CLI that helps AI agents avoid vulnerable dependencies
Details
- External ID
- 48752948
- Source
- HN
- Company
- —
- Product
- CLI that helps AI agents avoid vulnerable dependencies
- Website domain
- github.com
- Launched
- July 1, 2026
- Cohort
- —
- Upvotes
- 26
- Upvotes percentile
- 0.7652329749103942
- Tags
- —
- Fetched at
- Sept. 7, 2026, 9:26 p.m.
- Updated at
- Sept. 7, 2026, 9:26 p.m.
Description
deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more.It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service.I built this because AI coding agents kept suggesting outdated or vulnerable package versions. I kept having to manually tell tools like Claude and Codex to use newer, safer versions.deptrust gives the agent a quick way to verify whether a dependency version has known vulnerabilities before it installs or recommends it.You can install it with:1. pnpx @clidey/deptrust@latest install2. brew install clidey/tap/deptrust3. Or directly with go: go install github.com/clidey/deptrust/cmd/deptrust@latest
Enrichment
- Theme
- ai cybersecurity and penetration testing
- Vertical
- Security
- Function
- Dev tools
- Audience
- Developer
- AI stance
- AI feature
- Project type
- Commercial product
- Normalized one-liner
- dependency vulnerability checker for ai agents
- Manually corrected
- False
Could you build this?
Yes The CLI simply queries standard open public vulnerability databases (like OSV.dev) against package manifest files and provides an MCP server interface.
Discussion
5 comments analyzed.
Competitors mentioned: Codacy CLI, Aikido safe chain
Concerns raised: Unclear how it compares to existing Aikido solution
Feature requests: Claude plugin with hook on dependency files, Direct Claude Code/Codex integration
Competitors
Other products that read as similar to this one — 71 launches clear the similarity bar, closest 8 shown.
Attention rank: #17 of 72 (itself plus its competitors, highest first — normalized so YC and Product Hunt are compared fairly).
Launched 223 days after the earliest competitor.
- npm Package Inspector · ph · 2026-09-21 · 2 upvotes · similarity 0.42
- Drift — Dependency Upgrades · ph · 2026-09-29 · 2 upvotes · similarity 0.41
- Safe-install · hn · 2026-05-12 · 19 upvotes · similarity 0.41
- MCPShip · ph · 2026-09-12 · 3 upvotes · similarity 0.39
- Universal CLI by Composio · ph · 2026-03-27 · 158 upvotes · similarity 0.39
- mcp-audit-tool · github · 2026-09-26 · 120 upvotes · similarity 0.38
- agent-harness · ph · 2026-09-10 · 3 upvotes · similarity 0.38
- Buddy AI Access (MCP) · ph · 2026-09-15 · 99 upvotes · similarity 0.37
Other launches for this product
- No other launches for this product.
Same idea, different domain
Nobody's really built a dev tools tool for Sales yet.