Built with IBM Bob · IBM Bob 2.0 Hackathon

DepTax

Measures how much of each dependency your code actually uses — and what removing it would really free.

npm · pnpm · yarn Python · pip · Poetry · uv Flutter / Dart

DepTax — live scan result

date-fnsimported only for format()

Parasitic

96 KB / 1.8 MB

21.1 MBwould be freed

quiverFlutter · imported only for isBlank()

Parasitic

4 KB / 191 KB

460 KBwould be freed

axiosused across 22 call sites

Healthy

396 KB / 437 KB

—

Live · real scan output

Explore real DepTax reports.

These are the actual .deptax/deptax_report.json files produced by running DepTax against three real test projects — one per ecosystem. Switch tabs, filter by status, search, and click a package to see the exact symbols used and why it was flagged.

The problem

One helper function brings its whole codebase with it.

A package added for one function brings its entire codebase — and everything it depends on — into every install, build and release. Existing tools only ask "is this imported?" They never ask how much of it is used.

Bundle & binary bloat

Unused code still ships in every build, slowing downloads, startup and CI.

Supply-chain surface

Every dependency — direct or transitive — runs with your app's full privileges.

Maintenance churn

Every package is one more thing to update, audit, and keep compatible.

How it measures

Two numbers, in bytes, for every dependency.

R(P) = code reachable from P's public entry points (code carried) K(P) = the part of that code your imports actually reach (code used) u(P) = K / R = utilization

K comes from a declaration-level liveness analysis — the same idea a bundler's tree-shaking uses — following your real import statements. What removal would free comes from the dominator tree of the dependency graph, so a package another dependency also needs is never double-counted.

Real results

Measured on real installed packages.

Across three ecosystems — not illustrative numbers.

Package	Status	Code used	Removing it frees
date-fnsimported only for format()	Parasitic	96 KB / 1.8 MB	21.1 MB
lodash-esimported only for debounce()	Parasitic	15 KB / 613 KB	621 KB
quiver Flutter · imported only for isBlank()	Parasitic	4 KB / 191 KB	460 KB
richPython · never imported	Unused	—	1.4 MB
axiosused across 22 call sites	Healthy	396 KB / 437 KB	—
react	Healthy	135 KB / 178 KB	—

How it's built

One engine, three ecosystems.

Package graph

Resolve installed packages the way each runtime does: Node resolution, Python RECORD files, Dart package_config.json.

Liveness analysis

Tree-shaking style pass over Tree-sitter ASTs (TS/JS/Python) and a purpose-built Dart lexer.

Dominator tree

Cooper–Harvey–Kennedy algorithm computes what removing each package would actually free.

Verdict

Inline diagnostics, a ranked sidebar, a full report, and a status-bar badge — right in the editor.

Built to be trusted

Verified, not just claimed.

28automated tests

5,000random differential tests vs. real lodash

3ecosystems, one engine

0network calls — fully local