PackageMedicDocs
v0.6.1GitHub
Documentation · v0.6.1

Diagnose the graph with confidence.

Everything needed to install PackageMedic, choose a workflow, define repository policy, and integrate the result into CI.

Quick start

Install the stable .NET tool and point doctor at a project, solution,.slnx file, or directory. Omitting the path scans the current directory.

Terminal
dotnet tool install --global PackageMedic.Tool --version 0.6.1
package-medic doctor ./MySolution.sln

Choose a workflow

01

Run the first scan

Install the global tool, select a project or solution, and understand the result.

Open guide →02

Define team policy

Commit one configuration, tune rules, and document intentional exceptions.

Open guide →03

Adopt gradually

Keep existing findings visible while CI rejects only new dependency problems.

Open guide →04

Automate pull requests

Publish annotations, a job summary, JSON, SARIF, and optional Code Scanning results.

Open guide →05

Gate dependency impact

Trace causal package paths, measure blast radius, and enforce source-trust policy.

Open guide →06

Simulate before editing

Restore-validate one exact package candidate in disposable snapshots without changing the checkout.

Open guide →07

Run verified experiments

Review the 0.6 restore, build, test, CycloneDX, and evidence contracts.

Open guide →

What 0.6 can inspect

Dependency policy

Unused central versions, drift, CPM bypasses, duplicates, floating versions, and restore problems.

Resolved inventory

Direct and transitive packages by project, framework, runtime identifier, and dependency kind.

Known vulnerabilities

Official NuGet audit evidence, advisory URL, severity, target framework, and direct/transitive context.

Deprecated packages

Official NuGet reasons, critical-bug severity, dependency kind, and source-provided replacement guidance.

PR graph changes

Added/removed packages, upgrades, downgrades, dependency-kind transitions, risk deltas, and CPM changes.

Dependency Impact Gate

Causal paths, blast radius, source provenance, growth budgets, source mapping, and locked-restore policy.

Dependency Time Machine

Exact-version restore simulation in two isolated snapshots with byte-preserving declaration edits.

Verified experiments

Opt-in comparative restore, build, and bounded structured test evidence over immutable snapshots.

Portable evidence

Deterministic CycloneDX 1.7 NuGet inventory and unsigned in-toto analysis statements.

Repository policy

Configuration, exclusions, justified suppressions, portable baselines, and new-only gates.

CI-ready reports

Readable text, stable JSON, deterministic SARIF, GitHub annotations, summaries, and artifacts.

How a scan works

  1. 1
    Discover

    Resolve the selected projects without leaving the analysis root.

  2. 2
    Restore and evaluate

    Use the active .NET SDK, MSBuild model, imports, conditions, and target frameworks.

  3. 3
    Read the graph

    Inspect NuGet's resolved project.assets.json evidence.

  4. 4
    Apply policy

    Classify rules, suppressions, baselines, and configured failure thresholds.

  5. 5
    Explain impact

    Trace changed transitives to their direct root and evaluate repository trust policy.

  6. 6
    Report

    Return text, JSON, SARIF, or a Git comparison with a stable exit code.