DepWatch scans any GitHub repository and delivers transparent health reports — risk scores, evidence signals, and actionable recommendations for every dependency.
Dependencies become unmaintained silently. There's no alarm when the last commit was eight months ago, or when a library's sole maintainer stopped responding. Your build stays green while technical debt accumulates.
DepWatch surfaces that invisible drift — before it becomes a CVE, a breaking change, or a production incident.
Commit history, release cadence, contributor count, and issue activity — combined into one coherent health signal that reflects true maintenance state.
High / Medium / Low based on how many signals agree. Not all risk is equal — DepWatch tells you how sure it is.
Clear recommendations: no action, monitor, evaluate alternatives, or migrate now. No ambiguity about next steps.
Color-coded panels with detailed breakdowns. Designed to be readable at a glance in any terminal workflow.
FastAPI backend for programmatic access. Integrate health scores into your CI pipeline or internal tooling.
Parses requirements.txt, package.json, and pyproject.toml — Python and Node projects covered.
Point DepWatch at any GitHub URL. It fetches and parses your dependency manifest — requirements.txt, package.json, or pyproject.toml.
For each dependency, DepWatch queries the GitHub API — pulling commit recency, release dates, contributor counts, and issue activity.
A weighted scoring engine turns raw signals into a 0–10 risk number. Stale commits, solo maintainers, and abandoned releases all contribute.
Rich terminal panels show every signal, the confidence level, and a clear recommendation. No raw data to interpret — just actionable output.
No black boxes. Every point in the risk score traces back to a specific, observable signal from the repository.
Multiple independent signals point the same direction. The risk assessment is reliable.
Two signals align but others are neutral or absent. Treat this as an early warning.
Only one signal triggered. Worth monitoring, but not a clear risk signal yet.
DepWatch is MIT-licensed and community-driven. The scoring methodology is visible, the code is readable, and contributions are welcome.
One command. Full visibility. Know exactly what needs attention before it becomes a problem.