> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beta.b3os.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Open source packages (deps.dev)

The io.b3os/deps-dev pack: 5 actions with call snippets, fixture outputs, connection setup and error codes, generated from version 1.0.0.

`io.b3os/deps-dev` 1.0.0 · `developer-tools`, `security`, `open-source` · MIT

Facts about open source packages from Google's Open Source Insights (deps.dev), no key needed: a package's versions and its default (latest) version, one version's licenses, security advisories, links and deprecation, its resolved dependency graph, a source repository's stars, license and OpenSSF Scorecard, and advisory details with CVSS scores. Covers npm, PyPI, Go, Maven, Cargo, NuGet and RubyGems.

Every call's result carries `upstream_status` and `timing`: `validate_ms`, `inject_ms`, `render_ms`, `upstream_ms`, `map_ms` and `total_ms`. `upstream` is the service's time; the others are B3OS's own ([call actions](/actions/call)). The snippets below show no timing values, because a fixture records none.

## Connection

No credential: a keyless public API. Calls name no connection.

Hosts it reaches: `api.deps.dev`.

## Actions

| Action | Effect | MCP tool | Title |
|---|---|---|---|
| [`get-package`](/actions/catalog/deps-dev#deps-dev-get-package) | read | `deps-dev__get-package` | Get package |
| [`get-version`](/actions/catalog/deps-dev#deps-dev-get-version) | read | `deps-dev__get-version` | Get version |
| [`get-dependencies`](/actions/catalog/deps-dev#deps-dev-get-dependencies) | read | `deps-dev__get-dependencies` | Get dependencies |
| [`get-project`](/actions/catalog/deps-dev#deps-dev-get-project) | read | `deps-dev__get-project` | Get project |
| [`get-advisory`](/actions/catalog/deps-dev#deps-dev-get-advisory) | read | `deps-dev__get-advisory` | Get advisory |

get-package

**Get package.** A package's default version (what installs by default, usually the latest stable) with its publish time, the number of versions, and the last versions of deps.dev's version list (it sorts ascending), so the newest come first in the output.

Ref `io.b3os/deps-dev/get-package@1.0.0` · effect `read` · no connection · MCP tool `deps-dev__get-package`

**curl**

```bash
    curl -s https://beta-api.b3os.org/v1/actions/call \
      -H "Authorization: Bearer $B3OS_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
          "ref": "io.b3os/deps-dev/get-package@1",
          "input": {"system": "npm", "name": "left-pad", "limit": 3}
        }'
    ```
  **TypeScript**

```ts
    import { B3OS } from "@b3os/sdk";

    const b3os = new B3OS();
    const result = await b3os.actions.call({
      ref: "io.b3os/deps-dev/get-package@1",
      input: { system: "npm", name: "left-pad", limit: 3 },
    });
    console.log(result.output);
    ```
  **Python**

```python
    from b3os import B3OS

    b3os = B3OS()
    result = b3os.actions.call({
        "ref": "io.b3os/deps-dev/get-package@1",
        "input": {"system": "npm", "name": "left-pad", "limit": 3},
    })
    print(result["output"])
    ```
  **MCP**

```json
    {
      "method": "tools/call",
      "params": {
        "name": "deps-dev__get-package",
        "arguments": {"system": "npm", "name": "left-pad", "limit": 3}
      }
    }
    ```

    Expose the pack as tools with `--packs deps-dev` on the local server or `?packs=deps-dev` on the remote URL, and the agent calls `deps-dev__get-package` with the action's input. The tool needs no connection. Without exposing the pack, `actions_call` takes the same input with `ref`.

