How does Kevlar-CheckDeps differ from composer audit?

composer audit requires the PHP CLI runtime and Packagist connection. Kevlar-CheckDeps is a standalone CLI parsing composer.lock natively using standard Python stdlib and batch querying Google OSV DB.

Do I need PHP or Composer installed to scan my project?

No. Kevlar-CheckDeps parses composer.lock JSON files directly without needing PHP, extensions, or the Composer binary installed.

Can Kevlar-CheckDeps break CI/CD pipelines for vulnerable PHP packages?

Yes. Kevlar-CheckDeps includes the --fail-on-vulns flag to return exit code 1 whenever critical or high vulnerabilities exceed your configured limits.

⚡ PHP Ecosystem SCA CLI

PHP Dependency Audit CLI: Fast, Zero-Dependency SCA for Composer

Audit direct and transitive PHP dependencies, detect vulnerabilities in the Google OSV database, and validate composer.lock integrity—without external extensions or API keys.

$ python kevlar.py --tech php --path ./my-php-app --all --vuls

Composer (`composer.lock`) Manifest (`composer.json`) Packagist Ecosystem

bash - kevlar-checkdeps (php)

user@devsecops ~/my-php-app

$ python kevlar.py --tech php --path . --all --vuls

[INFO] Detected Ecosystem: PHP (Composer)

[INFO] Reading composer.lock...

[INFO] Checking 64 packages against Google OSV DB...

[INFO] Validating sha1/sha256 dist hashes...

[ALERT] Checked: 64 packages in 0.82s.

Vulnerabilities: 1 (1 High).

Status: ❌ FAIL (Threshold Breach)

The Problem with Traditional SCA Tools in PHP

Why do tools like `composer audit` or plugin extensions introduce friction in PHP CI/CD workflows?

Traditional Tools

(composer audit / Extensions)

Limitations

Requires PHP Runtime & Extensions

Requires installed PHP CLI binary, memory limits, and Composer extensions inside CI runners.

Kevlar-CheckDeps

(PHP Audit)

Solution

Zero PHP Runtime Required

Executes standalone on Python 3.11+ stdlib, parsing composer.lock JSON files directly.

Quick Usage Guide & Practical Example

How to run local scans, export executable reports, and integrate Kevlar into your CI/CD pipeline.

Full Local Scan

Audit direct and transitive PHP dependencies querying Google OSV DB:

Scan Command:


                                        $ python kevlar.py --tech php --path ./ --all --vuls

Export HTML / SARIF

Generate interactive HTML dashboards or standard SARIF v2.1.0 reports:

Report HTML:


                                            $ python kevlar.py --tech php --path ./ --all --vuls --output report.html

Report SARIF:


                                            $ python kevlar.py --tech php --path ./ --all --vuls --output report.sarif

CI/CD Build Breaking

Fail CI/CD pipelines automatically if severe vulnerabilities are detected:

Pipeline Command:


                                        $ python kevlar.py --tech php --path ./ --all --vuls --fail-on-vulns "critical:1,high:2"

Quick Comparison Matrix

Compare Kevlar-CheckDeps with common alternatives in the PHP ecosystem.

Feature / Criterion	Kevlar-CheckDeps Featured	composer audit	Roave Advisories	Local PHP Checker
Execution Speed	⚡ Ultra-fast (Multi-threaded & OSV Batch)	Medium (Composer CLI)	Slow (Full Conflict Resolution)	Fast (Local DB)
External Dependencies	Zero (Python 3.11+ Std Lib)	Requires PHP & Composer	Requires Composer Package	Requires Go Binary
API Keys / Accounts	Not Required (Public Google OSV)	Not Required	Not Required	Not Required
Code & Manifest Privacy	100% Local Execution	Local Packagist Queries	Local Git Resolution	100% Local Execution
Lockfile Checksum Audit	Yes (Dist SHA Checksums)	No	No	No
Cost & License	Free & Open Source (Apache 2.0 License)	Free (MIT)	Free & Open Source (MIT)	Free & Open Source (MIT)

Frequently Asked Questions (FAQ)

Quick answers to common questions about PHP dependency auditing.