THE OPEN TOOLKIT / 7 TOOLS

Supply chain
A closer look.

Dependencies, lockfiles, software inventories, package registries, and artifact integrity. Review what goes into the software you ship.

Free to use. No account. Local reviews. Optional AI summaries.

THE TOOLKIT

Find the right check.

Search by task, technology, or file format.

Sort

Every tool explains its limits. Local reviews stay on your device; online lookups and optional AI explain what is sent.

requirements.txt

Review Python dependency pins, local hash declarations, package indexes, editable sources, and transport settings.

CycloneDX / SPDX JSON

Compare software inventories across builds. Find added or removed components and changes to license or digest metadata.

package.json / npm lockfile

Look beyond the version number. Review install scripts, dependency sources, version ranges, and lockfile integrity metadata.

npm lockfile v2 / v3

See what a dependency update really changed. Compare versions, download sources, integrity hashes, and installation hooks.

CycloneDX / SPDX JSON

Make your software inventory readable. Inspect components, versions, licenses, package identifiers, and missing metadata.

.npmrc

Catch the quiet configuration risks: insecure registries, disabled TLS checks, and credentials with overly broad scope.

Any file / text

Generate SHA-256, SHA-384, and SHA-512 integrity strings from a local file or text. Keep the bytes in your browser.