Output, labeled `fixture`: Get package (response recorded 2026-10-26). From the bundle's `fixtures/get-package.json`, not a live call.

```json
{
  "system": "npm",
  "name": "left-pad",
  "version_count": 15,
  "default_version": "1.3.0",
  "default_published_at": "2018-04-09T01:10:45Z",
  "versions": [
    {
      "version": "1.3.0",
      "published_at": "2018-04-09T01:10:45Z",
      "is_default": true,
      "is_deprecated": true
    },
    {
      "version": "1.2.0",
      "published_at": "2017-11-17T05:48:38Z",
      "is_default": false,
      "is_deprecated": true
    },
    {
      "version": "1.1.3",
      "published_at": "2016-10-01T08:01:07Z",
      "is_default": false,
      "is_deprecated": true
    }
  ]
}
```

When the service answers with an error, the call fails with [`upstream_error`](/errors#upstream_error) and `pack_error.code` is one of:

| `pack_error.code` | Service status | Retryable | Message |
|---|---|---|---|
| `not_found` | 404 | no | deps.dev has no such package, version, project or advisory. |
| `rate_limited` | 429 | yes | deps.dev is rate limiting this address; retry shortly. |

get-version

**Get version.** One package version: publish time, whether it is the default version, deprecation and its reason, licenses (SPDX), security advisory ids affecting it (look them up with get-advisory), homepage, source repository and the related project id for get-project.

Ref `io.b3os/deps-dev/get-version@1.0.0` · effect `read` · no connection · MCP tool `deps-dev__get-version`

**curl**

```bash
    curl -s https://beta-api.b3os.org/v1/actions/call \
      -H "Authorization: Bearer $B3OS_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
          "ref": "io.b3os/deps-dev/get-version@1",
          "input": {"system": "npm", "name": "react", "version": "19.2.0"}
        }'
    ```
  **TypeScript**

```ts
    import { B3OS } from "@b3os/sdk";

    const b3os = new B3OS();
    const result = await b3os.actions.call({
      ref: "io.b3os/deps-dev/get-version@1",
      input: { system: "npm", name: "react", version: "19.2.0" },
    });
    console.log(result.output);
    ```
  **Python**

```python
    from b3os import B3OS

    b3os = B3OS()
    result = b3os.actions.call({
        "ref": "io.b3os/deps-dev/get-version@1",
        "input": {"system": "npm", "name": "react", "version": "19.2.0"},
    })
    print(result["output"])
    ```
  **MCP**

```json
    {
      "method": "tools/call",
      "params": {
        "name": "deps-dev__get-version",
        "arguments": {"system": "npm", "name": "react", "version": "19.2.0"}
      }
    }
    ```

    Expose the pack as tools with `--packs deps-dev` on the local server or `?packs=deps-dev` on the remote URL, and the agent calls `deps-dev__get-version` with the action's input. The tool needs no connection. Without exposing the pack, `actions_call` takes the same input with `ref`.

Output, labeled `fixture`: Get version (response recorded 2026-10-26). From the bundle's `fixtures/get-version.json`, not a live call.

```json
{
  "system": "npm",
  "name": "react",
  "version": "19.2.0",
  "published_at": "2025-10-01T21:38:32Z",
  "is_default": false,
  "is_deprecated": false,
  "deprecated_reason": null,
  "licenses": ["MIT"],
  "advisories": [],
  "homepage": "https://react.dev/",
  "source_repo": "git+https://github.com/facebook/react.git",
  "project": "github.com/facebook/react"
}
```

When the service answers with an error, the call fails with [`upstream_error`](/errors#upstream_error) and `pack_error.code` is one of:

| `pack_error.code` | Service status | Retryable | Message |
|---|---|---|---|
| `not_found` | 404 | no | deps.dev has no such package, version, project or advisory. |
| `rate_limited` | 429 | yes | deps.dev is rate limiting this address; retry shortly. |

get-dependencies

**Get dependencies.** The resolved dependency graph of one package version as deps.dev computes it: every package it pulls in with the resolved version and whether it is a direct or an indirect dependency. Large packages can have hundreds of nodes.

