Deptools

Deptools is a software dependency health platform, also known as software composition analysis (SCA), for Java, Kotlin, Android, Scala, JavaScript/TypeScript, and PHP projects. It scans your project's build files (Maven, Gradle, npm/Yarn/pnpm, sbt, Composer) and resolves the complete dependency graph, direct and transitive, using a pre-built ecosystem knowledge graph. Each dependency is scored across six dimensions, rolled up into a single 0-10 Health Score: - Security: CVE detection, with severity levels and actionable patch paths - License: permissive vs. copyleft classification, including GPL-style compliance risks - Maintainability: outdated versions, version conflicts, duplicate versions, upgrade paths - Popularity: adoption trends across the ecosystem - Activity: release frequency, maintainer activity, abandonment risk - Community: contributor count, forks, open issues, bus factor Deptools generates SBOM exports (CycloneDX and SPDX formats) for software supply chain security and compliance requirements like the EU Cyber Resilience Act (CRA), plus CSV audit reports and embeddable health badges. Deptools offers a native GitHub integration, allowing teams to gate CI/CD pipelines based on dependency health directly through the GitHub Action. For any other CI system, the same gating capabilities are available via the public REST API. And if a project isn’t hosted on GitHub, its build files can be pushed directly from the pipeline instead. Free for open-source projects, with a Pro plan for private repositories and unlimited projects. Try the live demo at deptools.io/dashboard/demo