when-mapping-dependencies-use-dependency-mapper

Dependency Mapper Skill

Overview

When mapping dependencies, use dependency-mapper to extract, analyze, visualize, and audit dependency trees across multiple package managers (npm, pip, cargo, maven, go.mod).

MECE Breakdown

Mutually Exclusive Components:

1. Extraction Phase: Parse lock files and manifests
2. Analysis Phase: Build dependency graph and detect issues
3. Security Phase: Audit for vulnerabilities
4. Visualization Phase: Generate interactive dependency graphs
5. Reporting Phase: Create actionable recommendations

Collectively Exhaustive Coverage:

• All major package managers (npm, pip, cargo, maven, go)
• Direct and transitive dependencies
• Circular dependency detection
• License compliance checking
• Security vulnerability scanning
• Outdated package detection
• Duplicate dependency identification

Features

Core Capabilities:

• Multi-language dependency extraction
• Dependency graph construction
• Circular dependency detection
• Security vulnerability scanning
• License compliance auditing
• Outdated package detection
• Interactive visualization generation
• Dependency optimization recommendations

Supported Package Managers:

• JavaScript/Node: npm, yarn, pnpm
• Python: pip, poetry, pipenv
• Rust: cargo
• Java: maven, gradle
• Go: go.mod
• Ruby: bundler
• PHP: composer
• C#: nuget

Usage

Slash Command:

/dep-map [path] [--format json|html|svg] [--security] [--circular] [--outdated]

Subagent Invocation:

Task("Dependency Mapper", "Analyze dependencies for ./project with security audit", "code-analyzer")

MCP Tool:

mcp__dependency-mapper__analyze({
  project_path: "./project",
  include_security: true,
  detect_circular: true,
  visualization_format: "html"
})

Architecture

Phase 1: Discovery

1. Detect project type and package manager
2. Locate manifest and lock files
3. Parse dependency declarations

Phase 2: Extraction

1. Extract direct dependencies
2. Resolve transitive dependencies
3. Build dependency tree structure

Phase 3: Analysis

1. Detect circular dependencies
2. Identify duplicate dependencies
3. Check for outdated packages
4. Analyze dependency depth

Phase 4: Security

1. Query vulnerability databases
2. Check license compliance
3. Identify supply chain risks
4. Generate security scores

Phase 5: Visualization

1. Generate graph data structure
2. Create interactive HTML visualization
3. Export SVG/PNG diagrams
4. Generate dependency reports

Output Formats

JSON Report:

{
  "project": "my-app",
  "package_manager": "npm",
  "total_dependencies": 847,
  "direct_dependencies": 23,
  "vulnerabilities": {
    "critical": 0,
    "high": 2,
    "medium": 5,
    "low": 12
  },
  "circular_dependencies": [],
  "outdated_packages": 15,
  "license_issues": 0,
  "dependency_tree": {...}
}

HTML Visualization:

Interactive D3.js graph with:

• Zoomable dependency tree
• Vulnerability highlighting
• Circular dependency paths
• Click-to-expand nodes
• Search and filter capabilities

SVG/PNG Export:

Static GraphViz-generated diagrams

Examples

Example 1: Basic Analysis

/dep-map ./my-project

Example 2: Security-Focused Audit

/dep-map ./my-project --security --format json

Example 3: Circular Dependency Detection

/dep-map ./my-project --circular --visualization svg

Example 4: Full Comprehensive Analysis

/dep-map ./my-project --security --circular --outdated --format html

Integration with Claude-Flow

Coordination Pattern:

// Step 1: Initialize swarm for complex analysis
mcp__claude-flow__swarm_init({ topology: "hierarchical", maxAgents: 4 })

// Step 2: Spawn agents via Claude Code Task tool
[Parallel Execution]:
  Task("Dependency Extractor", "Extract all dependencies from package.json and package-lock.json", "code-analyzer")
  Task("Security Auditor", "Run npm audit and cross-reference CVE databases", "security-manager")
  Task("Graph Builder", "Construct dependency graph and detect circular deps", "code-analyzer")
  Task("Visualization Generator", "Create interactive HTML dependency graph", "coder")

Configuration

Default Settings:

{
  "max_depth": 10,
  "include_dev_dependencies": true,
  "security_scan_enabled": true,
  "circular_detection_enabled": true,
  "license_check_enabled": true,
  "outdated_check_enabled": true,
  "visualization_default_format": "html",
  "cache_results": true,
  "cache_ttl": 3600
}

Performance Considerations

• Caching: Results cached for 1 hour by default
• Parallel Processing: Multiple package managers analyzed concurrently
• Incremental Analysis: Only re-analyze changed dependencies
• Lazy Loading: Visualization loads nodes on-demand for large graphs

Error Handling

• Graceful degradation if package manager unavailable
• Fallback to partial analysis if network issues
• Clear error messages for invalid project structures
• Retry logic for transient failures

Best Practices

1. Run dependency mapping before major releases
2. Integrate into CI/CD pipelines for automated auditing
3. Set up alerts for critical vulnerabilities
4. Review circular dependencies regularly
5. Keep dependency depth shallow (< 5 levels)
6. Audit licenses for compliance requirements
7. Update outdated packages incrementally

Troubleshooting

Issue: No dependencies found

Solution: Ensure lock files are present (package-lock.json, yarn.lock, etc.)

Issue: Visualization too large to render

Solution: Use --max-depth 5 to limit tree depth

Issue: Security scan taking too long

Solution: Use cached results or run offline mode

See Also

• PROCESS.md - Detailed step-by-step workflow
• README.md - Quick start guide
• subagent-dependency-mapper.md - Agent implementation details
• slash-command-dep-map.sh - Command-line interface
• mcp-dependency-mapper.json - MCP tool schema