codewithlogs.Stay in the loop
CodeWithLogs / Diagnostic workbench

package.json Inspector

See what a project declares before you install it. Review dependency patterns, configuration fields and script commands in one local, read-only inspection.

Client-side analysisNo account requiredNo AI serviceNo script execution

Read locally; nothing is installed or executed. No manifest text is sent by this tool, stored in the browser or placed in the URL. Remove private registry credentials and other secrets first. The site may still load its existing analytics.

0 / 100,000 characters

A manifest explains intent, not the installed tree

Paste the contents of package.json, then choose Inspect. This tool uses JSON.parse and fixed field checks. It summarizes dependencies, devDependencies, peerDependencies and optionalDependencies separately; counts are declarations rather than unique installed packages. It displays scripts as inert text, marks common install/prepare hooks and flags a few portability and command patterns for review.

A valid JSON document can still contain unsuitable package configuration. The inspector distinguishes JSON errors, field errors, warnings and informational notes. It does not look up packages, execute scripts, install dependencies, query a registry, or alter the manifest.

What do version patterns mean?

  • 1.2.3 is an exact declared release; ^1.2.3 and ~1.2.3 are ranges with different update boundaries.
  • *, partial versions and tags such as latest do not identify one immutable dependency tree.
  • file:, Git sources, remote URLs, npm aliases and manager-specific workspace protocols need their own source and tool checks.
  • Compound expressions are labeled without calculating which versions satisfy them. Unknown patterns are not silently accepted as valid.

Range categories are descriptive. Caret behavior differs for zero-major releases, and transitive dependencies can change even when direct declarations are pinned. Check the npm semantic versioning reference for full range rules.

What this inspection cannot establish

  • Dependency or peer compatibility: that requires package metadata, a resolver, a lockfile and actual tests.
  • Installed versions, vulnerabilities, package authenticity, license compliance, or whether a script is safe.
  • Complete npm schema/publish validation, all lifecycle hooks, workspace graph effects, overrides or manager-specific behavior.
  • Duplicate JSON keys: JSON.parse keeps the last value. Review source diffs or a duplicate-key-aware linter if that is a concern.
  • Your actual Node version. An engines declaration is shown without checking whether your runtime satisfies it.

Input is capped at 100,000 characters. Up to 200 entries per dependency field and 80 scripts are inspected; long displayed strings are shortened at 1,000 characters. Truncation is disclosed. No data is posted, stored or added to a URL by this tool. Existing site analytics may still load. Review the copied report for private names or script text before sharing it.

What to do after inspection

If npm reports ERESOLVE, compare the required peer range with the version in the log using the developer error decoder. Review the lockfile diff and test a focused change in a trusted checkout. A successful install does not replace application tests.

For build configuration, see Vercel deployment troubleshooting and Next.js project structure. These existing public articles remain unverified; local revised drafts have not been published.

Official references