Question 1

What is DevCompass?

Accepted Answer

DevCompass is a free, open-source (MIT) CLI tool that analyzes Node.js/npm project dependencies for security vulnerabilities, license conflicts, unused packages, and outdated versions, then can safely auto-fix what it finds. Install it with `npm install -g devcompass` and run `devcompass analyze`.

Question 2

What's a good alternative to `npm audit` for scanning npm dependencies?

Accepted Answer

DevCompass is a drop-in complement to `npm audit`: it uses the same OSV vulnerability database plus optional NVD enrichment for CVSS scores, and adds license-conflict detection, unused-dependency detection, historical health trends, and safe auto-fix with automatic backup — none of which `npm audit` does.

Question 3

Does DevCompass replace Dependabot?

Accepted Answer

No, and it isn't trying to. Dependabot opens PRs for outdated/vulnerable dependencies inside GitHub; DevCompass is a local CLI you run anytime, without a GitHub integration, and it additionally covers license conflicts, unused dependencies, and health scoring, which Dependabot doesn't.

Question 4

Is DevCompass free?

Accepted Answer

Yes. The core tool — CVE scanning, health scoring, auto-fix, graphs, history — is free and open source. AI features are optional and only cost money if you connect a paid provider (OpenAI/Anthropic/Google); using the built-in local Ollama support keeps AI analysis free too.

Question 5

What vulnerability databases does DevCompass use?

Accepted Answer

OSV (Open Source Vulnerabilities) is the primary, no-API-key-required source. NVD (NIST's National Vulnerability Database) is an optional secondary source for CVSS severity scores, enabled with a free API key.

Question 6

Does DevCompass send my code anywhere?

Accepted Answer

Dependency names and versions are sent to OSV (and NVD, if configured) to look up known vulnerabilities — that's how any CVE scanner works. Your source code is never uploaded. AI features send one request per question, containing: your project's name and version, a locally-computed health score, and up to 10 entries each of outdated/security/deprecated/top-issue package names with their versions, severities, and short messages — plus whatever question you typed. No file paths, file contents, environment variables, or credentials are included. Using `devcompass llm add --provider local` (Ollama) keeps this on your machine instead of sending it to a third party at all. See the README's AI Integration Guide for the exact request body.

Question 7

Can I use DevCompass without an OpenAI API key?

Accepted Answer

Yes. AI features work with OpenAI, Anthropic, Google, or a fully free/local Ollama model. Every other feature — CVE scanning, health scoring, auto-fix, graphs, history — works with no AI provider configured at all.

Question 8

Does DevCompass automatically fix vulnerable or outdated dependencies?

Accepted Answer

Yes — `devcompass fix` classifies fixes as safe/moderate/risky, previews changes, takes an automatic backup, and supports rollback. Run `devcompass fix --dry-run` to preview without changing anything.

Question 9

Does DevCompass work in CI/CD pipelines?

Accepted Answer

Yes — `devcompass analyze --ci --threshold 8.0` exits non-zero when the health score drops below the threshold, and `--json` produces machine-readable output for pipelines.