Lopper shows where a repository declares dependencies it barely uses.
Point it at a repository to compare manifests with imports, rank the largest gaps, and produce a report for local investigation or CI. It runs locally and supports a CLI, terminal UI, GitHub Action, and MCP server.
- Scan one language or every detected adapter in a repository
- Rank dependencies by unused surface, with confidence and policy context
- Export table, JSON, CSV, SARIF, and preview CycloneDX reports
- Compare results with a saved baseline in CI
- Inspect a result in the TUI or through an MCP client
- Review results before removing dependencies; a low-usage score is evidence to inspect, not proof that removal is safe
macOS and Linux with Homebrew:
brew tap ben-ranford/tap
brew install lopperFor the rolling build, which tracks main:
brew install ben-ranford/tap/lopper-rollingOn Windows, download the appropriate asset from the latest GitHub release.
To run Lopper without installing it:
docker run --rm ghcr.io/ben-ranford/lopper:latest --helpRank the 20 dependencies with the most unused surface:
lopper analyse --top 20 --repo . --language allInspect one dependency:
lopper analyse lodash --repo . --language js-tsOpen the terminal UI:
lopper tui --repo . --language allWrite a machine-readable report:
lopper analyse --top 20 --repo . --language all --format json > lopper.json
- uses: ben-ranford/lopper@v1
with:
version: action
repo: .
language: all
top: "20"For reproducible CI, pin both the action and version to a concrete release. The CI guide covers baselines, PR comments, threshold gates, and SARIF uploads.
js-ts, python, cpp, jvm, kotlin-android, go, php, ruby, rust, dotnet, elixir, swift, dart, and powershell.
Use lopper --help for the current adapter IDs and options. --language auto selects the highest-confidence adapter; --language all merges results from every matching adapter.