One slash command. Four ecosystems. Knows when an audit tool is missing — and doesn't pretend otherwise.
TL;DR:
/deps-doctor→ unified vuln/outdated/license report across npm, pip, cargo, and go in one pass.
Polyglot repos make dependency hygiene awkward — you end up with three different reports in three different terminals, and you forget which one was for staging. deps-doctor detects which ecosystems are present, shells out to the audit tools you actually have installed, and emits one consistent report. Missing tool? It says "skipped: tool not installed" — never silently green.
git clone https://github.com/mturac/pluginpool-deps-doctor ~/.claude/plugins/deps-doctorRestart Claude Code; the slash command /deps-doctor appears.
/deps-doctorOr directly:
python3 scripts/doctor.py --format md
python3 scripts/doctor.py --severity high --ecosystem npm,pip| Flag | Default | Description |
|---|---|---|
--format |
json |
json or md |
--severity |
all | Minimum severity: `low |
--ecosystem |
all detected | Comma-separated subset, e.g. npm,pip |
| Ecosystem | Audit tool | Detected by |
|---|---|---|
| npm | npm audit --json |
package.json |
| pip | pip-audit --format=json |
requirements.txt / pyproject.toml |
| cargo | cargo audit --json |
Cargo.toml |
| go | govulncheck -json ./... |
go.mod |
Missing tools are reported as "status": "skipped: tool not installed", never as a clean pass.
## deps-doctor report
### npm — 2 critical, 1 high
- **CVE-2024-XXXX** in `axios@0.21.1` → fixed in `0.21.4` (critical)
- **CVE-2024-YYYY** in `lodash@4.17.20` → fixed in `4.17.21` (high)
### pip — clean
### cargo — _skipped: cargo audit not installed_
### go — clean
- Scans the project root for marker files (
package.json,Cargo.toml, …). - Runs each ecosystem's audit tool via
subprocess— no shell, no injection surface. - Normalizes the JSON shapes from each tool into one schema.
- Aggregates by severity and renders.
- Network-only audits (registry lookups) inherit the speed of the underlying tool.
- License auditing is a placeholder field (
license_warnings: []) — populate via a future plugin. - Audit-tool installation is up to you; this plugin is glue, not an installer.
Step-by-step walkthroughs with real input fixtures and the helper's actual output live in examples/. Three or four scenarios per plugin — from the happy path to the edge cases the test suite guards.
Ten focused Claude Code plugins for everyday productivity: commit-narrator · pr-storyteller · test-gap · deps-doctor · env-lint · secret-guard · standup-gen · todo-harvest · flaky-detector · changelog-forge
MIT — see LICENSE. Contributions welcome.