# Tool matrix

| Tool | Stack | Purpose | Invocation policy |
| --- | --- | --- | --- |
| npm-check-updates | Node | Update declared versions | `pnpm dlx` per project directory; never recursive `dlx` |
| pnpm | Node | Install, audit, dedupe, signatures, SBOM, policy | Required; bootstrapped locally when absent |
| Syncpack | Node monorepo | Align versions and package metadata | `lint` by default, `fix` only with explicit fix mode |
| Knip | Node | Unused dependencies, files, exports | Report-oriented; nonzero findings are surfaced |
| Dependency Cruiser | Node | Cycles and architecture rules | Uses repository config when present, otherwise no-config analysis |
| Publint | Shared npm package | Package publication correctness | Runs only for detected shared packages |
| Are The Types Wrong | Shared npm package | Type/export compatibility | Full/deep profiles |
| JSCPD | Polyglot source | Duplicate code | Full/deep profiles, report-only |
| Renovate | npm and NuGet | Automated update PR configuration | Config generation only; no bot installation |
| Changesets | Shared npm packages | Versioning and changelogs | Created only for shared packages and never overwrites existing config |
| dotnet package/list | .NET | Outdated and vulnerable package analysis/update | Capability-detected native preference |
| dotnet-outdated | .NET | Update fallback | Installed in an isolated local tool path when needed |
| OSV-Scanner | Polyglot | Vulnerability scan | Used only when installed; absence is a warning |
| Trivy | Polyglot | Vulnerability, secret, config, license scan | Deep profile only and used only when installed |
| Stryker.NET | .NET | Mutation testing | Deep profile; local install only with `--install-tools` |