Platform Features

Everything You Need to Own Your Dependency Risk

From real-time scanning to policy enforcement and threat intelligence — Meerkat covers the full dependency security lifecycle.

Dashboard

Projects Dashboard

Get a single-pane view of every scanned repository across all your repository groups. See dependency counts, ecosystems, versions, and violation status at a glance — no more hunting through individual project reports.

  • View all scanned projects with dependency counts and package ecosystems
  • Filter by group, ecosystem, scan status, or violation state
  • Drill into any project to see its full dependency list with versions
  • Tracks scan time, project activity, and incremental scan eligibility

Search

Hunt — Cross-Repo Package Search

When a CVE lands, every second counts. The Hunt feature lets you search for one or more package names — optionally pinned to a specific version — and instantly shows every repository that uses them. What used to take days now takes seconds.

  • Search by package name, optionally with a version constraint
  • Search multiple packages simultaneously in a single query
  • Results show project name, group, matched version, and ecosystem
  • Export results for incident response documentation

Policy

Allow List & Policy Enforcement

Define the exact set of dependencies your organisation has approved. Scope enforcement to specific repository groups or individual projects. The CI agent automatically gates builds on compliance — no unapproved package gets through undetected.

  • Curate approved packages per ecosystem with optional version constraints
  • Scope enforcement targets to groups or individual projects
  • CI agent fails builds that introduce unapproved dependencies
  • Allow-list violations are logged and notified separately from deny-list hits

Threat Intelligence

Vulnerability Threat Feed

Meerkat subscribes to a vulnerability intelligence feed and automatically adds newly flagged malicious packages to the deny list. No manual updates, no missed threats.

  • Polls the threat feed on a configurable schedule (default: hourly)
  • Malware-flagged packages are auto-added to the deny list
  • Affected project owners are alerted immediately
  • Admin can manually trigger a threat feed poll at any time

CI/CD Integration

CI Agent

A lightweight, single static binary that plugs into any CI pipeline. It triggers a rescan, checks the result against your deny and allow lists, and either passes or fails the build — giving developers immediate, actionable feedback.

  • Single binary, zero runtime dependencies — add one stage to your .ci-pipeline.yml
  • Pass/fail exit codes integrate natively with your CI platform's pipeline gates
  • Prints a human-readable summary of any violations
  • Optional --allow-failure flag for warn-only rollout mode
  • Writes a JSON artifact for pipeline traceability

Scanning

Continuous & Incremental Scanning

Meerkat keeps your dependency inventory fresh through multiple complementary scan modes. Webhook-triggered scans fire on every CI build. Nightly full scans cover every project. Incremental mode skips unchanged projects to keep scans fast at scale.

  • Webhook-triggered single-project rescans on every CI build
  • Nightly full scan covers every visible project as a fallback
  • Incremental scan compares last_activity_at to skip unchanged projects
  • Configurable worker concurrency for large tenant sweeps
  • Supports 8 package ecosystems out of the box

Alerts

Notifications

Meerkat notifies the right people at the right time through email (via a configurable email API) and chat notifications. Templates, recipients, and credentials are fully configurable from the admin Notifications page — no code changes required.

  • Email notifications via a configurable email API
  • Team chat channel alerts with resolution thread follow-ups
  • Fires on deny-list violations, allow-list violations, scan errors, and new threat feed malware
  • Configurable dispatch timeout and per-environment dev override
  • Full audit log of every notification dispatch

Reporting

Policy Reports

Generate human-readable reports of allow-list and deny-list entries, organised by ecosystem. Use them for compliance audits, security reviews, or internal governance documentation.

  • Allow-list and deny-list reports in one click
  • Grouped by package ecosystem for easy review
  • Suitable for internal audit and regulatory submissions
  • Available via API for automated pipeline integration

Ready to See Meerkat in Action? Request a Demo.

Request a Demo Read the Docs