Dependquarry
Read CycloneDX and SPDX component inventories offline, triage evidence, record reachability and ownership, and export disposition.
Focused field tools
Normalize package name, version, ecosystem, supplier, and package URL.
Understand CycloneDX components and SPDX packages without flattening meaning.
Record direct, transitive, optional, build, and runtime relationships.
Separate advisory presence, affected version, reachability, and exploitability.
Retain declared, concluded, detected, exception, and notice evidence.
Record source, checksum, signature, build origin, and attestations.
Dependquarry interprets imported component metadata and user-entered findings; it does not fetch advisories, prove exploitability, determine legal obligations, or certify a product. Verify package identity, versions, reachability, licenses, provenance, and current advisories with accountable experts.