Ref `io.b3os/deps-dev/get-dependencies@1.0.0` · effect `read` · no connection · MCP tool `deps-dev__get-dependencies`

**curl**

```bash
    curl -s https://beta-api.b3os.org/v1/actions/call \
      -H "Authorization: Bearer $B3OS_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
          "ref": "io.b3os/deps-dev/get-dependencies@1",
          "input": {"system": "npm", "name": "express", "version": "4.21.2"}
        }'
    ```
  **TypeScript**

```ts
    import { B3OS } from "@b3os/sdk";

    const b3os = new B3OS();
    const result = await b3os.actions.call({
      ref: "io.b3os/deps-dev/get-dependencies@1",
      input: { system: "npm", name: "express", version: "4.21.2" },
    });
    console.log(result.output);
    ```
  **Python**

```python
    from b3os import B3OS

    b3os = B3OS()
    result = b3os.actions.call({
        "ref": "io.b3os/deps-dev/get-dependencies@1",
        "input": {"system": "npm", "name": "express", "version": "4.21.2"},
    })
    print(result["output"])
    ```
  **MCP**

```json
    {
      "method": "tools/call",
      "params": {
        "name": "deps-dev__get-dependencies",
        "arguments": {"system": "npm", "name": "express", "version": "4.21.2"}
      }
    }
    ```

    Expose the pack as tools with `--packs deps-dev` on the local server or `?packs=deps-dev` on the remote URL, and the agent calls `deps-dev__get-dependencies` with the action's input. The tool needs no connection. Without exposing the pack, `actions_call` takes the same input with `ref`.

Output, labeled `fixture`: Get dependencies (response recorded 2026-10-26). From the bundle's `fixtures/get-dependencies.json`, not a live call.

```json
{
  "direct": 3,
  "indirect": 2,
  "dependencies": [
    {"name": "accepts", "version": "1.3.8", "relation": "DIRECT"},
    {
      "name": "array-flatten",
      "version": "1.1.1",
      "relation": "DIRECT"
    },
    {
      "name": "async-function",
      "version": "1.0.0",
      "relation": "INDIRECT"
    },
    {
      "name": "async-generator-function",
      "version": "1.0.0",
      "relation": "INDIRECT"
    },
    {"name": "body-parser", "version": "1.20.3", "relation": "DIRECT"}
  ],
  "error": null
}
```

When the service answers with an error, the call fails with [`upstream_error`](/errors#upstream_error) and `pack_error.code` is one of:

| `pack_error.code` | Service status | Retryable | Message |
|---|---|---|---|
| `not_found` | 404 | no | deps.dev has no such package, version, project or advisory. |
| `rate_limited` | 429 | yes | deps.dev is rate limiting this address; retry shortly. |

get-project

**Get project.** A source repository's description, homepage, license, stars, forks and open issues, and its OpenSSF Scorecard: the overall score (0 to 10), the scan date and each check (Maintained, Code-Review, Vulnerabilities, ...) with its score and reason.

Ref `io.b3os/deps-dev/get-project@1.0.0` · effect `read` · no connection · MCP tool `deps-dev__get-project`

**curl**

```bash
    curl -s https://beta-api.b3os.org/v1/actions/call \
      -H "Authorization: Bearer $B3OS_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
          "ref": "io.b3os/deps-dev/get-project@1",
          "input": {"project": "github.com/facebook/react"}
        }'
    ```
  **TypeScript**

```ts
    import { B3OS } from "@b3os/sdk";

    const b3os = new B3OS();
    const result = await b3os.actions.call({
      ref: "io.b3os/deps-dev/get-project@1",
      input: { project: "github.com/facebook/react" },
    });
    console.log(result.output);
    ```
  **Python**

```python
    from b3os import B3OS

    b3os = B3OS()
    result = b3os.actions.call({
        "ref": "io.b3os/deps-dev/get-project@1",
        "input": {"project": "github.com/facebook/react"},
    })
    print(result["output"])
    ```
  **MCP**

```json
    {
      "method": "tools/call",
      "params": {
        "name": "deps-dev__get-project",
        "arguments": {"project": "github.com/facebook/react"}
      }
    }
    ```

    Expose the pack as tools with `--packs deps-dev` on the local server or `?packs=deps-dev` on the remote URL, and the agent calls `deps-dev__get-project` with the action's input. The tool needs no connection. Without exposing the pack, `actions_call` takes the same input with `ref`.

