CLI that helps AI agents avoid vulnerable dependencies
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more.It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service.I built this because AI coding agents kept suggesting outdated or vulnerable package versions. I kept having to manually tell tools like Claude and Codex to use newer, safer versions.deptrust gives the agent a quick way to verify whether a dependency version has known vulnerabilities before it installs or recommends it.You can install it with:1. pnpx @clidey/deptrust@latest install2. brew install clidey/tap/deptrust3. Or directly with go: go install github.com/clidey/deptrust/cmd/deptrust@latest
HN · launched Jul 1, 2026 · 26 upvotes (top 23%) · 0 views
Niche: vulnerability scanning and exploitation tools · 73 launches, 5 in the last 7 days · Explore this niche →
Category and tags
- Security
- Dev tools
- Developer
- AI feature
- Commercial product
Visit website ↗ Source listing ↗
More like this: all 73 launches in vulnerability scanning and exploitation tools →
Could you build this?
Yes The CLI simply queries standard open public vulnerability databases (like OSV.dev) against package manifest files and provides an MCP server interface.
Discussion
5 comments analyzed.
Competitors mentioned: Codacy CLI, Aikido safe chain
Concerns raised: Unclear how it compares to existing Aikido solution
Feature requests: Claude plugin with hook on dependency files, Direct Claude Code/Codex integration
Competitors
Other products that read as similar to this one : 237 launches clear the similarity bar, closest 8 shown.
Attention rank: #70 of 238 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 229 days after the earliest competitor.
- DepSentinel · ph · 2026-10-19 · 3 upvotes · similarity 0.44
- agend-sh · ph · 2026-10-10 · 1 upvotes · similarity 0.43
- npm Package Inspector · ph · 2026-09-21 · 2 upvotes · similarity 0.43
- LegacyFixer · ph · 2026-10-14 · 60 upvotes · similarity 0.42
- Drift — Dependency Upgrades · ph · 2026-09-29 · 2 upvotes · similarity 0.42
- Safe-install · hn · 2026-05-12 · 19 upvotes · similarity 0.41
- DMCPS · ph · 2026-10-03 · 3 upvotes · similarity 0.41
- Warden CI · ph · 2026-10-01 · 2 upvotes · similarity 0.41
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.