Open source packages (deps.dev)

io.b3os/deps-dev 1.0.0 · developer-tools, security, open-source · MIT

Facts about open source packages from Google's Open Source Insights (deps.dev), no key needed: a package's versions and its default (latest) version, one version's licenses, security advisories, links and deprecation, its resolved dependency graph, a source repository's stars, license and OpenSSF Scorecard, and advisory details with CVSS scores. Covers npm, PyPI, Go, Maven, Cargo, NuGet and RubyGems.

Every call's result carries upstream_status and timing: validate_ms, inject_ms, render_ms, upstream_ms, map_ms and total_ms. upstream is the service's time; the others are B3OS's own (call actions). The snippets below show no timing values, because a fixture records none.

Connection

No credential: a keyless public API. Calls name no connection.

Hosts it reaches: api.deps.dev.

Actions

get-package

Get package. A package's default version (what installs by default, usually the latest stable) with its publish time, the number of versions, and the last versions of deps.dev's version list (it sorts ascending), so the newest come first in the output.

Ref io.b3os/deps-dev/get-package@1.0.0 · effect read · no connection · MCP tool deps-dev__get-package

bash
curl -s https://beta-api.b3os.org/v1/actions/call \  -H "Authorization: Bearer $B3OS_API_KEY" \  -H "Content-Type: application/json" \  -d '{      "ref": "io.b3os/deps-dev/get-package@1",      "input": {"system": "npm", "name": "left-pad", "limit": 3}    }'

ts
import { B3OS } from "@b3os/sdk";const b3os = new B3OS();const result = await b3os.actions.call({  ref: "io.b3os/deps-dev/get-package@1",  input: { system: "npm", name: "left-pad", limit: 3 },});console.log(result.output);

python
from b3os import B3OSb3os = B3OS()result = b3os.actions.call({    "ref": "io.b3os/deps-dev/get-package@1",    "input": {"system": "npm", "name": "left-pad", "limit": 3},})print(result["output"])

json
{  "method": "tools/call",  "params": {    "name": "deps-dev__get-package",    "arguments": {"system": "npm", "name": "left-pad", "limit": 3}  }}

Output, labeled fixture: Get package (response recorded 2026-10-26). From the bundle's fixtures/get-package.json, not a live call.

json
{  "system": "npm",  "name": "left-pad",  "version_count": 15,  "default_version": "1.3.0",  "default_published_at": "2018-04-09T01:10:45Z",  "versions": [    {      "version": "1.3.0",      "published_at": "2018-04-09T01:10:45Z",      "is_default": true,      "is_deprecated": true    },    {      "version": "1.2.0",      "published_at": "2017-11-17T05:48:38Z",      "is_default": false,      "is_deprecated": true    },    {      "version": "1.1.3",      "published_at": "2016-10-01T08:01:07Z",      "is_default": false,      "is_deprecated": true    }  ]}

When the service answers with an error, the call fails with upstream_error and pack_error.code is one of:

get-version

Get version. One package version: publish time, whether it is the default version, deprecation and its reason, licenses (SPDX), security advisory ids affecting it (look them up with get-advisory), homepage, source repository and the related project id for get-project.

Ref io.b3os/deps-dev/get-version@1.0.0 · effect read · no connection · MCP tool deps-dev__get-version

bash
curl -s https://beta-api.b3os.org/v1/actions/call \  -H "Authorization: Bearer $B3OS_API_KEY" \  -H "Content-Type: application/json" \  -d '{      "ref": "io.b3os/deps-dev/get-version@1",      "input": {"system": "npm", "name": "react", "version": "19.2.0"}    }'

ts
import { B3OS } from "@b3os/sdk";const b3os = new B3OS();const result = await b3os.actions.call({  ref: "io.b3os/deps-dev/get-version@1",  input: { system: "npm", name: "react", version: "19.2.0" },});console.log(result.output);

python
from b3os import B3OSb3os = B3OS()result = b3os.actions.call({    "ref": "io.b3os/deps-dev/get-version@1",    "input": {"system": "npm", "name": "react", "version": "19.2.0"},})print(result["output"])

json
{  "method": "tools/call",  "params": {    "name": "deps-dev__get-version",    "arguments": {"system": "npm", "name": "react", "version": "19.2.0"}  }}

Output, labeled fixture: Get version (response recorded 2026-10-26). From the bundle's fixtures/get-version.json, not a live call.

json
{  "system": "npm",  "name": "react",  "version": "19.2.0",  "published_at": "2025-10-01T21:38:32Z",  "is_default": false,  "is_deprecated": false,  "deprecated_reason": null,  "licenses": ["MIT"],  "advisories": [],  "homepage": "https://react.dev/",  "source_repo": "git+https://github.com/facebook/react.git",  "project": "github.com/facebook/react"}

When the service answers with an error, the call fails with upstream_error and pack_error.code is one of:

get-dependencies

Get dependencies. The resolved dependency graph of one package version as deps.dev computes it: every package it pulls in with the resolved version and whether it is a direct or an indirect dependency. Large packages can have hundreds of nodes.

