Every language brings its own linter, its own audit command, and its own configuration, and none of them agree on what a finding looks like or which ones block a merge. The result is a wall of warnings that nobody owns and a gate that means something different in each repository.
A vulnerability audit needs the dependencies installed, so it runs late and slowly, or not at all on the branch where it would matter. A lockfile that drifted from the registry's hashes passes it anyway, because nothing compares the two.
Each tool has its own severity scale, its own exceptions file, and its own exit codes. A team that ships JavaScript, C#, and Python maintains three gates that cannot be read side by side, and the rule that was relaxed in one is still strict in another.
Code-quality numbers exist and are ignored, because a number without a diagnosis and a threshold is a report, not a gate.
The Dependably check tools are small command-line checkers, build-free by default, one per job, that read the same .dependably configuration and emit the same JSON finding format, so a rule, an exception, and a gate mean the same thing in every repository they run in.
npm-check validates, migrates, and repairs package-lock.json, verifies locked hashes against the registry's own, and scans locked versions for vulnerabilities, deprecations, and licence violations, with no node_modules and no npm audit subprocess. nucheck does the same for NuGet, matching four-part versions and interval ranges the way NuGet does, against the GitHub Advisory Database or OSV.
npm-check · nucheckcslint enforces every key in your .editorconfig, runs syntactic security checks that need no build step, loads the project through Roslyn for deeper analysis when asked, and scans for repository hygiene such as silently skipped tests. pycheck finds unused imports and validates committed packaging configuration.
cslint · pycheckcodemetrics computes cyclomatic and cognitive complexity, Halstead volume, maintainability index, coupling, and cohesion for C# from one command, and turns them into diagnoses such as a god class or an unmaintainable hotspot, each with a severity you can gate on.
codemetricsEvery tool discovers one .dependably file at the repository root, reads a common section and its own, applies the same rule and exception grammar, and emits findings in one JSON envelope. A gate configured once reads the same in CI for each of them.
.dependably · --format jsonFindings from every language arrive in the same shape, with the same severity scale and the same exceptions, so what blocks a merge is a decision made once.
npm-check is on npm, and nucheck, cslint, and codemetrics are .NET tools on NuGet; pycheck is built from source. All are open source on GitHub under the Dependably organization, and they share one configuration contract and one finding schema.