DepWarden Plugins

Native packages for every build ecosystem. One plugin, one POST, one report. No source code leaves your network.

Available now

Maven (Java · Kotlin · Scala) — A native Maven Mojo that resolves your full dependency graph, sends only package coordinates to the DepWarden API, and writes reports to target/depwarden/. Install guide.

<plugin>
  <groupId>in.depwarden</groupId>
  <artifactId>depwarden-maven-plugin</artifactId>
  <version>1.0.0</version>
</plugin>

npm / yarn / pnpm (Node.js · JavaScript · TypeScript) — A zero-dependency CLI that reads your lockfile and streams results from the API. Install guide.

npm install --save-dev depwarden
npx depwarden scan

GitHub Actions (CI · CD · Pipelines) — A composite Action wrapping the npm CLI. Gate PRs on severity, upload report artifacts. Install guide.

- uses: depwarden/scan-action@v1
  with:
    api-key: ${{ secrets.DEPWARDEN_API_KEY }}
    fail-on: high

Coming soon

Gradle, Python (pip / Poetry / uv), .NET (dotnet tool + MSBuild), Go, Rust (cargo), PHP (Composer), Ruby, Dart / Flutter.

All plugins share the same API contract and conformance suite — once an ecosystem is supported, it gets the full feature set on day one.

Try paid features free

Set your API key to DEMO for three full-fidelity scans — all four report formats, build gating, transitive fix paths and SBOM export. No account or credit card needed.