Local CVE Dependency Assessment

Audit dependencies without modifying application files. Do not call an assessment or CVE MCP tool.

Inputs

• workspace-path: Absolute project root.
• output-path: Required JSON result path supplied by the assessment catalog.
• scan-scope: direct (default) or all.

1. Detect Ecosystem

• Maven/Gradle project → advisory ecosystem maven.
• .sln, .slnx, or project files → nuget.
• package.json → npm.
• If none apply, write [] to output-path and stop.

2. Collect Dependencies