Know every package
before it knows you.
Kistn keeps a living inventory of the software your projects ship — Composer, npm and WordPress — and watches it for vulnerabilities. Your tools do the collecting locally and push what changed. The server ingests, diffs, stores and enriches.
Three steps, fully async
Clients hash their local package list per ecosystem, ask which hashes differ, and push only what changed.
Collect locally
Native clients — a Composer plugin, the WordPress plugin, a JS collector — read your lock files and build a package list with content hashes. No agents phoning home.
Push what changed
One request fetches every ecosystem hash. The client posts only the ecosystems that differ. The server returns 202 and queues the work — ingestion is never blocking.
Ingest & enrich
Kistn diffs against the last known state, records an append-only event history, and matches installed versions against advisory sources to surface vulnerabilities.
One inventory, every ecosystem
A single project can span PHP, JavaScript and WordPress. Kistn tracks them side by side — and this is only the beginning.
Docker images, system packages, Python and more are on the roadmap. New ecosystems drop in by convention — every project you already run picks them up automatically.
Built to be quiet and honest
The design choices that keep the data trustworthy and the noise low.
Cross-project vulnerability sharing
A finding is stored once per package, version and advisory — then visible to every project running that version. Fix it once, learn about it everywhere.
Append-only history
Every added, updated and removed package is recorded as an immutable event. You can always answer "what did we ship, and when?"
Three vulnerability origins
Client-reported audits, optional server-side Composer/npm audits, and global advisory enrichment — all reconciled, with discrepancies flagged to the owner.
Lock files, archived
Clients upload gzip-compressed lock and manifest files alongside each push, so the server can re-audit and verify independently of the client.
Private packages stay private
Slugs confirmed absent from public advisory databases are scoped per-project — structurally invisible to everyone else sharing the platform.
Diff, don't dump
Content hashing means an unchanged project sends almost nothing. Only real changes travel the wire and hit the queue.
Start watching your inventory today.
Create a project, drop a token into your client, and let the pushes roll in.