VoriTools

package.json Inspector & Dependency Analyzer

Paste package.json to list its dependency sections, scripts, engines and packageManager, and to see which versions are unbounded or referenced outside the registry. The tool reads the manifest text only: it does not install packages, run scripts, resolve versions or query the registry.

Runs locally in your browser
View category: DevOps & Diagnostics (18)
This tool processes all data locally in your browser.
package.jsonPaste a package manifest to inspect scripts, dependency sections, engines and common release risks.
Dependencies and scripts

How to inspect a package.json manifest

Paste a package.json manifest and press Analyze locally. The text is parsed with the browser own JSON parser; nothing is installed, no script is run, no registry is contacted and the manifest never leaves the page.

The Package report shows a summary of name, version, packageManager, engines, dependencyCounts and scripts, three tiles for the dependency, script and package-manager counts, and a findings list that names each flagged dependency with the version string exactly as it was written.

  1. Paste the manifest into the package.json box, or press Load example for a manifest with zod and vite, a test and a build script, engines.node >=20, packageManager pnpm@9 and no license field.
  2. Press Analyze locally. Load example analyzes the sample right away.
  3. Read the three tiles: how many dependencies the four dependency sections declare, how many scripts are defined, and whether packageManager is set.
  4. Work through the findings list. Every entry names the dependency and the version string, so ^3.23.0 is reported as written.
  5. Scroll to Dependencies and scripts for one row per dependency (section, name, version) and one row per script. Copy puts the summary JSON on the clipboard.

What the report counts and what it flags

What is read from the manifest

The four dependency sections - dependencies, devDependencies, peerDependencies and optionalDependencies - are read in that order together with scripts, so a package that appears in two sections is listed twice, once per section.

The summary repeats the count per section and the field names of the manifest itself, which is what makes it comparable with the file you pasted. Everything is printed as declared: ranges are not expanded, versions are not resolved and no field is rewritten.

What the findings flag

"*" and "latest" are reported as unbounded, and references that leave the registry or point into a workspace (github:, https:, git+, file:, workspace:, link:, portal:) are reported for review. A missing engines.node range, a missing license and a section that is not an object are reported as well; the last one is also skipped.

Caret, tilde and comparison ranges such as ^1.2.3, ~1.2.0, >=1 <2 or 1.x are not flagged - they are bounded by their own syntax - and an npm: alias counts as a registry reference. Nothing is compared against the latest published version.

Limits

The inspector reads the manifest text only. It does not install packages, run scripts, resolve versions, read a lockfile (use the Lockfile Analyzer for that) or scan dependencies for vulnerabilities.

It does not validate the manifest against the npm schema either: fields such as overrides, resolutions or workspaces are not inspected, and the JSON must be strict - comments and trailing commas are rejected with the parser message.

Recent tools: