Use before installing, updating, auditing, or executing dependencies, package-manager commands, project generators, CI actions/workflows, release jobs, IDE extensions, MCP servers, or AI-agent tools. Also use when investigating suspected compromise or advisories, debugging publish or release authentication, or…
Scan dependencies for known vulnerabilities using OSV, check provenance attestations, and find deprecated or yanked versions. Use when checking for CVEs, reviewing security posture, or investigating who introduced or fixed a vulnerable dependency.
Evaluate a package before adding it as a dependency. Checks registry metadata, adoption, maintenance, security posture, and license. Use when assessing whether a package is trustworthy, comparing alternatives, or reviewing a new dependency.
Interact with GitHub, GitLab, Gitea, Forgejo, Codeberg, Bitbucket, Gerrit, and Tangled repositories through one CLI. Use instead of gh or glab when the git remote is not github.com, when working against a self-hosted forge, or when the same workflow needs to run unchanged across forges. Covers pull/merge requests…