Ref io.b3os/deps-dev/get-dependencies@1.0.0 · effect read · no connection · MCP tool deps-dev__get-dependencies

bash
curl -s https://beta-api.b3os.org/v1/actions/call \  -H "Authorization: Bearer $B3OS_API_KEY" \  -H "Content-Type: application/json" \  -d '{      "ref": "io.b3os/deps-dev/get-dependencies@1",      "input": {"system": "npm", "name": "express", "version": "4.21.2"}    }'

ts
import { B3OS } from "@b3os/sdk";const b3os = new B3OS();const result = await b3os.actions.call({  ref: "io.b3os/deps-dev/get-dependencies@1",  input: { system: "npm", name: "express", version: "4.21.2" },});console.log(result.output);

python
from b3os import B3OSb3os = B3OS()result = b3os.actions.call({    "ref": "io.b3os/deps-dev/get-dependencies@1",    "input": {"system": "npm", "name": "express", "version": "4.21.2"},})print(result["output"])

json
{  "method": "tools/call",  "params": {    "name": "deps-dev__get-dependencies",    "arguments": {"system": "npm", "name": "express", "version": "4.21.2"}  }}

Output, labeled fixture: Get dependencies (response recorded 2026-10-26). From the bundle's fixtures/get-dependencies.json, not a live call.

json
{  "direct": 3,  "indirect": 2,  "dependencies": [    {"name": "accepts", "version": "1.3.8", "relation": "DIRECT"},    {      "name": "array-flatten",      "version": "1.1.1",      "relation": "DIRECT"    },    {      "name": "async-function",      "version": "1.0.0",      "relation": "INDIRECT"    },    {      "name": "async-generator-function",      "version": "1.0.0",      "relation": "INDIRECT"    },    {"name": "body-parser", "version": "1.20.3", "relation": "DIRECT"}  ],  "error": null}

When the service answers with an error, the call fails with upstream_error and pack_error.code is one of:

get-project

Get project. A source repository's description, homepage, license, stars, forks and open issues, and its OpenSSF Scorecard: the overall score (0 to 10), the scan date and each check (Maintained, Code-Review, Vulnerabilities, ...) with its score and reason.

Ref io.b3os/deps-dev/get-project@1.0.0 · effect read · no connection · MCP tool deps-dev__get-project

bash
curl -s https://beta-api.b3os.org/v1/actions/call \  -H "Authorization: Bearer $B3OS_API_KEY" \  -H "Content-Type: application/json" \  -d '{      "ref": "io.b3os/deps-dev/get-project@1",      "input": {"project": "github.com/facebook/react"}    }'

ts
import { B3OS } from "@b3os/sdk";const b3os = new B3OS();const result = await b3os.actions.call({  ref: "io.b3os/deps-dev/get-project@1",  input: { project: "github.com/facebook/react" },});console.log(result.output);

python
from b3os import B3OSb3os = B3OS()result = b3os.actions.call({    "ref": "io.b3os/deps-dev/get-project@1",    "input": {"project": "github.com/facebook/react"},})print(result["output"])

json
{  "method": "tools/call",  "params": {    "name": "deps-dev__get-project",    "arguments": {"project": "github.com/facebook/react"}  }}

Output, labeled fixture: Get project (response recorded 2026-10-26). From the bundle's fixtures/get-project.json, not a live call.

json
{  "project": "github.com/facebook/react",  "description": "The library for web and native user interfaces.",  "homepage": "https://react.dev",  "license": "MIT",  "stars": 251612,  "forks": 51565,  "open_issues": 1464,  "scorecard_score": 7,  "scorecard_date": "2026-08-24T00:00:00Z",  "checks": [    {      "name": "Maintained",      "score": 10,      "reason": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10"    },    {      "name": "Code-Review",      "score": 10,      "reason": "all changesets reviewed"    },    {      "name": "CII-Best-Practices",      "score": 2,      "reason": "badge detected: InProgress"    }  ]}

When the service answers with an error, the call fails with upstream_error and pack_error.code is one of:

get-advisory

Get advisory. One security advisory by id (from get-version): title, aliases such as the CVE id, CVSS v3 score and vector, and its OSV page.

Ref io.b3os/deps-dev/get-advisory@1.0.0 · effect read · no connection · MCP tool deps-dev__get-advisory

bash
curl -s https://beta-api.b3os.org/v1/actions/call \  -H "Authorization: Bearer $B3OS_API_KEY" \  -H "Content-Type: application/json" \  -d '{      "ref": "io.b3os/deps-dev/get-advisory@1",      "input": {"id": "GHSA-2p57-rm9w-gvfp"}    }'

ts
import { B3OS } from "@b3os/sdk";const b3os = new B3OS();const result = await b3os.actions.call({  ref: "io.b3os/deps-dev/get-advisory@1",  input: { id: "GHSA-2p57-rm9w-gvfp" },});console.log(result.output);

python
from b3os import B3OSb3os = B3OS()result = b3os.actions.call({    "ref": "io.b3os/deps-dev/get-advisory@1",    "input": {"id": "GHSA-2p57-rm9w-gvfp"},})print(result["output"])

json
{  "method": "tools/call",  "params": {    "name": "deps-dev__get-advisory",    "arguments": {"id": "GHSA-2p57-rm9w-gvfp"}  }}

Output, labeled fixture: Get advisory (response recorded 2026-10-26). From the bundle's fixtures/get-advisory.json, not a live call.

json
{  "id": "GHSA-2p57-rm9w-gvfp",  "title": "ip SSRF improper categorization in isPublic",  "aliases": ["CVE-2024-29415"],  "cvss3_score": 8.1,  "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",  "url": "https://osv.dev/vulnerability/GHSA-2p57-rm9w-gvfp"}

When the service answers with an error, the call fails with upstream_error and pack_error.code is one of: