GitHub Dependency Risk Triage with OSV

Dependency Signal Monitor

ishekofficial/dependency-signal-monitor

Reads your repo's dependency manifests through a GitHub connector, scores each dependency for abandonment risk, and opens an issue listing the ones that are dying.

Inspect public GitHub package manifests for dependency counts, lockfile presence, license, engine, and lightweight risk signals.

Read Markdown through a least-privilege GitHub MCP connector, validate public external links without cloning the repository, and create or update one review issue.

GitHub Repo & Dependency Scraper

taroyamada/github-repo-dependency-intelligence

Analyze GitHub repositories, package manifests, dependencies, and repository health signals using the GitHub REST API.

Scan npm, PyPI, Maven, Go & more dependencies for known vulnerabilities via OSV.dev and the GitHub Advisory Database. CI/CD-ready, no login.

OSV-Scanner Vulnerability Checker

ayeeyee/osv-scanner-vulnerability-checker

Scan a git repository dependency manifests, package-lock.json, requirements.txt, go.sum, and more, against Google OSV.dev vulnerability database using OSV-Scanner. Get cross-ecosystem CVE matching across npm, PyPI, Go, Maven, and other package registries. $0.49 per completed scan.

OSV.dev Vulnerabilities Scraper

crawlerbros/osv-vulnerabilities-scraper

Scrape OSV.dev, Google's open vulnerability database covering NPM, PyPI, Go, Maven, NuGet, Cargo, RubyGems, GitHub Actions, OS distros, and more. Look up vulnerabilities by package, fetch a specific OSV/GHSA/CVE record, or batch-query an entire dependency tree.

DURA - Dependency Update Risk Analyzer

artistic_seal/dura

Analyzes a GitHub project's Node.js dependencies and rates the update risk using version changes + GitHub release notes.

Dependency License Auditor

junipr/dependency-license-auditor

Audit dependency manifests for license types, unknown licenses, and policy risk.

OSV & GitHub Security Scraper

taroyamada/oss-vulnerability-monitor

Scrape GitHub Security Advisories and OSV databases to extract CVSS v3.1 base scores, fixed version tags, and patching details for your tech stack.