Score your project's dependency health before supply-chain risk scores you.

dephealth scans your Python project's dependency tree and produces a rich terminal report (or CI-compatible JSON) with per-dependency health scores covering maintenance activity, security posture, community signals, and license compatibility.

pip's CVE-2025-8869 (path traversal, 90-day exposure window) highlighted that developers have no quick way to assess the health of their dependency tree. Existing tools check for known CVEs but don't evaluate maintenance status, bus factor, or license risk holistically. Teams discover abandoned or risky dependencies only after incidents.

dephealth fills this gap with a single command.

pip install dephealth

# Scan current project (auto-detects requirements.txt, pyproject.toml, or Pipfile)
dephealth scan

# Scan a specific requirements file
dephealth scan -r requirements.txt

# Fail CI if any dependency scores below grade C
dephealth scan --min-grade C

# Machine-readable JSON output
dephealth scan --format json

# Generate an HTML report
dephealth report --html report.html

Each dependency receives scores in four categories, combined into a composite A-F grade:

Scan dependencies and display health scores.

Generate an HTML report.

Create a .dephealth.toml in your project root to customize scoring weights and behavior:

cache_ttl_hours = 24
min_grade = "C"
github_token = ""  # Optional: for higher GitHub API rate limits

[weights]
maintenance = 0.35
security = 0.30
popularity = 0.15
license = 0.20

• requirements.txt (including extras, version specifiers)
• pyproject.toml (PEP 621 [project.dependencies])
• Pipfile ([packages] section)

Auto-detection priority: requirements.txt > pyproject.toml > Pipfile

- uses: actions/setup-python@v5
  with:
    python-version: '3.12'
- run: pip install dephealth
- run: dephealth scan --min-grade C --format json

dephealth exits with code 1 when any dependency falls below the minimum grade threshold, making it easy to gate CI pipelines.

• PyPI JSON API — Package metadata, release history, maintainer info
• GitHub REST API — Repository stats, commit activity, contributor count
• OSV Database — Known vulnerabilities for PyPI packages

API responses are cached locally in SQLite (~/.cache/dephealth/cache.db) for 24 hours by default to minimize rate limiting.

1. Clone the repository
2. Install dependencies: uv sync
3. Run tests: uv run pytest
4. Lint: uv run ruff check .
5. Format: uv run ruff format .

uv run pytest                    # Run tests
uv run pytest --cov              # Run with coverage
uv run ruff check .              # Lint
uv run ruff format .             # Format
uv run dephealth scan            # Run the tool locally

MIT License. See LICENSE for details.