OSS Sentinel: Mapping Human Risk in Open Source Dependencies
What It Does
OSS Sentinel is a graph-powered AI agent that helps developers identify sustainability risks hidden inside their software supply chain.
Instead of focusing on known vulnerabilities, OSS Sentinel analyzes the people behind open-source packages. It identifies packages with low bus factors, inactive maintainers, growing issue backlogs, and weak project health signals that could become future points of failure.
Users upload dependency files such as package.json, requirements.txt, go.mod, or Cargo.toml. The system builds a knowledge graph connecting packages, repositories, contributors, and dependency relationships, then exposes the graph through a Neo4j Aura Agent for natural-language investigation.
The Problem
Incidents like Log4Shell and the xz-utils backdoor revealed that critical infrastructure often depends on projects maintained by a handful of volunteers.
Traditional dependency scanners answer:
Is this package vulnerable?
OSS Sentinel answers:
Is this package sustainable?
A package with millions of weekly downloads and a single inactive maintainer may represent a serious organizational risk long before a CVE appears.
Why Neo4j
This is fundamentally a graph problem.
Questions such as:
- Which dependencies in my project have only one active maintainer?
- What is the riskiest package in my dependency tree?
- Which critical packages haven't seen commits in the last year?
- How many hops away is a high-risk dependency?
require traversing relationships across packages, repositories, contributors, and transitive dependencies.
Neo4j enables these relationships to be modeled and queried naturally, while Aura Agent allows users to explore the graph using plain English.
Architecture
User Upload
│
▼
Dependency Parser
│
▼
External Data Collection
├─ deps.dev
├─ GitHub API
└─ npm / PyPI Statistics
│
▼
Risk Scoring Engine
│
▼
Neo4j AuraDB
├─ Package
├─ Repository
├─ Contributor
└─ Scan
│
▼
Neo4j Aura Agent
│
▼
Natural Language Risk Analysis
Graph Model
The graph contains:
- Package
- Repository
- Contributor
- Scan
Relationships:
- DEPENDS_ON
- HOSTED_AT
- MAINTAINED_BY
- INCLUDES
This structure allows dependency risk to be traced all the way from an application to the maintainers responsible for each package.
Risk Model
Each package receives a composite risk score based on:
- Bus Factor
- Maintainer Inactivity
- Open Issues
- OpenSSF Scorecard Health
Packages are categorized as:
- HIGH
- MEDIUM
- LOW
This makes it easy to identify critical dependencies requiring attention.
Aura Agent in Action
OSS Sentinel uses Neo4j Aura Agent as the primary interface for investigating dependency risk.
Instead of writing Cypher queries, developers can ask natural-language questions about their dependency graph.
Example questions include:
- Which package is riskiest?
- Find packages with bus factor 1.
- Are there dependencies with no commits in the last 12 months?
- Which dependency is a single point of failure?
- Show me risky packages in my dependency tree.
The Aura Agent translates these questions into graph operations and returns actionable insights backed by live dependency and maintainer data.
This allows developers to move from raw graph exploration to conversational risk analysis while still leveraging Neo4j's graph traversal capabilities underneath.
Screenshots
Aura Agent Configuration
Screenshot showing the Aura Agent running inside Neo4j Aura Console.
OSS Sentinel Dashboard
The dashboard visualizes overall package health, risk distribution, and dependency sustainability metrics.
Neo4j Knowledge Graph
Graph visualization showing packages, repositories, contributors, and dependency relationships stored in AuraDB.
Tech Stack
- Neo4j AuraDB
- Neo4j Aura Agent
- FastAPI
- MongoDB Atlas
- Next.js 16
- TypeScript
- Tailwind CSS
- GitHub API
- deps.dev
- npm Registry
- PyPI Statistics
What Makes This Different
Most software supply-chain tools focus on security vulnerabilities.
OSS Sentinel focuses on sustainability vulnerabilities.
By mapping dependency trees to the people maintaining them, OSS Sentinel helps teams identify succession risk, maintainer burnout, and critical single points of failure before they become security incidents.
Try it out: GitHub - isthatananya/packages-intel · GitHub