Developer Tools / BROWSER-ONLY UTILITY
Dependency Inventory Builder
Get a clear list of supplied dependency names and versions before using an advisory service. Keep declared ranges separate from resolved or deployed versions.
Choose package.json, an npm package-lock.json version 2 or 3, or a simple requirements file. You can also paste the original content and choose its format. Limit: 100,000 characters.
Loading local tool code...
Input stays in this tab. No upload, AI call, analytics or ads. Reset clears the workspace. Clipboard copies and downloaded files remain under your control.
Result
Technical details (optional)
Review the result before sharing. It may still contain personal or confidential information.
Use the file your project already has
Select a package.json or an npm package-lock.json directly; there is no extra document to prepare. Package declarations cover normal, development, optional and peer dependencies. Lockfiles must use version 2 or 3 with a packages section. Root metadata and workspace links are not treated as dependency versions. Scoped npm names and nested package paths are supported.
Choose the format that matches the content
For a simple Python requirements file, use lines such as demo-library==1.2.3. Optional extras and trailing comments are accepted. Directives, editable installs, URL requirements, environment markers, version ranges and continuations are skipped. Format selection tells the reviewer how to read the original text; it does not install a package or resolve an unsupported entry.
Read completeness before using the list
The output deduplicates matching ecosystem, name and version rows while retaining occurrence counts and source groups. Non-version references are omitted from the version field to avoid reproducing authenticated VCS URLs. Unsupported or malformed rows increment a skipped count. Limits are 1,000 dependency entries and 2,000 requirements lines within the 100,000-character input boundary.
Inventory is not an advisory scan
No registry, package archive, source repository, licence database or advisory service is queried. A declaration such as ^2.0.0 is not an installed version, and a lockfile is not proof of the deployed build. The tool does not decide whether a package is vulnerable, malicious, correctly licensed or reachable in your application. Preserve those distinctions in any downstream report.
References
Documentation reviewed: . Rule results describe the supplied text, not a live application test.
Useful next steps
Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.