deps.dev

liveDeveloperSecurity

Google's package metadata + dependency graph API. Keyless.

5tools
0msauth
free tier50 calls/day

Tools

projectrequired: project_type, project_key

Fetch deps.dev project metadata for a GitHub, GitLab, or Bitbucket repository (e.g. project_key="facebook/react"), returning scorecard scores, version count, and linked package references.

Parameters
NameTypeDescription
project_typereqstring—
project_keyreqstring—
▶Try it
packagerequired: system_, name

Fetch deps.dev metadata for an open-source package by ecosystem (NPM/PYPI/GO/MAVEN/NUGET/CARGO/RUBYGEMS) and name, returning version list, latest version, and linked source repository.

Parameters
NameTypeDescription
system_reqstring—
namereqstring—
▶Try it
versionrequired: system_, name, version

Security advisories, license and dependency metadata for ONE specific published release of a package. Requires an exact version that this package actually shipped — if you do not already have one, cal

Parameters
NameTypeDescription
system_reqstring—
namereqstring—
versionreqstring—
▶Try it
dependenciesrequired: system_, name, version

The fully resolved dependency graph of one published release — every transitive package it pulls in. Same requirement as `version`: the version must be one this package actually shipped, so call `pack

Parameters
NameTypeDescription
system_reqstring—
namereqstring—
versionreqstring—
▶Try it
queryrequired: query

Query packages/versions (by hash, repo URL, etc).

Parameters
NameTypeDescription
queryreqobject—
▶Try it

Test with curl

The gateway speaks JSON-RPC 2.0 over HTTP POST. You can test any pack directly from the terminal.

List available tools
bash
curl -X POST https://gateway.pipeworx.io/deps-dev/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Call a tool
bash
curl -X POST https://gateway.pipeworx.io/deps-dev/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"project","arguments":{"project_type": "example", "project_key": "example"}}}'

Use with the SDK

Install @pipeworx/sdk to call tools from any TypeScript/Node project.

TypeScript
import { Pipeworx } from '@pipeworx/sdk';
const px = new Pipeworx();
const result = await px.call("project", {"project_type":"example","project_key":"example"});
ask_pipeworx
// Or ask in plain English:
const answer = await px.ask("google's package metadata + dependency graph api");