# Dependency Vulnerability Explorer

> Known vulnerabilities in your dependencies, and the version that fixes each one. Reads npm (package.json, package-lock.json), Python (requirements.txt), Go (go.mod), Rust (Cargo.lock) and PHP (composer.lock) manifests, or lines like npm:lodash@4.17.20, and checks every exact package version against OSV.dev, the open vulnerability database that aggregates GitHub Security Advisories, PyPA, RustSec, Go and more. For each finding: severity, aliases (CVE/GHSA), and the nearest fixed version. You can also look up a single advisory ID.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://dependencyvulnerabilityexplorer.usefulweb.site/ (interactive tool at https://dependencyvulnerabilityexplorer.usefulweb.site/tool)
- JSON API: POST https://dependencyvulnerabilityexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://dependencyvulnerabilityexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://dependencyvulnerabilityexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://dependencyvulnerabilityexplorer.usefulweb.site/mcp - tool `dependency_vulnerability_explorer`

## Inputs
- manifest (textarea): Manifest, lockfile or package list
- vulnId (text): Or: look up one advisory ID

## Method
- Exact versions come from lockfiles and == pins; for version ranges (^1.2.0, >=2.0) the lower bound is checked and the package is marked exact=false.
- Each package@version is sent to the OSV.dev querybatch API; details for up to 60 distinct advisories are fetched from /v1/vulns/{id}.
- Severity is the advisory database rating (GHSA: LOW/MODERATE/HIGH/CRITICAL); the CVSS vector is shown when published. fixedIn = the lowest fixed release above your version for that package; upgradeTo = the highest of those across a package's advisories.
- Advisories are matched by OSV's version ranges; withdrawn advisories are not returned by OSV.