trawld
catch vulnerable dependencies before they catch you
trawld launched on May 29, 2026 with 4 votes, #2,419 of 20,538 launches that month and more than 75% of that year's launches.
What it does
most dependency scanners run in CI. trawld runs on the machine. install the agent once globally and it watches every project you have, npm and pip, cross-references against the OSV database, and streams findings to a live dashboard across all your machines. no config, no pipeline setup. it also queues remediation commands through the agent's heartbeat loop so fixes reach machines without needing persistent server connections. built for developers who vibe-code fast and forget to audit.
trawld monitors every machine on your team, scans packages against the OSV database, and surfaces vulnerable dependencies before they reach production.
trawld watches every machine on your team, scans packages against the OSV database, and surfaces vulnerable dependencies before they reach production. Works on Linux, macOS, and Windows. No app-level code changes required. One-click Vercel deploy. Point it at a MongoDB database and you're done - it serves the dashboard and accepts agent connections. Global npm package. The setup wizard chooses project folders, configures startup, and enrolls the machine with your cloud instance. Your machine appears in the fleet, packages are indexed, and vulnerabilities are matched against OSV. Live heartbeats keep status current. Every feature ships by default. Nothing to configure beyond the initial…from trawld.vercel.app
Does a similar job
all alternatives →
Dependency CI – Continuous testing for your dependencies2016 · dependencyci.com · ▲198SonarQube provides advanced SAST, SCA & secrets detection to secure your SDLC. Scan 40+ languages for vulnerabilities. Start your free trial today.
ReplicasJun 2026 · replicas.dev · ▲239Hey HN! I'm Connor, creator of Replicas. I'm a heavy Codex/Claude Code user, and I wanted to hand off tasks to agents like I would to an engineer - kick something off before work, let it scaffold while I'm at lunch, even come back to a ready PR. The problem: existing alternatives use workspace VMs that are black boxes. I have no access to any of them - they can't run tests, read logs, or use tools like the Playwright MCP (which I use to verify agents actually fixed what they claim to fix). Replicas gives agents real cloud workspaces where they can: - Run your test suite and read the…
Dependabot – Automated Dependency Update PRs for Ruby, JS, Python and PHP2017 · dependabot.com · ▲51GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.
Continue – Source-controlled AI checks, enforceable in CIFeb 2026 · docs.continue.dev · ▲44We now write most of our code with agents. For a while, PRs piled up, causing review fatigue, and we had this sinking feeling that standards were slipping. Consistency is tough at this volume. I’m sharing the solution we found, which has become our main product. Continue (https://docs.continue.dev) runs AI checks on every PR. Each check is a source-controlled markdown file in `.continue/checks/` that shows up as a GitHub status check. They run as full agents, not just reading the diff, but able to read/write files, run bash commands, and use a browser. If it finds…
More dev tools this month
the category →
Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.
Dev tools · 1d ago · github.com
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 29d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 27d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 24d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 22d ago · talanoa.email
Source: Product Hunt launch ↗
Launched alongside, May 2026
the whole month →
Parallel agents, diff reviewer, and multi-model comparisons
Dev tools · May 2026 · kilo.ai
Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…
Life & fun · May 2026 · github.com
🌱 Private, quiet space for thinking. Simple app for .md files. - zakirullin/files.md
Dev tools · May 2026 · github.com