Kevlar-CheckDeps
View on GitHub
⚡ .NET Ecosystem SCA CLI

.NET Dependency Audit CLI: Fast, Zero-Dependency SCA for NuGet

Audit direct and transitive C# dependencies in .NET projects, detect vulnerabilities in the Google OSV database, and validate lockfile integrity—without external packages or API keys.

$ python kevlar.py --tech dotnet --path ./my-dotnet-app --all --vuls
NuGet (`packages.lock.json`) C# Project (`.csproj`) Solution (`.sln`) Central Package Mgmt (`Directory.Packages.props`)
bash - kevlar-checkdeps (dotnet)
user@devsecops ~/my-dotnet-app
$ python kevlar.py --tech dotnet --path . --all --vuls
[INFO] Detected Ecosystem: .NET (NuGet)
[INFO] Parsing packages.lock.json & App.csproj...
[INFO] Checking 114 NuGet packages against Google OSV DB...
[INFO] Validating SHA-512 package content hashes...
[ALERT] Checked: 114 packages in 1.12s.
Vulnerabilities: 3 (1 Critical, 2 High).
Status: ❌ FAIL (Threshold Breach)

The Problem with Traditional SCA Tools in .NET

Why do tools like Snyk or heavy enterprise scanners introduce friction into .NET DevSecOps pipelines?

Traditional Tools

(Snyk / Heavy Scanners)
Limitations

  • Heavy SDK & Tooling Requirements

    Requires installing full .NET SDK, MSBuild components, or proprietary CLI binaries just to audit dependencies.

  • Mandatory SaaS Accounts & Secret Tokens

    Enforces commercial cloud registrations, secrets management in CI/CD, and sending project manifests to SaaS servers.

Kevlar-CheckDeps

(.NET Audit)
Solution

  • Zero .NET SDK Installation Needed

    Executes strictly on Python 3.11+ stdlib, parsing XML/JSON static project manifests locally.

  • Direct Batch Queries to Google OSV DB

    Sends POST batch requests (/v1/querybatch) to audit up to 1,000 NuGet packages without API keys.

Quick Usage Guide & Practical Example

How to run local scans, export executable reports, and integrate Kevlar into your CI/CD pipeline.

Full Local Scan

Audit direct and transitive .NET dependencies querying Google OSV DB:

Scan Command:
$ python kevlar.py --tech dotnet --path ./ --all --vuls

Export HTML / SARIF

Generate interactive HTML dashboards or standard SARIF v2.1.0 reports:

Report HTML:
$ python kevlar.py --tech dotnet --path ./ --all --vuls --output report.html
Report SARIF:
$ python kevlar.py --tech dotnet --path ./ --all --vuls --output report.sarif

CI/CD Build Breaking

Fail CI/CD pipelines automatically if severe vulnerabilities are detected:

Pipeline Command:
$ python kevlar.py --tech dotnet --path ./ --all --vuls --fail-on-vulns "critical:1,high:2"

Quick Comparison Matrix

Compare Kevlar-CheckDeps with common alternatives in the .NET ecosystem.

Feature / Criterion
Kevlar-CheckDeps
Featured
dotnet list package Snyk CLI OWASP Dep-Check
Execution Speed
⚡
Ultra-fast (Multi-threaded & OSV Batch)
Medium NuGet REST API Slow SaaS Cloud Analysis Very Slow Full NVD Download
External Dependencies
Zero (Python 3.11+ Std Lib)
Requires .NET SDK Requires CLI Binary Requires Java JRE
API Keys / Accounts
Not Required (Public Google OSV)
Not Required
Mandatory (Account & Token)
Optional (NVD Key)
Code & Manifest Privacy
100% Local Execution
Local NuGet Queries Manifests Sent to SaaS 100% Local Execution
Lockfile Checksum Audit
Yes (SHA-512 Hash Audit)
No No No
Cost & License
Free & Open Source (Apache 2.0 License)
Free (Bundled in SDK) Freemium / Commercial Free & Open Source (Apache 2.0)

Frequently Asked Questions (FAQ)

Quick answers to common questions about .NET dependency auditing.