git-pkgs tracks package dependencies across your repository's git history. It answers questions like "who added this dependency?", "when was it introduced?", and "how long were we exposed to this vulnerability?" Works with 35+ package managers.

Install it with:

brew tap git-pkgs/git-pkgs
brew install git-pkgs

Or download a binary from the releases page.

Or build from source:

go install github.com/git-pkgs/git-pkgs@latest

• brief - Detect a project's toolchain, configuration, and conventions
• capcheck - Fail CI when Go code or dependencies gain new privileged operations
• outline - Reduce a source tree to a structural skeleton for LLM context
• pin - Vendor browser assets without npm
• proxy - Lightweight caching proxy for package registries

• archives - Reading and browsing archive files in memory
• attestation - Parsing SLSA provenance v1 attestation bundles
• changelog - Parsing changelog files into structured entries
• cooldown - Filtering package versions by minimum age across ecosystems
• enrichment - Fetching package metadata from multiple sources
• forge - Fetching repository metadata from git forges
• gitignore - Matching paths against gitignore rules
• managers - Wrapping package manager CLIs behind a common interface
• manifests - Parsing package manager manifest and lockfiles
• markup - Rendering markup files to HTML
• platforms - Translating platform identifiers across package ecosystems
• pom - Resolving effective POMs for Maven artifacts
• purl - Package URL construction, parsing, and registry URL mapping
• registries - Fetching package metadata from registry APIs
• resolve - Parsing package manager resolve output into dependency trees
• reuse - Extracting SPDX license and copyright data from REUSE-compliant projects
• sbom - Reading and writing Software Bill of Materials documents
• sigstore - Verifying attestation bundles against the Sigstore TUF trust root
• spdx - SPDX license expression parsing, normalization, and validation
• vers - Version range parsing and comparison per the VERS spec
• vulns - Fetching vulnerability data from multiple sources

• actions - Reusable GitHub Actions for git-pkgs dependency analysis
• skills - Claude Code skills plugin for git-pkgs and brief