depsight

GitHub-connected security dashboard: CVEs, licenses, and dependency health, self-hosted.

Live demo: depsight.opentriologue.ai. Sign in with a GitHub account. The password-less Dev Login exists only in a development build (make dev, see Quick start).

Overview

Dependency trees rot quietly: a CVE disclosed against a dependency installed six months ago will not surface until something fails, or until a customer asks. depsight runs continuous CVE, license, and staleness scanning across every repository a team owns, so the answer to "are we shipping known-vulnerable code right now?" is a dashboard view rather than an afternoon of manual audits, across npm, Python, Go, Java, Rust, and PHP (license detection does not cover Go). depsight reads the Dependabot alerts GitHub has raised for a repository and supplements them with an OSV query over the dependencies declared in its manifests; a package installed only transitively shows up only once GitHub has raised a Dependabot alert for it, so a 0-advisory scan does not rule out a vulnerable transitive dependency (see Known limitations).

For the broader operational picture beyond security, see agent-ops-dashboard, which complements depsight with a fleet-wide repo-health view.

Key features

• Per-repo CVE scanning: severity breakdown, risk scores, vulnerability timeline.
• License detection and copyleft/policy-driven compliance checking.
• Dependency age tracking, outdated alerts, and Dependabot status, with bulk-enable across repos.
• PR comments listing the open Dependabot alerts that were not in the repository's latest completed CVE scan (see docs/configuration.md).
• Slack and webhook alerts.
• SBOM export (CycloneDX 1.4).
• A policy engine for custom CVE, license and dependency rules.
• An MCP server for agent access (Claude and other MCP-capable clients).

Full feature list, including known limitations, in docs/features.md.

Quick start

Prerequisites: Docker Engine 25 or later and Docker Compose 2.24 or later. The minimums come from the shipped compose files: the healthcheck start_interval needs Engine 25, the env_file entry with required: false needs Compose 2.24, and building the schema-migrate image needs BuildKit (the Docker buildx plugin, Docker Engine 23 or later). docs/configuration.md covers the healthcheck (Health check, resource limits and log rotation) and the migrate image build (Production).

git clone https://github.com/LanNguyenSi/depsight.git
cd depsight
make dev          # docker compose up: app + Postgres, pushes the DB schema, starts dev server

Open http://localhost:3000 and click Dev Login. No GitHub OAuth credentials needed for a first look. Add GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET to .env to connect real repos. See docs/configuration.md for env vars and Make targets, and Self-hosting for a production deployment (docker-compose.yml; docker-compose.traefik.yml is the hosted instance's file, see Which compose file).

Usage

Trigger a CVE scan for a tracked repository over the REST API:

curl -X POST http://localhost:3000/api/scan \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"repoId": "<repo-id>"}'

Create an API token on the Settings page (or via POST /api/tokens from a signed-in session); triggering scans needs the WRITE scope (the Settings form preselects READ; POST /api/tokens without a scope creates a WRITE token). The dashboard UI covers the same actions without a token. Endpoint reference in docs/api.md.

Documentation

Doc	Description
docs/configuration.md	Env vars, Make targets, GitHub OAuth, self-hosting, database backup and restore, how CI Health syncs GitHub Actions data
docs/rollback.md	What a relay rollback does not undo (the database schema), safe schema changes, recovery runbook
docs/api.md	REST API reference
docs/architecture.md	Architecture: Next.js App Router, Prisma, project layout
docs/features.md	Full feature list and known limitations
docs/roadmap.md	Planned work
docs/ways-of-working.md	Git workflow, deployment, code review checklist
mcp/README.md	MCP server for agent access
CHANGELOG.md	Release notes

Development

npm install
npx prisma generate   # required before build on a fresh clone
npm run build
npm test              # vitest
npm run lint          # eslint

See CONTRIBUTING.md for the full PR workflow, the checks CI runs, and the Docker Compose dev setup.

License

MIT.

---

Generated with ScaffoldKit.