DepWarden Plugins

Native packages for every build ecosystem. One plugin, one POST, one report. No source code leaves your network.

Available now

Maven (Java · Kotlin · Scala) — *Publishing to Maven Central now; coordinates below are final, but the artifact isn't fetchable yet.* A native Maven Mojo that resolves your full dependency graph, sends only package coordinates to the DepWarden API, and writes reports to target/sca-reports/. Install guide.

<plugin>
  <groupId>io.github.rushabh5000</groupId>
  <artifactId>sca-maven-plugin</artifactId>
  <version>1.0.5</version>
</plugin>

npm / yarn / pnpm (Node.js · JavaScript · TypeScript) — A zero-dependency CLI that reads your lockfile and streams results from the API. Install guide.

npm install --save-dev @lowdep/depwarden
npx @lowdep/depwarden

Python (pip · Poetry · Pipenv · uv) — A zero-dependency CLI (Python standard library only) that reads requirements.txt, poetry.lock, Pipfile.lock or uv.lock and streams results from the API. Install guide.

pip install depwarden-cli
depwarden

GitHub Actions (CI · CD · Pipelines) — A composite Action running SCA and SAST as separate, independent steps. Gate PRs on severity, no API key required for anonymous SCA. Install guide.

- uses: Rushabh5000/depwarden-action@v1
  with:
    file: package-lock.json
    fail-on: high
  env:
    APP_API_KEY: ${{ secrets.APP_API_KEY }}

GitLab CI · Jenkins · CircleCI · Azure Pipelines (CI · CD · Pipelines) — No dedicated marketplace package for these — the same @lowdep/depwarden CLI that powers the GitHub Action runs as a plain build step anywhere Node is available. Install guide.

npx @lowdep/depwarden --fail-on-error true

Coming soon

Gradle, .NET (dotnet tool + MSBuild), Go, Rust (cargo), PHP (Composer), Ruby, Dart / Flutter.

All plugins share the same API contract and conformance suite — once an ecosystem is supported, it gets the full feature set on day one.

Try paid features free

Set your API key to DEMO for three full-fidelity scans — all four report formats, build gating, transitive fix paths and SBOM export. No account or credit card needed.