CURRENT CAPABILITIES

What Marshal does today, stated plainly for developers evaluating the tool.

What works now

  • +

    Maven (pom.xml) and Gradle (build.gradle(.kts)) scanning at full parity.

  • +

    7 behavioral rules scoring each dependency 0 to 100 (maintainer changes, signature drops, dependency surface growth, repository changes, version jumps).

  • +

    GitHub Action posts a PR comment with the risk delta and fails the check on risky updates (exit code 1). Composite action for Maven and Gradle.

  • +

    Terminal, JSON, and Markdown output formats. Slack webhook alerts.

  • +

    Whitelist/suppression with an audit trail. JSON records which rule matched, the reason, and expiry.

  • +

    Open-source CLI and GitHub Action (Apache 2.0). Runs fully offline for cached packages.

Current limits

  • -

    Maintainer-change detection currently keys on signing-key change only. Same-organization key rotations (e.g. Apache re-keying across a long release gap) can produce false positives.

  • -

    JVM ecosystems only. Maven and Gradle. Other ecosystems are not supported.

  • -

    Behavioral analysis is static. Slow long-game social-engineering attacks (XZ-style) are only partially detectable with static signals. This is documented and the limitation is real.

VERSION HISTORY
v0.3.0 July 2026
  • · Maven scans resolve the full transitive dependency graph, the same way Gradle scans already did.
  • · Findings on transitive dependencies show which declared dependency introduced them, with the full path.
  • · A dependency whose metadata cannot be read is scored and flagged; its unscanned subtree is reported instead of skipped silently.
v0.2.0 June 2026
  • · Gradle support at full Maven parity: scan, diff, and GitHub Action.
  • · Composite GitHub Action for Maven and Gradle.
  • · Exit-code contract: 0 clean, 1 findings, 2 usage error, 3 resolution failed.
  • · Version stamping corrected. Empty-diff PR comment noise removed.
v0.1.0 June 2026
  • · First release. Maven pom.xml scanning, 7 behavioral rules, risk scorer.
  • · Three output formats: terminal, JSON, Markdown.
  • · GitHub Action with PR comments. Slack webhook. SQLite cache.
  • · Two false-positive bugs caught and fixed before launch.