StackVet BETA
Beta / experimental. Free while in beta. Feedback welcome. No guarantee of revenue or results.
Vet your app's dependencies and licenses before you ship — copyleft traps, missing licenses, and unpinned versions.
Get the free beta by email Get a launch audit Send feedback How it works
What it does
Runs a deterministic, local-first, read-only scan over your project's package.json and the lockfiles beside it (and, when present, the licenses actually installed in node_modules) and returns a verdict (SHIP-SAFE / NEEDS REVIEW / RISKY), a 0-100 score, severity counts, evidence for every finding, and a Claude-ready fix prompt per issue, in JSON, Markdown, and HTML. It catches the dependency, license, and supply-chain hygiene problems AI-built projects ship with — a copyleft license on a product you mean to sell, no license at all, a publishable manifest with no "private": true, no lockfile, wildcard / unbounded / prerelease version ranges, dependencies pulled from git / URLs / local paths, install lifecycle scripts and scripts that pipe a download into a shell, typosquat-looking names, and direct-dependency bloat. Runs entirely on your machine with zero runtime dependencies: it never installs anything, never runs your scripts, never networks. No cloud, no account, no telemetry.
Who it's for
Indie founders, AI-app builders, and small agencies shipping a Node project who want a fast, honest check that their dependencies and license obligations are intentional — before they publish, ship, or sell.
What it does NOT do
Reports dependency & license hygiene signals, not guarantees. It is NOT a vulnerability / CVE scanner, not `npm audit`, and NOT legal advice about open-source licensing — it does not know whether a version is exploitable or whether a license is enforceable against you. It never installs, never runs your scripts, never reaches the network, never deploys or publishes, never touches DNS or hosting, never reads or transmits real secrets (secret-looking values are redacted to [REDACTED]), and never crosses an owner manual gate. Installed-license auditing requires node_modules to be present; root package.json + lockfiles only (workspaces are future scope).
How to try it
Request free beta access via the feedback form, then run it locally on Node: scan a bundled demo (node src/scan.mjs --demo bad or --demo good), point it at your own project folder, or open the local-only dashboard at 127.0.0.1 — no account or payment required.
What StackVet checks
- A secret-looking value committed in package.json (the value is redacted to [REDACTED])
- A copyleft / share-alike license (AGPL/GPL/LGPL/SSPL) on a product you may intend to keep proprietary or sell
- A publishable manifest with no "private": true (accidental npm publish risk), worse if it also has no license
- No lockfile (non-reproducible installs) or multiple conflicting lockfile types
- Wildcard / "latest", unbounded comparator, and prerelease (alpha/beta/rc) version ranges
- Dependencies pulled from a git/URL source or a local file: path instead of the registry
- Install lifecycle scripts (preinstall/postinstall) and scripts that pipe a network download into a shell
- Typosquat-looking / malformed dependency names
- Direct-dependency bloat (maintenance + attack surface)
- When node_modules is installed: copyleft and unknown-license packages actually present
How it works
- Point StackVet at your project folder (or a bundled demo). It reads package.json and the lockfiles beside it read-only, plus the license fields in node_modules if it's installed — your source never leaves your machine and nothing is installed or executed.
- A deterministic check engine runs 15 heuristic checks across Secrets, License, Publish, Reproducibility, Supply chain, and Maintenance, and scores the result into SHIP-SAFE / NEEDS REVIEW / RISKY with a 0-100 score and severity counts, with all evidence redacted.
- Every finding includes evidence, its area, and a copy-ready Claude fix prompt that tells a Claude Code session exactly what to fix — and what not to do (no installs from untrusted sources, no publish, stop at any owner manual gate).
Known limitations
- Experimental beta — checks and scoring may change or miss things.
- Dependency & license hygiene signals only — NOT a vulnerability/CVE scan, npm audit, or legal/licensing advice, and no guaranteed results.
- Root package.json + lockfiles only (no workspaces yet); installed-license auditing needs node_modules present; not yet reviewed for production use.
Changelog
- 2026-06-25 — Beta candidate created: local-first dependency & license hygiene audit engine (15 heuristic checks), CLI scan, JSON/MD/HTML reports, local-only dashboard, risky/clean demo fixtures, and 12 unit tests. Owner review required before promotion.
Try StackVet free while it's in beta
StackVet is free while in beta. Run it on your own project, then tell us whether the SHIP-SAFE / NEEDS REVIEW / RISKY verdict matched reality and what it missed — no account, no payment, and no guarantee of results.
Built by Everstead Labs LLC. Live on Shopify: LaunchLock and CatalogCare.