Dependency Risk Check

Complete security and license risk assessment for any npm or PyPI package. Combines CVE scanning (OSV.dev), OpenSSF Scorecard analysis, freshness check, and license compatibility verification into one call.

2 steps dependency-risk-check

What it runs

Package Security Audit
Source: OSV.dev + deps.dev + npm Registry + PyPI
Licence Compatibility Check
Source: SPDX License List

The answer returns every step’s result, so your agent can show or check each one.

Inputs

Field	Type	Required	What it is
`name`	string	Yes	Package name (e.g. 'express', 'requests')
`version`	string	No	Version to audit (optional — defaults to latest)
`use_case`	one of commercial, open-source, saas, internal	No	How the software will be used (for license check). Default: commercial
`ecosystem`	one of npm, pypi	No	Package ecosystem (optional — auto-detected)

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/dependency-risk-check/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "name": "express",
      "version": "4.18.2",
      "use_case": "commercial"
    },
    "max_price_cents": 25
  }'

The bundle’s published example input.

Limitations

If OSV.dev is down, vulnerability data returns null but other signals still produce a risk score.
From step: Package Security Audit
PyPI does not expose per-version publisher data in the registry API, so publisher_changed is null for PyPI packages.
From step: Package Security Audit
If deps.dev is unavailable or the package is not indexed, provenance attestation fields return null.
From step: Package Security Audit
Unknown SPDX identifiers are flagged as 'unknown' and treated conservatively.
From step: Licence Compatibility Check