Output, labeled `fixture`: Get project (response recorded 2026-10-26). From the bundle's `fixtures/get-project.json`, not a live call.

```json
{
  "project": "github.com/facebook/react",
  "description": "The library for web and native user interfaces.",
  "homepage": "https://react.dev",
  "license": "MIT",
  "stars": 251612,
  "forks": 51565,
  "open_issues": 1464,
  "scorecard_score": 7,
  "scorecard_date": "2026-08-24T00:00:00Z",
  "checks": [
    {
      "name": "Maintained",
      "score": 10,
      "reason": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10"
    },
    {
      "name": "Code-Review",
      "score": 10,
      "reason": "all changesets reviewed"
    },
    {
      "name": "CII-Best-Practices",
      "score": 2,
      "reason": "badge detected: InProgress"
    }
  ]
}
```

When the service answers with an error, the call fails with [`upstream_error`](/errors#upstream_error) and `pack_error.code` is one of:

| `pack_error.code` | Service status | Retryable | Message |
|---|---|---|---|
| `not_found` | 404 | no | deps.dev has no such package, version, project or advisory. |
| `rate_limited` | 429 | yes | deps.dev is rate limiting this address; retry shortly. |

get-advisory

**Get advisory.** One security advisory by id (from get-version): title, aliases such as the CVE id, CVSS v3 score and vector, and its OSV page.

Ref `io.b3os/deps-dev/get-advisory@1.0.0` · effect `read` · no connection · MCP tool `deps-dev__get-advisory`

**curl**

```bash
    curl -s https://beta-api.b3os.org/v1/actions/call \
      -H "Authorization: Bearer $B3OS_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
          "ref": "io.b3os/deps-dev/get-advisory@1",
          "input": {"id": "GHSA-2p57-rm9w-gvfp"}
        }'
    ```
  **TypeScript**

```ts
    import { B3OS } from "@b3os/sdk";

    const b3os = new B3OS();
    const result = await b3os.actions.call({
      ref: "io.b3os/deps-dev/get-advisory@1",
      input: { id: "GHSA-2p57-rm9w-gvfp" },
    });
    console.log(result.output);
    ```
  **Python**

```python
    from b3os import B3OS

    b3os = B3OS()
    result = b3os.actions.call({
        "ref": "io.b3os/deps-dev/get-advisory@1",
        "input": {"id": "GHSA-2p57-rm9w-gvfp"},
    })
    print(result["output"])
    ```
  **MCP**

```json
    {
      "method": "tools/call",
      "params": {
        "name": "deps-dev__get-advisory",
        "arguments": {"id": "GHSA-2p57-rm9w-gvfp"}
      }
    }
    ```

    Expose the pack as tools with `--packs deps-dev` on the local server or `?packs=deps-dev` on the remote URL, and the agent calls `deps-dev__get-advisory` with the action's input. The tool needs no connection. Without exposing the pack, `actions_call` takes the same input with `ref`.

Output, labeled `fixture`: Get advisory (response recorded 2026-10-26). From the bundle's `fixtures/get-advisory.json`, not a live call.

```json
{
  "id": "GHSA-2p57-rm9w-gvfp",
  "title": "ip SSRF improper categorization in isPublic",
  "aliases": ["CVE-2024-29415"],
  "cvss3_score": 8.1,
  "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "url": "https://osv.dev/vulnerability/GHSA-2p57-rm9w-gvfp"
}
```

When the service answers with an error, the call fails with [`upstream_error`](/errors#upstream_error) and `pack_error.code` is one of:

| `pack_error.code` | Service status | Retryable | Message |
|---|---|---|---|
| `not_found` | 404 | no | deps.dev has no such package, version, project or advisory. |
| `rate_limited` | 429 | yes | deps.dev is rate limiting this address; retry shortly. |