Show the path, not a score
Every exposed service comes with the exact chain from its own dependency down to the poisoned version, found with a shortest-path query, and a receipt you can re-derive.
Which of your services does the poisoned package reach?
When a package is poisoned, Plumbline follows the dependency path to every service it touches, says plainly when it can't know, and reopens past decisions the moment an assumption breaks.
- storefront-webyour service
- @acme/payments-sdk@2.1.0direct dependency
- @cacheable/net@2.1.1transitive
- @cacheable/utils@2.5.1transitive
- keyv@6.0.0poisoned release
Replay the incident
Loading the incident. Drag the weight down the line, or press play, and watch each service's verdict change as the first hour unfolds.
Drag the weight
Who is affected
Where it sits in the graph
That was a recorded incident. Run the same check on your own project.Check your lockfile
Which services exist, and which face the internet, is declared, not discovered. Verdicts come from deterministic code, never from a model.
Three habits that keep an answer honest
Say what you assumed
Clearing a service rests on facts: the lockfile hasn't changed, this version isn't on the advisory. Plumbline stores each fact next to the decision that leans on it.
1. The lockfile has not changed
keyv@6.0.1 is not on the advisory
No longer true since 12:45
Reopen only what broke
When a fact stops being true, one query finds the decisions that leaned on it. Everything else stays decided, so nothing is re-reviewed by habit.
Then try it on your own project
- Open Check your project in the top bar.
- Choose a sample, or pick or paste your
package-lock.json. - Click Check. You get a verdict, the path, and the queries the graph ran.
This recorded copy of the site can't read your files. Run the project locally (see the README) or open the live deployment to use the checker.
One graph does three jobs
Evidence, memory and the agent's tools all run on a single FalkorDB graph. Here is what each job asks of it.
- Evidence
- A shortest-path query over the resolved dependency edges returns the chain for every exposed service.
- Memory
- Decisions point at the facts they assume. One traversal finds exactly which decisions a new event breaks.
- Tools
- An MCP server exposes read-only tools, including a fleet-wide fix-first query and PageRank over each dependency graph, plus a shared work queue for hand-offs between agents. The agent reaches the graph only through them.