Solve dependency upgrades in one go.
OSS IQ maps transitive supply chain risk and feeds a deterministic fix plan straight to your AI agent or terminal—so you never break main on an upgrade.
41%
Lower cost per dependency update.
Unassisted, the agent researches versions itself: twenty tool calls and nine registry lookups every run. Given a solved plan, that work disappears and registry lookups drop to zero.
60%
Less wall-clock time waiting on it.
Ninety-six seconds down to thirty-eight. The saving is fewer round-trips rather than faster ones — twenty-two agent turns unassisted against eight with OSS IQ — so latency and tokens fall together.
An agentic pre-flight check.
Your agent installs whatever package name sounds right. OSS IQ runs first: does this exist, is it a typosquat, was it published this morning, is anyone still maintaining it. A hallucinated name fails the lookup and a freshly-published release is flagged at the gate, not in production — ossiq add is a quality gate in front of npm install and uv add.
Built for the axis nobody else covers.
Audit tools grade the past — which CVEs are already in your tree. Dependabot grades nothing and opens a pull request for everything. OSS IQ grades the move forward: what it costs to stay current, what breaks if you upgrade, and whether a package is worth depending on at all.
10/10
The same answer every time.
Run the same upgrade ten times unassisted and the agent settles on two different dependency trees. Both pass the tests, so no pass/fail benchmark will ever catch it. With OSS IQ, ten runs out of ten converged on one answer — and the cost spread narrowed from 4.5× to 1.6×.
Ten seconds to your first answer.
Point it at any JavaScript or Python project. Nothing to procure, nothing to install globally, nothing to send anywhere.
Not another audit tool.
The ecosystem is full of point solutions for what already went wrong. OSS IQ answers the question you actually have on a Tuesday morning: can I move this dependency, and what happens if I do.
Five questions, one command each.
Each is a question you already ask about a dependency. OSS IQ answers it in your terminal, or through your coding agent.
ossiq statusossiq info <package>ossiq add <package>npm install and uv add. It installs the recommended version instead of the newest, and flags a release still inside the 7-day cooldown.--ignore-scripts. Gated add →ossiq plan · ossiq applyplan previews the change; apply writes it and rolls back if the install fails.--update-strategy, from security (only what clears a CVE) up to cutting-edge. --strategy-override pkg=tier moves one package differently, and --yes runs it in CI.
Plan and apply →
ossiq install skillsossiq apply shows the plan and you confirm. In our benchmark the agent needed 8 turns instead of 22, at 41% lower cost per update. Set up your agent →Try it.
One for the project you already have. One for the package your agent is about to add.
# no install — Python toolchain, or Node $ uvx ossiq status $ npx @ossiq/cli status # solver-backed plan, transitive cascade included $ ossiq plan --production # rewrite the manifest, roll back on failure $ ossiq apply
# inspect drift, CVEs and health first $ ossiq info requests ✓ 2.31.0 recommended · no CVEs · maintained ⚠ latest 2.32.0 — single maintainer, bus factor # quality-gated install of the right version $ ossiq add requests # wire it into Claude Code, Codex or Copilot $ ossiq install skills
Held to the standard it measures.
A tool that forecasts supply-chain risk in other people's dependencies has no business being sloppy about its own. Every artifact OSS IQ publishes is verifiable before you run it.
gh attestation verify.uv sync --locked. Packaging makes no network calls.The Docker image installs from PyPI and sits outside this chain — verify the wheel instead. Full detail and the exact verification commands: SECURITY.md.
Cost, time and consistency figures come from our Round 3 agent benchmark, 28 September 2026: 60 sessions across two projects and three delivery modes, ten seeds each, paired by seed with bootstrap 95% confidence intervals. Headline numbers are the static-report delivery mode; the MCP server saves 29% on cost and 33% on time. Every arm reached 100% verified-correct results on these fixtures — including the unassisted control — so we make no claim that OSS IQ improves correctness. Two six-dependency fixtures are not production repositories; larger graphs and real repositories are the next tests.
Stop letting your agent guess.
Free and open source under AGPLv3. Run it on a repo in the next ten seconds.