Dependency Audit

Check npm or Python dependencies against their registries: latest version, deprecation and known vulnerabilities for each.

Pay by wallet (x402) dependency-audit

Example

Example answer

{
  "summary": {
    "total": 2,
    "errors": 0,
    "outdated": 2,
    "deprecated": 0,
    "up_to_date": 0
  },
  "ecosystem": "npm",
  "dependencies": [
    {
      "name": "express",
      "is_outdated": true,
      "is_deprecated": false,
      "last_published": "2025-12-01T20:49:43.268Z",
      "latest_version": "5.2.1",
      "current_version": "4.18.0",
      "is_dev_dependency": false
    },
    {
      "name": "lodash",
      "is_outdated": true,
      "is_deprecated": false,
      "last_published": "2026-01-21T17:29:52.831Z",
      "latest_version": "4.17.23",
      "current_version": "4.17.21",
      "is_dev_dependency": false
    }
  ],
  "outdated_count": 2,
  "critical_updates": [],
  "deprecated_count": 0,
  "total_dependencies": 2
}

Inputs

Field	Type	Required	What it is
`package_json`	string	No	package.json contents
`requirements_txt`	string	No	requirements.txt contents

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`summary`	object	Always (present in every successful answer)
`ecosystem`	string	Always (present in every successful answer)
`dependencies`	array	Always (present in every successful answer)
`outdated_count`	integer	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "dependency-audit",
    "inputs": {
      "package_json": "{\"name\": \"my-app\", \"version\": \"1.0.0\", \"dependencies\": {\"express\": \"^4.18.0\", \"lodash\": \"^4.17.21\"}}"
    },
    "max_price_cents": 5
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "dependency-audit",
    "inputs": {
      "package_json": "{\"name\": \"my-app\", \"version\": \"1.0.0\", \"dependencies\": {\"express\": \"^4.18.0\", \"lodash\": \"^4.17.21\"}}"
    },
    "max_price_cents": 5
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "dependency-audit",
  inputs: {
    "package_json": "{\"name\": \"my-app\", \"version\": \"1.0.0\", \"dependencies\": {\"express\": \"^4.18.0\", \"lodash\": \"^4.17.21\"}}"
  },
  max_price_cents: 5,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="dependency-audit",
    inputs={
        "package_json": "{\"name\": \"my-app\", \"version\": \"1.0.0\", \"dependencies\": {\"express\": \"^4.18.0\", \"lodash\": \"^4.17.21\"}}",
    },
    max_price_cents=5,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/dependency-audit?package_json=%7B%22name%22%3A+%22my-app%22%2C+%22version%22%3A+%221.0.0%22%2C+%22dependencies%22%3A+%7B%22express%22%3A+%22%5E4.18.0%22%2C+%22lodash%22%3A+%22%5E4.17.21%22%7D%7D'

Limitations

Transitive and runtime dependencies are not checked
AI-based audit of declared dependencies — cannot detect transitive vulnerability chains or runtime-only dependencies
What to do instead: Supplement with npm audit or pip-audit for vulnerability scanning that includes transitive dependencies

Bundled checks that include it

Pre-Merge Check €0.32
Repo Health Check €0.22