NovacoastSearch across repositories
Explore libraries, versions, and ecosystems in a unified dependency view. Use Hunt to locate repositories that depend on a package under investigation.
Meerkat / Software supply chain insight
Know what your software depends on.
Meerkat brings open-source dependency inventory, vulnerability intelligence, and policy enforcement together across repositories. Find the packages that matter, understand where they are used, and give teams a clear path to act.
From individual packages to shared risk
A dependency finding is only useful if you know where it lands.
Third-party libraries connect projects to a much larger software supply chain. A newly disclosed vulnerability can affect multiple repositories, versions, and teams at once.
Meerkat aggregates dependency information across repository groups instead of leaving teams to reconcile isolated project reports. Its Hunt search helps identify the projects using a particular package so investigation can start with scope, not guesswork.
Meerkat supports software supply chain decisions. Findings still need context, ownership, and validation before a team chooses a remediation.
Core capabilities
Inventory, investigate, enforce.
Connect inventory to intelligence
Cross-reference discovered packages with known vulnerability databases and a vulnerability intelligence feed. Scheduled scans and webhook-triggered rescans keep findings connected to changing code.
Make policy actionable
Define approved-library allow-lists for groups or individual projects, use deny lists for disallowed packages, and check builds against active policy through a CI agent.
Three-step workflow
From repository discovery to a policy decision.
01 / DiscoverBuild the dependency picture
Scan repositories to inventory packages and versions. Refresh the picture through scheduled scans and build-related webhooks.
02 / EvaluateIdentify risk and scope
Compare inventory with vulnerability intelligence and library policy. Search affected projects and notify teams through configured email or chat alerts.
03 / EnforceBring decisions into CI
Have the CI agent check the latest stored scan result against active policy and return a pass or fail. Teams remediate dependencies and rescan to assess the change.
A CI policy check uses the most recent scan; it does not itself initiate a fresh scan. Scan cadence and webhook configuration matter to the freshness of that decision.
Security and governance
Turn dependency rules into a repeatable process.
Meerkat combines approved-library policies with a vendor-approval workflow covering security scorecards, country and organization checks, maturity ratings, and governance review. These controls help teams apply supplier decisions consistently across repositories.
Ecosystem-grouped policy reports support internal review. Malicious-package intelligence can feed the deny list, while configurable notifications bring policy violations, scan errors, and newly discovered threats to the responsible teams.
Coverage depends on supported repositories, package ecosystems, scan configuration, and available intelligence. Policy reports support governance work; they are not a compliance certification or a guarantee that software is free of vulnerabilities.
Where it fits
Shared visibility for the teams responsible for what ships.
Security and incident response
When a package becomes suspect, identify repositories using it and coordinate investigation with the teams that own those projects.
Platform and DevOps teams
Connect rescans and policy checks to delivery workflows so dependency decisions become part of the build process rather than a separate reporting exercise.
Risk and governance teams
Review supplier approvals, maintain approved-library policies, and use dependency reports as evidence for internal software risk discussions.
Questions, answered
Working with Meerkat.
How is Meerkat different from a per-project dependency scanner?
Meerkat aggregates dependencies across repository groups and adds organization-wide search, notifications, and policy enforcement. That shared view helps teams trace a package across projects rather than compare separate reports manually.
Is this just an SBOM snapshot?
No. Meerkat maintains a dependency inventory through recurring and webhook-triggered scans, connects that inventory to vulnerability intelligence, and uses policies in CI. Its focus extends beyond generating a point-in-time inventory.
Does the CI agent run a full scan on every check?
No. The agent asks the Meerkat server for a pass or fail based on the latest stored scan and active policy. Configure scans and webhooks to keep that underlying information current.
Can library approvals differ between teams?
Yes. Allow-lists can be scoped to repository groups or individual projects. Teams should establish who owns approvals and remediation decisions before introducing enforcement into delivery pipelines.
Make dependency risk visible
Start with the software your teams actually ship.
Talk with Novacoast about your repository landscape, dependency policies, and where Meerkat can fit into your development workflow.