1 to 25 manifest files. Give each one as pasted text (content) or as a public URL (url). Supported types: package.json, package-lock.json, requirements.txt, go.mod and Cargo.toml. The type comes from the file name, or you can state it. No repository clone. No package install.

Type:array

Min. items:1

Max. items:25

Default:

[
  {
    "name": "web/package.json",
    "type": "package.json",
    "content": "{\n  \"name\": \"demo-web\",\n  \"dependencies\": {\n    \"express\": \"^4.18.2\",\n    \"request\": \"^2.88.2\",\n    \"left-pad\": \"^1.3.0\"\n  }\n}\n"
  },
  {
    "name": "api/requirements.txt",
    "type": "requirements.txt",
    "content": "requests==2.31.0\ndjango>=4.2\n"
  },
  {
    "name": "gateway/go.mod",
    "type": "go.mod",
    "content": "module example.com/demo\n\ngo 1.21\n\nrequire (\n\tgithub.com/gorilla/mux v1.8.1\n\tgithub.com/sirupsen/logrus v1.9.3\n)\n"
  },
  {
    "name": "worker/Cargo.toml",
    "type": "Cargo.toml",
    "content": "[package]\nname = \"demo-worker\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0\"\nrand = \"0.8\"\n"
  }
]

Denied SPDX licenses

licensePolicy

Optional

SPDX identifiers that the report must flag, for example GPL-3.0-only and AGPL-3.0-only. A package whose license matches one of these gets the FAIL verdict. Deprecated identifiers such as GPL-3.0 are matched as well.

Type:array

Default:

[
  "GPL-3.0-only",
  "AGPL-3.0-only"
]

Abandonment age in days

abandonmentDays

Optional

A package with no new release in this many days gets the abandoned flag.

Type:integer

Minimum:1

Maximum:10000

Default:730

Include transitive dependencies

includeTransitive

Optional

Resolve one level of transitive dependencies for npm and PyPI packages, and keep the transitive entries that a lock file or a go.mod indirect marker already states. Off by default, because it multiplies the package count and the run cost.

Type:boolean

Default:false

A deprecated package fails the policy

failOnDeprecated

Optional

Count a package that the registry marks deprecated (or a yanked PyPI or crates.io release) as a policy failure.

Type:boolean

Default:true

An abandoned package fails the policy

failOnAbandoned

Optional

Count a package that is older than the abandonment age as a policy failure. Off by default, because an old release is often a stable release.

Type:boolean

Default:false

An unreadable license fails the policy

failOnUnknownLicense

Optional

Count a package whose license the registry does not state as an SPDX identifier as a policy failure.

Type:boolean

Default:false

Baseline key

baselineKey

Optional

Optional key-value store key that holds the baseline for this manifest set. Leave it empty and the Actor derives one key from the manifest names, so the same manifest set finds its own baseline on the next run.

Type:string

Default:

PWA Install Readiness and Manifest Asset Gate

kingii98/pwa-install-readiness-and-manifest-asset-gate

Reads the manifest link from the HTML head of each origin, reads the web app manifest, then verifies every declared icon, screenshot and shortcut icon with one HEAD and one ranged GET. It reports the true pixel size read from the file header against the d

kingii98

The Manifest Agency Scraper

great_pistachio/manifest-agency-scraper

Extract B2B agency and service-provider listings from The Manifest (themanifest.com): name, rating, review count, hourly rate, minimum project size, team size, location, notable clients, and profile link. Filter by category and location. Fast HTTP scraper, no browser.

Saturnin Pugnet

Product End-of-Life & Lifecycle Scraper

chrisp1211/endoflife-scraper-max

Product End-of-Life & Lifecycle Scraper. No API key required. Pay only per result; empty or failed runs cost nothing.

Christian Pichichero

Dependency Audit — CVE, License & EOL Check for AI

haketa/dependency-audit

Audit any software dependency for vulnerabilities (CVE), license, deprecation, end-of-life and health scores in one call. Supports npm, PyPI, crates, Go, Maven, NuGet, RubyGems. Supply-chain security grounding for AI coding agents & SCA.

Haketa

Manifest Agency Scraper | B2B Agency Leads

ahmed_jasarevic/manifest-agency-scraper

Extract B2B agency profiles from The Manifest — company names, ratings, reviews, hourly rates, project sizes, team sizes, services and client data. Build lead lists for agency outreach.

Ahmed Jasarevic

Container Registry Pull Reachability and Rate-Budget Ledger

kingii98/container-registry-pull-reachability-and-rate-budget-ledger

Pulls the manifest of every pinned image reference over HTTPS and reports whether the pull works now, why it would fail, which platforms the manifest holds, the TLS name-match verdict, and how much anonymous rate budget the registry has left. HTTP only, n

kingii98

Colorado Professional License Scraper

velvety_bedbug/colorado-professional-license-scraper

Scrape the Colorado DORA professional and occupational license registry: licensee name, license number, profession type, status, city, and license dates — built for license verification, compliance, and lead generation.

Peters Bugs

Insurance License Scraper - Agent License Verification

lulzasaur/insurance-license-scraper

Scrape insurance agent/broker license data from state DOI databases. Supports FL, CA, TX. Verify license status, expiration dates, and license types for compliance and due diligence.

lulz bot

State Insurance License Scraper

chimerical_quicklime/state-insurance-license-scraper

Scrape insurance producer license data from state regulators (Florida and more). License #, name, status, residency, license type. Export JSON, CSV, Excel.

Khrystyna Skotte

Batch License Header Injector for Source Code

aspiring_hypotenuse_ior/add-license-information-to-codebase

Automatically prepend license text to multiple codebase files to ensure legal compliance across your project. This tool takes a license string and a list of file paths/contents, returning the updated files with a properly formatted blank line separating the license from your original code.