DepGuard — Dependency Audit & License Compliance

DepGuard scans your project dependencies for known vulnerabilities, license violations, and outdated packages. It uses native package manager audit tools (npm audit, pip-audit, cargo-audit, etc.) and enriches results with license analysis and risk scoring.

Commands

Free Tier (No license required)

depguard scan [directory]

One-shot vulnerability and license scan of your project dependencies.

How to execute:
CODEBLOCK0

What it does:

1. 1. Detects package manager (npm, yarn, pnpm, pip, cargo, go, composer, bundler, maven, gradle)
2. Runs native audit commands (npm audit, pip-audit, cargo audit, etc.)
3. Parses dependency manifests for license information
4. Generates a security report with severity levels
5. Lists packages with problematic or unknown licenses

Example usage scenarios:

• - "Scan my dependencies for vulnerabilities" → runs INLINECODE1
• "Check the licenses of my node modules" → runs INLINECODE2
• "Are any of my packages insecure?" → runs INLINECODE3

depguard report [directory]

Generate a formatted dependency health report in markdown.

CODEBLOCK1

Pro Tier ($19/user/month — requires DEPGUARDLICENSEKEY)

depguard hooks install

Install git hooks that scan dependencies on every commit that modifies lockfiles.

CODEBLOCK2

What it does:

1. 1. Validates Pro+ license
2. Installs lefthook pre-commit hook targeting lockfile changes
3. On every commit that modifies package-lock.json, yarn.lock, Cargo.lock, etc.: runs vulnerability scan, blocks commit if critical/high vulns found

depguard hooks uninstall

Remove DepGuard git hooks.

CODEBLOCK3

depguard watch [directory]

Continuous monitoring — re-scans on any lockfile change.

CODEBLOCK4

depguard fix [directory]

Auto-fix vulnerabilities by upgrading to patched versions where available.

CODEBLOCK5

Team Tier ($39/user/month — requires DEPGUARDLICENSEKEY with team tier)

depguard policy [directory]

Enforce a dependency policy: block specific licenses, require minimum versions, deny specific packages.

CODEBLOCK6

depguard sbom [directory]

Generate a Software Bill of Materials (SBOM) in CycloneDX or SPDX format.

CODEBLOCK7

depguard compliance [directory]

Generate a compliance report for auditors — maps licenses to categories (permissive, copyleft, proprietary, unknown).

CODEBLOCK8

Supported Package Managers

Manager	Lockfile	Audit Tool
npm	package-lock.json	npm audit
yarn

yarn.lock | yarn audit | | pnpm | pnpm-lock.yaml | pnpm audit | | pip | requirements.txt / Pipfile.lock | pip-audit / safety | | cargo | Cargo.lock | cargo audit | | go | go.sum | govulncheck | | composer | composer.lock | composer audit | | bundler | Gemfile.lock | bundle audit | | maven | pom.xml | mvn dependency-check | | gradle | build.gradle | gradle dependencyCheck |

Configuration

Add to ~/.openclaw/openclaw.json:

CODEBLOCK9

Important Notes

• - Free tier works immediately — no configuration needed
• All scanning happens locally using native package manager audit tools
• License validation is offline — no phone-home
• Falls back to manifest parsing if native audit tools aren't available
• Supports monorepos — scans all workspaces/packages

When to Use DepGuard

The user might say things like:

• - "Scan my dependencies for vulnerabilities"
• "Check my package licenses"
• "Are any of my npm packages insecure?"
• "Generate a security audit report"
• "Set up dependency monitoring"
• "Block GPL dependencies in this project"
• "Generate an SBOM"
• "Check if we're compliant with our license policy"