ericrihm/depfence
AI-aware dependency security scanner — CVE, behavioral, supply chain, EPSS, CISA KEV, and MCP scanning
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (default: current directory) | no | . |
| fail-on | Minimum severity to fail the check (critical, high, medium, low, any, none) | no | high |
| format | Output format (table, json, sarif) | no | sarif |
| scanners | Comma-separated scanners to skip (no-advisory, no-behavioral, no-reputation) | no | "" |
| upload-sarif | Upload SARIF to GitHub Code Scanning (requires security-events: write) | no | true |
| enrich-epss | Enrich findings with EPSS exploit probability scores | no | true |
| enrich-kev | Flag CISA Known Exploited Vulnerabilities | no | true |
| sbom | Generate CycloneDX SBOM alongside scan results | no | false |
| python-version | Python version to use | no | 3.12 |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings |
| critical-count | Number of critical findings |
| sarif-file | Path to SARIF output file |
| sbom-file | Path to CycloneDX SBOM file (if generated) |