DepGuard

Inspiration Every hackathon and every new clone of a repo hits the same wall: you pull the code, try to run it, and hit a wall of missing dependencies, wrong runtime versions, or a database the README never mentioned. Most tools either check one ecosystem (like npm audit for Node) or focus on vulnerabilities instead of the much more basic question: can this project even run? We wanted a tool that answers that question first, works across multiple stacks at once, and meets people where they already collaborate — Slack. What it does DepGuard scans a project (locally via CLI, or a public GitHub repo via Slack) and:

Detects every stack actually present — Python, Node.js, JavaScript, TypeScript, Java, Go, .NET, PHP, Rust, Ruby — polyglot-safe, so a repo with Python and Node gets both checked, not just one. Reads each ecosystem's manifest (requirements.txt, package.json, pom.xml, go.mod, composer.json, Cargo.toml, Gemfile) and infrastructure config (Docker, Kubernetes, GitHub Actions, Terraform). Flags database signals (PostgreSQL, MySQL, MongoDB, Redis, Oracle) without overclaiming — it tells you what it can't confirm, not just what's broken. Compares source imports against declared dependencies (Dependency Alignment) to catch drift between what's imported and what's actually declared. Reports results as PASS / FAIL / WARN, with a plain-language suggestion and a copy-paste fix command wherever one exists.

In Slack, you just run /depguard owner/repo and get the full report back as a formatted message — no local setup required to check someone else's repo. How we built it

Core engine: a Python CLI that runs a pipeline of stack detectors and per-ecosystem check modules, each returning a structured CheckResult. Slack layer: a separate wrapper repo that clones the target repo into a temp directory, invokes the core engine, and formats results into Slack Block Kit. MCP integration: exposes the scan as a callable tool so the Slack bot (and potentially other agent surfaces) can invoke it directly. Deployment: backend runs on Railway for the Slack bot to call into. We kept the two repos separate on purpose — DepGuard (engine) and depguard-slack (integration) — so the CLI stays usable standalone via pip install.

Challenges we ran into

Avoiding false confidence. Early on, database and dependency checks were either too aggressive (flagging test-only imports as production issues) or too silent. We settled on a three-tier status system (PASS/FAIL/WARN) specifically so "signal, not proof" findings — like an Oracle-related import with no confirmed connection string — get surfaced as WARN with cautious language instead of a hard FAIL. Polyglot repos. Detecting "this repo is Python" is easy. Detecting "this repo is Python and Node and has a Dockerfile" without one stack drowning out the other took more careful detection logic. Static sites with no manifest. HTML/JS/TS projects with no package.json still needed useful signal instead of DepGuard just giving up — we added detection that warns dependency tooling is undefined rather than skipping the check entirely. Scoping security out — for now. It was tempting to fold in CVE/advisory scanning (via OSV, npm audit, etc.) immediately, but that's a fundamentally different question ("is this safe?" vs. "can this run?") with different performance and UX needs. We explicitly deferred it to a v2 opt-in flag rather than blurring the product's focus.

Accomplishments that we're proud of

A single scan that's genuinely polyglot-safe across 11 languages and 9+ frameworks. Clear, non-alarmist language for uncertain findings — grey-area warnings read as "review this," not "confirmed broken." A working Slack slash-command flow on top of a CLI that also stands alone and installs with one pip install command.

What we learned

Precision in language matters as much as detection accuracy — a tool that says "FAIL" when it means "maybe" erodes trust fast. Keeping "setup diagnostics" and "security scanning" as clearly separate concerns (even in the roadmap) made the current release's scope much easier to reason about and ship. Building the Slack integration as a thin wrapper around a standalone CLI, rather than baking Slack-specific logic into the core engine, made both pieces easier to test and reuse.

What's next for DepGuard

Advisory/CVE scanning (v2.0) — opt-in vulnerability checks against declared dependencies via OSV and ecosystem-native tools (pip-audit, npm audit, cargo audit, etc.), reported in a clearly separate [SEC] section so it never gets confused with setup results. Per-ecosystem install validation — lockfile consistency checks (npm ci, go mod verify, bundle check, etc.) beyond the current Python-only dry-run install. Monorepo support — detecting and reporting per-subdirectory package roots instead of assuming one root per repo. Private repository scanning in Slack — with secure, scoped, never-logged token handling, once a proper design pass is done.

Built With

• cli
• github-api
• mcp
• python
• railway
• slack-api
• slack-block-kit