Deterministic capability analysis for Node.js dependencies.
CapScan helps you understand what your dependencies are capable of doing.
Unlike traditional security scanners, CapScan doesn't classify risk or assign scores.
Instead, it answers a simple question:
What can this dependency do?
Every result is backed by file-level evidence.
Most tools answer:
❌ "Is this dependency vulnerable?"
CapScan answers:
✅ "Can this dependency access the filesystem?"
✅ "Can it execute shell commands?"
✅ "Can it make outbound HTTP requests?"
✅ "Can it load native binaries?"
Capabilities are facts.
Risk is context.
npx capscan scan .Output:
📁 Filesystem
fs:write ............ 3 packages
fs:read ............. 2 packages
🌐 Network
net:outbound_http ... 2 packages
net:outbound_https .. 1 package
⚙️ Process
proc:execute_shell .. 1 package
🔑 Environment
env:read ............ 5 packages
- 🔍 Deterministic capability analysis
- 📄 Evidence for every finding
- ⚡ Fast (~2.8ms/package)
- 📦 Works with npm, pnpm and Yarn lockfiles
- 📊 JSON, Markdown and Terminal output
- 📸 Snapshot & diff support
- 🔎 Explain why a capability exists
# Scan a project
capscan scan .
# Why does axios have capabilities?
capscan why axios
# Which packages can write files?
capscan why fs:write
# Save current dependency baseline
capscan snapshot .
# Compare against previous snapshot
capscan diff .
# Compare two packages
capscan compare express@4 koa@2CapScan can check capabilities before each npm install:
# Setup (creates .npmrc with preinstall hook)
capscan init
# Now every npm install checks capabilities
npm install axios
# → CapScan: axios can make HTTP requests, read env, use crypto
# To disable
# Remove the "preinstall" line from .npmrc# Only allow specific capabilities
capscan check . --allow=fs:read,env:read
# Quiet mode (only output if blocked)
capscan check . --quietCapScan performs deterministic static analysis.
- Resolve dependencies from your lockfile.
- Parse source files with
oxc-parser. - Detect runtime API usage.
- Map APIs to capabilities.
- Generate explainable reports.
No telemetry.
No cloud.
No code execution.
capscan scan . --format terminal
capscan scan . --format json
capscan scan . --format markdown| Capability | Evidence |
|---|---|
fs:write |
fs.writeFile() |
fs:read |
fs.readFileSync() |
net:outbound_http |
http.request() |
proc:execute_shell |
child_process.exec() |
env:read |
process.env |
native:dlopen |
process.dlopen() |
packages/
├── engine/ # Deterministic analysis engine
└── cli/ # Terminal interface
The engine is designed to be reusable by:
- CLI
- GitHub Actions
- VS Code extensions
- Future integrations
| Metric | Value |
|---|---|
| Average scan time | 2.8 ms/package |
| Throughput | ~360 packages/sec |
| Determinism | 100% |
pnpm install
pnpm build
pnpm golden-test
pnpm determinism-test
pnpm performance-budgetCapScan intentionally avoids making security decisions.
It reports observable capabilities with deterministic evidence.
You decide what those capabilities mean for your project.
Contributions are welcome.
Please read CONTRIBUTING.md before opening a pull request.
MIT
Built with ❤️ by Maximiliano Moldenhauer.