Understand every dependency in your Rust project: why it's there, what it risks, and what to do.
CargoScope is an open-source CLI, written in Rust, for Rust/Cargo projects. One command produces one report: inventory, security advisories, available versions, licenses, likely-unused dependencies, and the dependency chain behind each finding. No more running cargo-audit, cargo-deny, cargo-machete and cargo-tree separately and reconciling their output.
- Local, no account: the first scan needs no account and no online service.
- Your code never leaves your machine: nothing is uploaded.
- No silent writes: CargoScope never modifies your files.
- Evidence first: every finding shows its evidence, its source and the date of its data.
- No code execution: CargoScope reads files directly and never runs
cargo, build scripts or project code by default.
Early development, not yet ready for production use. Today, cargoscope update downloads the RustSec advisory database and the crates.io data of the project, and cargoscope scan reports matching advisories, licenses, outdated and yanked versions, and inventories the packages resolved in Cargo.lock, with the dependency chain behind every advisory and transitive package. It also lists likely-unused dependencies found by static analysis, with the evidence behind each one. Output is available as text, JSON and SARIF. Release tooling (binaries, installers, crates.io, Homebrew, npm, PyPI and a GitHub Action) is in place; the first release is not published yet.
Not released yet: the commands below work from the first release (v0.1.0) on.
# Prebuilt binary, macOS and Linux
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/HarpeLm/CargoScope/releases/latest/download/cargoscope-installer.sh | sh
# Prebuilt binary, Windows (PowerShell)
irm https://github.com/HarpeLm/CargoScope/releases/latest/download/cargoscope-installer.ps1 | iex
# Homebrew
brew install HarpeLm/tap/cargoscope
# From crates.io
cargo install cargoscope
# Without installing, through npm or Python tooling
npx cargoscope scan .
uvx cargoscope scan .Until then, build from source: cargo install --path crates/cargoscope-cli.
permissions:
contents: read
security-events: write # to upload SARIF to code scanning
jobs:
cargoscope:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: HarpeLm/CargoScope@v0.1.0
with:
fail-on: high # or none, to report without failingThe action downloads the prebuilt binary (no compilation), caches advisory data for a day, prints the report in the log, and uploads SARIF results to the Security tab. Inputs: version, path, fail-on, checks, sarif, upload-sarif.
# Download the RustSec database and this project's crates.io data (the only command that uses the network)
cargoscope update .
# Scan the current project, offline
cargoscope scan .CargoScope 0.1.0
Target: .
Advisories: 1 (RustSec database downloaded 2026-11-12)
- RUSTSEC-2020-0071 [medium] time 0.1.45: Potential segfault in the time crate
via my-app -> chrono -> time
fix: upgrade to >= 0.2.23
https://github.com/time-rs/time/issues/293
Resolved packages: 22
- cargoscope-cargo 0.1.0 [root]
- indexmap 2.14.2 [transitive] (registry+https://github.com/rust-lang/crates.io-index)
via cargoscope-cargo -> toml -> toml_edit -> indexmap
- toml 0.8.23 [direct] (registry+https://github.com/rust-lang/crates.io-index)
...
Every transitive package shows the shortest dependency chain that pulls it in. The JSON report carries the same chain in a path field.
cargoscope scan . --format json --output report.json # versioned JSON report
cargoscope scan . --format sarif --output results.sarif # SARIF 2.1.0 for GitHub code scanning
cargoscope scan . --fail-on high # fail only on high or critical vulnerabilities
cargoscope scan . --fail-on none # never fail CI on findings
cargoscope scan . --checks inventory,unused # run only some checks (no download needed)
cargoscope scan . --show-uncertain # also list possibly-unused dependencies
cargoscope scan . --verbose # also list every resolved packageBy default, any security vulnerability fails the scan (exit code 1); vulnerabilities without a CVSS score count at every threshold, and informational advisories never fail. Set CARGOSCOPE_CACHE_DIR to choose where downloaded data is stored. Use --fail-on none to add CargoScope to CI alongside your existing tools without blocking builds. Exit codes: 0 OK, 1 threshold reached, 2 execution error.
The JSON report follows a published schema with a compatibility policy: see docs/json-report.md. SARIF results cover advisories (pointing at the package in Cargo.lock), yanked versions in use, and likely-unused dependencies (pointing at their line in Cargo.toml).
| Version | Focus |
|---|---|
| v0.1 | Unified Rust report: inventory, RustSec advisories, crates.io versions, licenses, unused candidates, dependency paths, text/JSON/SARIF, all distribution channels, GitHub Action |
| v0.2 | Measured precision: compiler-oracle benchmark, opt-in --precise mode |
| v0.3 | Report comparison, baselines, license and source policies |
| v0.4 | Maintenance indicators, justified recommendations, exportable graph |
| v0.5 | Locally generated HTML report |
| v0.6 | Controlled fixes (fix --dry-run, explicit fix --apply) |
| v0.7 | Multi-project aggregation of local reports |
| 1.0 | Stable CLI, JSON schema and compatibility policy |
CargoScope supports Rust/Cargo only. Other ecosystems are not planned until the Rust experience is clearly better than combining existing tools. See SPEC.md for the full specification.
cargoscope/
├── crates/
│ ├── cargoscope-cli/ # commands, options, exit codes
│ ├── cargoscope-core/ # data model, orchestration, configuration
│ ├── cargoscope-cargo/ # Cargo parsing, resolution, unused analysis
│ ├── cargoscope-advisory/ # RustSec database and cache (skeleton)
│ └── cargoscope-report/ # text, JSON and SARIF
└── tests/ # fixtures and integration tests
Pipeline: discover → parse → analyze → report.
Contributions are welcome, especially false-positive reports for unused-dependency detection. See CONTRIBUTING.md.
cargo test --workspace
cargo clippy -- -W clippy::pedantic
cargo run -p cargoscope -- scan .Unused-dependency detection is measured on a labelled corpus of 70 real repositories (about 91–94% precision on unseen code, below the 97% target; on the same packages, cargo-machete's default mode has about 41% precision, see the comparison, and a blind benchmark against cargo-machete, cargo-audit and cargo-deny): see tests/corpus for the method and the honest numbers.
cargoscope scan . --format json --output baseline.json # once, on main
cargoscope scan . --baseline baseline.json # later: only new advisories fail
cargoscope compare baseline.json current.json # what changed between two reportscompare lists new and resolved advisories, new yanked versions, new and resolved likely-unused dependencies, and version changes. It exits with 1 when new advisories reach --fail-on.
A cargoscope.toml next to Cargo.toml enforces allowed licenses, allowed sources and banned crates, in the spirit of cargo-deny. Violations fail the scan. See docs/policy.md.
cargoscope scan . --preciseConfirms unused dependencies with rustc's unused_crate_dependencies lint (cargo check --all-targets --all-features, in target/cargoscope-precise). It compiles the project, so build scripts and proc macros run: use it on code you trust. It is never enabled by default, and covers only the current platform.
[package.metadata.cargoscope]
ignore-unused = [
{ name = "once_cell", reason = "used by code generated in build.rs" },
]A reason is required. Ignored dependencies stay visible in the report with their reason. Unused dependencies never fail the scan.
Licensed under the MIT License.