Which AI libraries does it detect?

Model runtimes (transformers, torch, tensorflow, onnxruntime, vllm, llama-cpp), LLM SDKs (openai, anthropic, cohere, litellm, google-generativeai), agent/orchestration frameworks (langchain, langgraph, llama-index, langflow, crewai, autogen, semantic-kernel, haystack), vector databases (chromadb, pinecone, weaviate, qdrant, faiss, milvus), and MCP libraries.

Why does it flag some dependencies as risky?

Several AI frameworks have had recent, actively-exploited vulnerabilities — for example Langflow (CVE-2026-0768), LiteLLM (CVE-2026-59822) and Hugging Face Transformers (CVE-2026-80047). The scanner flags those so you can verify your version is patched.

Does it upload my manifest?

No. Parsing and detection happen entirely in your browser; nothing you paste leaves the page.

Free tool · no signup · runs in your browser

AI Dependency Scanner

Paste a requirements.txt or package.json and see the AI/ML libraries in your dependency tree — with a flag on the ones under active exploitation. Nothing is uploaded.

Dependency manifest

These are your AI supply chain. Put them in an AIBOM with the free ML-BOM Converter, validate it with the AIBOM Validator, and screen every model license with the Model License Checker.

AI Dependency Scanner

Practice & Coaching

Simulations

PCI DSS

Studios

Scanners & Library

Arcade

Stay Lowkey 🔒

Community

Get Started Free