One tool, focused commands.
Use doctor for policy and optional deprecations, audit for known vulnerabilities, diff for PR graph changes, and supporting commands for repeatable adoption.
doctor
Runs the complete dependency diagnosis and optionally includes vulnerability evidence.
package-medic doctor [path] [options]
package-medic doctor . --format json --output artifacts/medic.json
package-medic doctor . --audit --include-transitive
package-medic doctor . --deprecated --include-transitive
package-medic doctor . --format json --sarif-output artifacts/medic.sarifaudit
Requests official NuGet vulnerability data from the active SDK. Direct packages are included by default; add --include-transitive for the complete resolved graph.
package-medic audit ./MySolution.sln --include-transitive
package-medic audit . --format sarif --output artifacts/audit.sarif --fail-on errordiff
Compares the working graph with a safely materialized reachable Git reference without switching the checkout. It reports diagnostics, upgrades, downgrades, dependency-kind transitions, vulnerability/deprecation deltas, CPM changes, causal dependency paths, blast radius, source provenance, and the repository Impact Gate result.
package-medic diff origin/main ./MySolution.sln
package-medic diff v0.1.0 . --format json --output artifacts/diff.json
package-medic diff origin/main . --audit --deprecated --include-transitive --fail-on warningPackageMedic 0.6 can require comparative restore, build, or test evidence with --verify. See Verified experimentsfor immutable-snapshot requirements, verdicts, and safety boundaries.
A complete diff also evaluates the impact policy from.packagemedic.json. That gate remains active when--fail-on none disables diagnostic threshold failures.
simulate
Restore-validates one exact direct or centrally managed package version in two independent snapshots of the same clean HEAD. Dependency declarations, lock files, and restore assets in the checkout are never edited; only an explicit report--output may be written.
package-medic simulate <package-id> --to <exact-version> [path]
package-medic simulate Example.Package --to 2.0.0 ./MySolution.sln
package-medic simulate Example.Package --to 2.0.0 . --audit --deprecated --format json
package-medic simulate Contoso.Private --to 4.2.0 . --credential-env PRIVATE_FEED_TOKENThe command requires a clean committed tree and refuses ambiguous, conditional, dynamic, external, or transitive-only declarations. See the complete Time Machine guide for verdicts, lock files, private feeds, and isolation details.
Policy and reference commands
| Command | Purpose |
|---|---|
package-medic init [directory|file] [--force] | Create a starter .packagemedic.json without overwriting by default. |
package-medic baseline create [path] --output <file> | Capture reviewed current findings as a portable baseline. |
package-medic baseline update [path] [--baseline <file>] | Refresh an existing accepted state explicitly. |
package-medic rules | List PM001–PM008 and their default severity. |
package-medic explain PM008 | Show the explanation and next action for one rule. |
package-medic clean [path] --dry-run | Preview high-confidence cleanup candidates; never applies changes in 0.6. |
package-medic sbom [path] --output <file> | Write a deterministic CycloneDX 1.7 NuGet inventory after a complete analysis. |
Common scan options
| Option | Meaning |
|---|---|
--config <path> / --no-config | Select an explicit policy file or disable automatic discovery. |
--baseline <path> | Classify current findings against a portable baseline. |
--no-restore | Use existing project.assets.json files instead of restoring. |
--format text|json|sarif | Select the primary output format. |
--output, -o <path> | Atomically write the primary report. |
--sarif-output <path> | Also write SARIF from the same analysis. |
--sbom-output <path> | Also write CycloneDX from doctor, audit, or diff. |
--fail-on none|warning|error | Gate all effective diagnostics. |
--fail-on-new none|warning|error | Gate only diagnostics absent from the baseline. |
--audit / --deprecated / --include-transitive | Request official vulnerability or deprecation evidence and optionally transitive packages. |
--include-transitive-audit / --include-transitive-deprecated | Enable transitive evidence for only one audit when both are active. |
--credential-env <NAME> | Explicitly inherit and redact one private-feed variable in simulate; repeat as needed. |
--restore-timeout / --evaluation-timeout | Bound restore and per-MSBuild evaluation time from 1 to 3600 seconds. |
--max-parallelism <1-32> | Bound concurrent restore, audit, and MSBuild processes. |
--verbosity quiet|normal|detailed | Control progress and evidence detail. |