deps-doctor

May 16, 2026 · View on GitHub

hero

deps-doctor

One slash command. Four ecosystems. Knows when an audit tool is missing — and doesn't pretend otherwise.

License: MIT Python 3.8+ Claude Code Plugin Tests: 7 passing

TL;DR: /deps-doctor → unified vuln/outdated/license report across npm, pip, cargo, and go in one pass.

Writing

LinkedIn

Dev.to

Writing

Install (Claude Code)

git clone https://github.com/mturac/pluginpool-deps-doctor ~/.claude/plugins/deps-doctor

Restart Claude Code; the slash command /deps-doctor appears.

Writing

Quick start

/deps-doctor

Or directly:

python3 scripts/doctor.py --format md
python3 scripts/doctor.py --severity high --ecosystem npm,pip

Writing

Flags

FlagDefaultDescription
--formatjsonjson or md
--severityallMinimum severity: `low
--ecosystemall detectedComma-separated subset, e.g. npm,pip

Writing

Supported ecosystems

EcosystemAudit toolDetected by
npmnpm audit --jsonpackage.json
pippip-audit --format=jsonrequirements.txt / pyproject.toml
cargocargo audit --jsonCargo.toml
gogovulncheck -json ./...go.mod

Missing tools are reported as "status": "skipped: tool not installed", never as a clean pass.

Writing

Example output (markdown)

#### Writing

- ✍️ [**Dev.to · TuracTheThinker**](https://dev.to/turacthethinker) — Technical articles on AI, agentic systems, and production engineering
- 📄 [**LinkedIn Articles**](https://www.linkedin.com/in/mehmetturac/recent-activity/articles/) — Industry insights and analysis
- 📊 [**LinkedIn Documents**](https://www.linkedin.com/in/mehmetturac/recent-activity/documents/) — Research papers and technical documents

- 🗡️ [**Çift Yüzlü Katana: Yapay Zeka Dönüşümlerinin Gerçekçi Bir Analizi**](https://www.linkedin.com/pulse/%C3%A7ift-y%C3%BCzl%C3%BC-katana-yapay-zeka-d%C3%B6n%C3%BC%C5%9F%C3%BCmlerinin-ger%C3%A7ek%C3%A7i-bir-mehmet-turac-80h7f) — AI transformations realistic analysis. The 5 illusions that compound into expensive, fragile systems. (LinkedIn, 2026)


## deps-doctor report

### npm — 2 critical, 1 high
- **CVE-2024-XXXX** in `axios@0.21.1` → fixed in `0.21.4` (critical)
- **CVE-2024-YYYY** in `lodash@4.17.20` → fixed in `4.17.21` (high)

### pip — clean

### cargo — _skipped: cargo audit not installed_

### go — clean

Writing

How it works

  1. Scans the project root for marker files (package.json, Cargo.toml, …).
  2. Runs each ecosystem's audit tool via subprocess — no shell, no injection surface.
  3. Normalizes the JSON shapes from each tool into one schema.
  4. Aggregates by severity and renders.

Writing

Limitations

  • Network-only audits (registry lookups) inherit the speed of the underlying tool.
  • License auditing is a placeholder field (license_warnings: []) — populate via a future plugin.
  • Audit-tool installation is up to you; this plugin is glue, not an installer.

Writing

Examples

Step-by-step walkthroughs with real input fixtures and the helper's actual output live in examples/. Three or four scenarios per plugin — from the happy path to the edge cases the test suite guards.

Writing

Part of the pluginpool family

Ten focused Claude Code plugins for everyday productivity: commit-narrator · pr-storyteller · test-gap · deps-doctor · env-lint · secret-guard · standup-gen · todo-harvest · flaky-detector · changelog-forge

Writing

License

MIT — see LICENSE. Contributions welcome.