DepVet

What it is

DepVet checks a software dependency before a developer adds it to a project.

You paste a GitHub repo link or a package name. DepVet returns a short risk brief with a clear verdict: adopt, caution, or avoid.

The brief covers security history, maintenance health, licence, and recent incidents. Every factual claim has a source. When sources conflict, DepVet marks the conflict and leaves it visible.

Why it exists

Package pages make adoption look simple. They show downloads, stars, and a short description. They do not give a clear answer on trust.

The facts that matter sit in many places. Advisories sit in one place. Release history sits in another. Licence records, project notices, incident reports, and repo activity sit somewhere else. A developer has to open tab after tab and still may miss the one fact that changes the call.

Recent supply chain attacks made the cost plain. A bad dependency can bring old code, weak upkeep, licence risk, or a past compromise into a new project. Small teams and solo developers often have no security staff to run this check.

DepVet puts the check in one place and keeps the proof attached.

How it works

1. You enter a GitHub repo link or a package name.
2. DepVet resolves the input to one exact project and package record.
3. It pulls records from the registry, the repo, and public advisory data.
4. Tavily searches the live web for incident reports, project notices, and recent changes that the base records miss.
5. NVIDIA Nemotron models, served through Nebius Token Factory, extract claims from the evidence and sort them under security, maintenance, licence, and incidents.
6. A second pass checks for conflicts between sources. It also checks that each claim in the brief has a source.
7. DepVet writes the brief with the verdict first, then the reasons, the conflicts, and the full source list.

If a source fails or a fact cannot be checked, the brief says so. It does not fill the gap.

DepVet does not scan your own code. It checks the dependency before it enters your code.

Models used

• Extraction and claim sorting: NVIDIA Nemotron 3 Nano 30B (nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B) on Nebius Token Factory
• Synthesis, conflict check, and verdict: NVIDIA Nemotron 3 Ultra 550B (nvidia/Nemotron-3-Ultra-550b-a55b) on Nebius Token Factory

Built With

• github
• nebius-token-factory
• npm-registry-records
• nvidia-nemotron-models
• osv.dev
• pypi-records
• tavily-extract
• tavily-search