Introducing the Verifi CLI: the safe fix for your vulnerable dependencies

Verifi is open source, and it starts with a single command-line tool. This is the smallest useful version of what we are building, and it is the one we wanted in our own pipelines first.

Every scanner hands you a list of vulnerable dependencies. None of them tell you whether fixing one will break your app, so the list sits there, or someone upgrades and loses an afternoon to a broken build. The CLI starts where that list stops.

What it does

Point the CLI at a project and it resolves your full dependency tree, direct and transitive, then matches it against the public OSV advisory data to mark what is vulnerable. It keeps the vulnerabilities your code actually reaches and drops the rest, so the list is short and real.

For each one it works out the fix: the version to move to, or a replacement when there is no safe upgrade, and what that clears. You get a concrete change, not another warning.

Honest about confidence

A fix is only useful if you can trust it. So every recommendation says how sure we are. An advisory fix is drawn from the published data. A structural fix has been checked to see that no symbol your code uses changed. A behavioural fix has been run against your own tests. Verifi never tells you more confidence than it has earned, and it says plainly what it has not checked.

The core reads and reasons. It does not run your build and it does not write to your repository. That is deliberate: the reasoning you can trust comes first, and applying fixes and opening pull requests follows, gated behind that confidence.

Where you already work

Run it in your terminal to see what is in your tree, and run it in CI on the same project. It is npm-first today, with more ecosystems close behind, and the write side that opens the pull requests is the next release. The code is on GitHub. Read exactly what it does, then wire it in.