deps.dev Package Insights Scraper

deps.dev Package Insights Scraper

Scrape package insights from deps.dev for any npm, PyPI, Cargo, Maven, Go, or NuGet package. Get dependencies, dependents, versions, licenses, and security advisories in one flat row per package. No API key required. Export to CSV, JSON, Excel, or XML.

deps.dev is Google's open-source package intelligence service, but its API is rate-limited and returns nested JSON that is hard to flatten. This Actor reads the public package pages directly, so you can pull insights for hundreds of packages in one run. Each package comes back as a clean row with its dependency graph, version history, license, and known vulnerabilities.

Who uses it	What they scrape deps.dev for
Security engineers	Check which of their dependencies have known vulnerabilities or risky licenses
Developer platform teams	Build an internal catalog of approved packages with their transitive dependencies
Open-source researchers	Analyze dependency graphs across ecosystems to spot supply-chain patterns
Compliance officers	Audit license types and version freshness for every package in production

What it does

This Actor collects package insights from deps.dev for the ecosystem and package names you provide, and returns each package as one flat row.

• 📦 Six ecosystems: npm, PyPI, Cargo, Maven, Go, and NuGet, selected with one dropdown.
• 🔍 Bulk package lookup: paste up to a million package names and get one row per package.
• 🧾 Flat output: dependencies, dependents, versions, licenses, and advisories are normalized into simple fields.
• ⚡ No API key: reads the public deps.dev pages directly, so there is no registration or rate limit to manage.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with deps.dev data

🛡️ Audit dependencies for vulnerabilities.

A security engineer lists every package in their production lockfile and gets a row with all known CVEs and affected version ranges, then prioritizes upgrades.

📋 Build an approved package catalog.

A platform team scrapes deps.dev for their internal allowlist and records each package's license, latest version, and dependency count to enforce policy.

🔗 Map transitive dependencies.

A developer investigates a supply-chain incident and pulls the full dependency graph for a suspicious package to see what else is exposed.

📊 Compare package popularity.

A researcher collects dependents counts and version release dates for hundreds of packages to rank ecosystem health and adoption.

Why choose this scraper

	What you get
Dependency graph	Direct and transitive dependencies with their own versions and licenses
Version history	All published versions with release dates and tags
License detection	SPDX license identifiers for the package and its dependencies
Security advisories	Known vulnerabilities from OSV with severity and affected versions
Dependents count	How many other packages depend on this one, a proxy for popularity

How it compares

No other Store actor targets deps.dev the same way, so the honest comparison is with the alternatives teams actually weigh.

	deps.dev Package Insights Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When deps.dev changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Choose an ecosystem, list the package names you want, and set a maximum number of packages per run. The Actor reads each package page and returns one flat row per package. The Input tab lists every parameter.

A first run with the defaults:

{
  "system": "npm",
  "packages": [
    "react",
    "express"
  ],
  "maxItems": 10
}

A larger pull:

{
  "system": "npm",
  "packages": [
    "react",
    "express"
  ],
  "maxItems": 200
}

Pricing

Pay-per-result: $0.011 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$1.10
1,000 results	$11.00
10,000 results	$110.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the deps.dev Package Insights Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to deps.dev through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/deps-dev-package-insights-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check that the package names are spelled correctly and match the selected ecosystem. For Maven, use group:artifact; for Go, use the full module path.

The run is slow for many packages.

The Actor reads pages sequentially to be polite to deps.dev. Reduce the number of packages or split the list into multiple runs.

Some fields are empty in the output.

Not every package has the same data. For example, a package may have no known vulnerabilities or no dependents. Empty fields are normal.

I get an error about the ecosystem.

Make sure you selected the correct ecosystem from the dropdown. The package name format must match that ecosystem's conventions.

FAQ

Question	Answer
Do I need a deps.dev API key?	No. This Actor reads the public deps.dev package pages directly, so there is no registration, key, or rate limit to manage.
Which package ecosystems are supported?	npm, PyPI, Cargo, Maven, Go, and NuGet. Select one per run from the dropdown.
How do I format package names for Maven?	Use group:artifact, for example com.google.guava:guava. For Go, use the full module path like github.com/gin-gonic/gin.
Can I scrape more than one package at a time?	Yes. Add as many package names as you need in the Package Names field, up to one million per run.
What does the output look like?	Each package is one flat row with fields for dependencies, dependents, versions, licenses, and security advisories. You can export to CSV, JSON, Excel, or XML.
Does it include transitive dependencies?	Yes. The dependency graph includes direct and transitive dependencies, each with its own version and license information.
Are security advisories included?	Yes. Known vulnerabilities from OSV are returned with severity, affected versions, and references.
Is there a limit on how many packages I can scrape?	You can set a maximum number of packages per run, up to one million. The Actor stops after reaching that limit.
Can I schedule this Actor to run regularly?	Yes. Use Apify's scheduler to run it daily or weekly and keep your package insights up to date.
What if a package name is not found?	The Actor skips packages that return no data and continues with the rest. You can check the run log for skipped names.

Related actors

• google-search-scraper: Search the web for package mentions and discussions to complement deps.dev insights.

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Google LLC. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.