1
Fallowfallow.toolsverified and signed
Static analysis of one repository graph that reports unused dependencies, circular dependencies and architecture boundaries for TypeScript and JavaScript 4.
Website Docs
for agents: fallow · fallow_analyze · fallow_check_install
2
PyPA documentationpypa.ioverified and signed
Points to pypa/gh-action-pip-audit, which scans Python dependencies for known vulnerabilities 7.
Website Docs
for agents: dependency · pypa/gh-action-pip-audit · eggs
3
detektdetekt.devwebsite read, tools not yet checked
A static analyzer for Kotlin that runs as part of Gradle, Maven or Bazel builds 10.
Website Docs
+2 community tools built for it

Sources

4Fallow documentationfallow.tools · read 2026-10-29
7Python Packaging Authority — PyPA documentationpypa.io · read 2026-10-29
10Hello from detekt | detektdetekt.dev · read 2026-10-29

For agents: the 10 actions behind this answer

detect-static-dependencies · detect-static-dependencies verified and signed
ACTIVATION PREREQUISITE: the request or discovered target must explicitly identify C#, .NET, `.cs`, or `.csproj`; otherwise stay dormant without invoking this skill. USE FOR: locating System.DateTime.Now/UtcNow, System.IO.File/Directory, System.Environment, HttpClient, Console, or Process usage in C
sponsor-finder · sponsor-finder verified and signed
Find which of a GitHub repository's dependencies are sponsorable via GitHub Sponsors. Uses deps.dev API for dependency resolution across npm, PyPI, Cargo, Go, RubyGems, Maven, and NuGet. Checks npm funding metadata, FUNDING.yml files, and web search. Verifies every link. Shows direct and transitive
docker/setup-qemu-action · Docker Setup QEMU verified and signed
Install QEMU static binaries
fallow · fallow verified and signed
Codebase intelligence for TypeScript and JavaScript. Static analysis reports changed-code risk, cleanup opportunities, duplication, circular dependencies, complexity hotspots, architecture boundaries, design-system drift, feature flags, and opt-in security candidates. Optional local similar-code dis
export_dashboard · opensearch-flux found in code, not yet checked
Export a dashboard and all its dependencies as NDJSON. Use after list_dashboards. Next step: inspect_ndjson.
zizmorcore/zizmor-action · zizmor-action verified and signed
Run zizmor from GitHub Actions 🌈
dependency · hatch verified and signed
List all dependencies · Snyk API verified and signed
List all dependencies
dependency · poetry-core verified and signed
· detekt website read, tools not yet checked
The official website of detekt - A static analyzer for Kotlin

Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.