the colony watches its own

SBOM-as-fingerprint for your fleet.

meerkat scans every machine's dependencies, matches them against known vulnerabilities, and answers "which machines have this CVE?" in seconds.

Try the live demo GitHub

What it is

A single binary runs on each machine, inventories the software dependencies it finds, and ships that inventory to a central server. The server matches every package against OSV, records which machines are affected, and exposes a dashboard. When a new CVE drops, you already know who's exposed.

Inspired by how meerkat colonies work: every member scouts its surroundings and alerts the group, while a sentinel keeps the collective view.

The two actors

client

Scout

meerkat scan on a machine walks the filesystem, detects projects from lock files, builds an inventory of dependencies, and uploads it. Runs once or on a schedule.

server

Mob

meerkat server receives inventories, matches against OSV, stores everything in SQLite, emails alerts on new vulns, and re-matches offline machines against fresh data.

The server never reads filesystems; the client never matches vulnerabilities. They talk over one HTTP endpoint with a bearer API key.

How it works

  1. Walk & scan. The client detects projects from lock files and runs Syft on each, with a content-hash cache so repeat scans are fast.
  2. Upload. The deduped inventory is POSTed with the bearer key; on network failure it queues to disk and drains later.
  3. Match. The server queries OSV per PURL, groups by canonical CVE, and computes a CVSS-derived exposure score.
  4. Alert. When an endpoint gains a new vulnerability, the affected fleet gets an email.
  5. Passive rematch. A timer re-evaluates powered-off machines against current OSV data, so they're flagged even while offline.

What it scans

Project-tier dependencies, resolved from lock files:

Ecosystem Detected from
npm package-lock.json · yarn.lock · pnpm-lock.yaml
PyPI poetry.lock · Pipfile.lock · uv.lock
Cargo Cargo.lock
Go go.sum
Conan (C/C++) conan.lock · conanfile.txt/.py

Development status

alpha

meerkat is alpha and built for research. It works and is useful today, but the scope is intentionally narrow and the data model still moves. It scans project dependencies only — not yet everything you'd expect from a production-grade security tool.

Today

  • + Lock-file dependency scanning (5 ecosystems)
  • + OSV matching with canonical-CVE grouping
  • + CVSS-derived exposure scoring
  • + Email alerts & passive rematch
  • + Dashboard + JSON API, macOS & Linux

On the way

  • ~ System packages (dpkg / rpm / apk)
  • ~ Global installs (brew, npm -g)
  • ~ Windows support
  • ~ Deeper C/C++ + Conan coverage
  • ~ Daily full-machine scanning

Try the live demo

A hosted instance with synthetic data — a fake fleet built from sample lock files — is up so you can try the dashboard without installing anything. Sign in with this read-only key:

mk_XduLgOubsKHYZMfQy0ERYAri8P2jl54u Open demo →

Guest, read-only: browse everything, but writes are blocked. All data is synthetic — nothing here is a real machine.