lopper

README

Lopper

Lopper shows where a repository declares dependencies it barely uses.

Point it at a repository to compare manifests with imports, rank the largest gaps, and produce a report for local investigation or CI. It runs locally and supports a CLI, terminal UI, GitHub Action, and MCP server.

Highlights

• Scan one language or every detected adapter in a repository
• Rank dependencies by unused surface, with confidence and policy context
• Export table, JSON, CSV, SARIF, and preview CycloneDX reports
• Compare results with a saved baseline in CI
• Inspect a result in the TUI or through an MCP client
• Review results before removing dependencies; a low-usage score is evidence to inspect, not proof that removal is safe

Install

macOS and Linux with Homebrew:

brew tap ben-ranford/tap
brew install lopper

For the rolling build, which tracks main:

brew install ben-ranford/tap/lopper-rolling

On Windows, download the appropriate asset from the latest GitHub release.

To run Lopper without installing it:

docker run --rm ghcr.io/ben-ranford/lopper:latest --help

Start here

Rank the 20 dependencies with the most unused surface:

lopper analyse --top 20 --repo . --language all

Inspect one dependency:

lopper analyse lodash --repo . --language js-ts

Open the terminal UI:

lopper tui --repo . --language all

Write a machine-readable report:

lopper analyse --top 20 --repo . --language all --format json > lopper.json

Use it in GitHub Actions

- uses: ben-ranford/lopper@v1
  with:
    version: action
    repo: .
    language: all
    top: "20"

For reproducible CI, pin both the action and version to a concrete release. The CI guide covers baselines, PR comments, threshold gates, and SARIF uploads.

Supported languages

js-ts, python, cpp, jvm, kotlin-android, go, php, ruby, rust, dotnet, elixir, swift, dart, and powershell.

Use lopper --help for the current adapter IDs and options. --language auto selects the highest-confidence adapter; --language all merges results from every matching adapter.

More documentation

• CI and GitHub Action
• Repository configuration and threshold tuning
• Feature flags and release channels
• MCP server integration
• Runtime trace annotations
• Multi-repository dashboards
• Pull-request dependency review
• SARIF code scanning
• Report schema
• Language adapter architecture
• Contributing