Dependency Health Check
A dependency check on one open-source package: maintenance, release cadence, security history, license, adoption and alternatives, so you can decide whether to adopt or keep it.
Built for engineers running a dependency check before they adopt or keep a package.
Why this work is hard
Engineers deciding whether to adopt or keep a dependency spend hours on this by hand: finding the right sources, reading them, checking them against each other and writing up what matters. The work is repetitive, it is easy to miss something, and nobody can show where a claim came from.
Dependency Health Check does that work as a GREP AI agent. It runs when you ask, and you can put it on a daily, weekly or monthly schedule. Every run delivers a sourced report, with every claim linked to its source.
What you get
What Dependency Health Check delivers
FAQ
What does Dependency Health Check need to run?
Dependency Health Check needs package or repository.
How often does Dependency Health Check run?
It runs when you ask, and you can put it on a daily, weekly or monthly schedule.
What does Dependency Health Check deliver?
Every run delivers a sourced report, with every claim linked to its source.
Can I change what Dependency Health Check does?
Yes. Every GREP AI agent can be cloned into your workspace, where you can edit its instructions, add your own sources and files, and change its schedule.
Which package registries does it check?
It looks up the registry entry on npm, PyPI, crates.io, Maven Central, RubyGems, NuGet, Packagist or pkg.go.dev, and confirms it links to the source repository on GitHub, GitLab or Codeberg.
How does the dependency check review security history?
It searches OSV.dev, the GitHub Advisory Database and NVD for advisories, recording each ID, severity, affected and fixed versions, and the time from disclosure to fix. It also checks for a SECURITY.md file, the OpenSSF Scorecard and signed releases or provenance.
What if the name matches several packages?
It picks the most likely one by downloads and name match, states the choice in the first line of the report and lists the other candidates. It also watches for typosquats and lookalike names.
More agents like this
- PremiumRuns on a schedule, weekly
Tech Intel
Weekly technology intelligence on an area or stack you name: releases, security issues, architecture and AI developments, in one research report.
Sourced reportView → - Runs over a list
Vendor Security Precheck
Prefills a vendor security review for each vendor you list from public evidence: certifications, trust center, breaches, data location and subprocessors.
Sourced reportView → - Runs on demand
Scam Check
An AI scam checker that returns a verdict on whether a website, message or offer looks like a scam, with the evidence behind the call and what to do next, each claim sourced.
Sourced reportView → - Runs on demand
Business Tool Evaluator
An evidence-backed vendor evaluation for one tool or vendor: regulatory status, validation evidence, performance, risks, integration fit and pricing, with a verdict.
Sourced reportView → - Runs on a schedule, weekly
Citation Alert
Citation alerts for your seed papers or authors: each run lists new citing papers with abstract, venue, method, and exactly how they use the cited work.
Formatted briefView → - Runs on a schedule, weekly
Cyber Threat Watch
Weekly cyber threat intelligence on breaches, ransomware, exploited vulnerabilities, attack techniques and advisories hitting your industry, region or technology, with concrete defenses.
Formatted briefView →
Run Dependency Health Check in minutes.
Free to start. Run it once, put it on a schedule, or clone it and make it yours.