Develra v0.1.0

Develra v0.1.0

Develra is a local-first lockfile and scanner for the external APIs, SDKs,
endpoints, outbound webhooks, and MCP servers a repository appears to depend
on. The first release works without an account, hosted backend, API key, or
source upload.

Highlights

• Run npx develra scan to create a deterministic, reviewable
  develra.lock.
• Run npx develra check to enforce the committed inventory in local or CI
  workflows.
• Scan JavaScript, TypeScript, Python, raw HTTP endpoints, webhook-like URL
  configuration, and static project-level MCP JSON.
• Distinguish confirmed, probable, and possible evidence instead of
  treating installation as active use.
• Preserve unknown external hosts so unsupported services remain visible.
• Generate console, JSON, Markdown, standalone SVG, and SARIF reports.
• Use develra-dev/develra@v0 as a bundled, read-only GitHub Action.
• Extend detection through schema-validated declarative provider packs.

Initial provider catalog

Anthropic, Clerk, GitHub, OpenAI, Resend, Shopify, Slack, Stripe, Supabase, and
Twilio.

Privacy and safety

Default scans are offline and telemetry-free. Develra does not execute project
code, lifecycle scripts, binaries, or MCP servers. It rejects filesystem
escapes and does not write source snippets, environment values, authorization
headers, tokens, URL queries, or absolute local paths into the lockfile.

Known limitations

• Detection is shallow and intra-file; dynamic values and whole-program alias
  propagation are intentionally not evaluated.
• Yarn and resolved Python lockfile parsing are deferred.
• MCP support covers static project-level JSON configuration, not server
  execution or live schema negotiation.
• Unknown custom domains remain unknown rather than being guessed.
• Provider coverage is deliberately conservative and will grow through tested
  provider-pack contributions.

Verify the release

npx develra@0.1.0 --version
npx develra@0.1.0 scan

Full documentation and source: https://github.com/develra-dev/develra