deptrust: a CLI that scans packages across languages for known vulnerabilities

deptrust is a command-line tool that checks whether the package versions a project depends on have known security vulnerabilities. It covers nearly every major package ecosystem: npm, PyPI, crates.io (Rust), Go modules, RubyGems, NuGet, Maven, Packagist (PHP), pub.dev (Dart), CocoaPods, Hex.pm, Hackage, and GitHub Actions.

It runs locally as a plain CLI, but it can also run as an MCP server, meaning an AI agent can call it directly to check for vulnerabilities as part of its workflow. It ships with a ready-made skill and a hook, making it easy to wire into automated coding pipelines.