App category
Developer and software supply chain
Check the package, manifest, dependency, and integration details around a software release. These apps inspect npm readiness, vulnerable JavaScript, SBOMs, deep links, web app manifests, workflow files, security headers, and connected-device metadata.
Choose an app when
- Use npm Package Check for the published tarball and release metadata; use JS Vulnerability Check for library versions served by a public page.
- Use SBOM Check for CycloneDX or SPDX documents and CWL Workflow Check for workflow resolution and step wiring.
- Use Web App Manifest Check for web app installability, Deep Link Check for iOS and Android association files, and Thing Description Check for a WoT document.
- Use Security Headers Check for browser protection headers and Auth Discovery Check for OIDC or OAuth discovery.
Auth Discovery Check
2 tools
Check an OIDC/OAuth issuer's discovery documents in chat
CWL Workflow Check
2 tools
Validate a hosted Common Workflow Language document with the reference cwltool --validate engine: real SALAD reference resolution and cross-step type wiring, not a YAML syntax parse
Deep Link Check
2 tools
Check universal-link and App-Links config in chat
JS Vulnerability Check
1 tool
A Retire.js scan of the external scripts present in a page's served HTML, matched against the public database of known JavaScript library vulnerabilities
npm Package Check
2 tools
Inspect the exact published npm tarball before you install or ship it: registry facts, shipped files, install scripts, integrity, and provenance, never an install
Web App Manifest Check
2 tools
Check selected core web app manifest members and Chrome's documented installability fields, with declared icons fetched and decoded for reachability and true pixel size
SBOM Check
2 tools
Check an SBOM document before you ship it
Security Headers Check
1 tool
Reads the eight industry-standard browser protection headers straight off the live response: each one set or missing, with the value your server actually sent and a weighted header score
Thing Description Check
2 tools
Validate a hosted or pasted W3C WoT Thing Description against both the JSON Schema and the beyond-schema assertions ajv alone cannot check, in chat