A common requirement for security and compliance audits is to produce a comprehensive list of direct dependencies across an organization's entire codebase. While Mend excels at vulnerability scanning within a single repository or project, generating a consolidated, organization-wide report of *only* direct dependencies (excluding the often-noisy transitive ones) is not a native feature in its UI.
The primary challenge is aggregation. Mend's data is project-centric. To get a holistic view, you must query its API for each project, extract the direct dependencies, and deduplicate the results. I've implemented this using the Mend REST API, as the Web UI does not support this cross-project reporting at scale.
Here is a conceptual Python script outline. You will need to generate an API key with appropriate scope (`org.read`) in your Mend (SaaS) instance and set your `ORG_TOKEN`.
```python
import requests
import pandas as pd
API_BASE = "https://saas.mend.io/api/v1.4"
ORG_TOKEN = "YOUR_ORG_TOKEN"
AUTH_HEADER = "Authorization"
API_KEY = "YOUR_API_KEY"
headers = {
AUTH_HEADER: API_KEY,
"Content-Type": "application/json"
}
# 1. Get list of all projects
projects_url = f"{API_BASE}/projects"
params = {"orgToken": ORG_TOKEN}
response = requests.get(projects_url, headers=headers, params=params)
projects = response.json().get('projects', [])
all_direct_deps = []
# 2. For each project, get its direct dependencies
for project in projects:
project_token = project.get('token')
product_name = project.get('name')
deps_url = f"{API_BASE}/dependencies"
params = {
"orgToken": ORG_TOKEN,
"projectToken": project_token,
"dependencyType": "direct" # Critical filter
}
response = requests.get(deps_url, headers=headers, params=params)
deps = response.json().get('dependencies', [])
for dep in deps:
dep['source_project'] = product_name
all_direct_deps.append(dep)
# 3. Deduplicate and output. Key is often 'libraryId' or name+version.
df = pd.DataFrame(all_direct_deps)
# Deduplication logic here, e.g., on 'name', 'version', 'keyUuid'
deduped_df = df.drop_duplicates(subset=['keyUuid'])
deduped_df.to_csv('organization_direct_dependencies.csv', index=False)
```
Important notes: The `dependencyType` parameter is crucial to filter out transitive dependencies. The exact field for deduplication (`keyUuid`, `libraryId`, etc.) depends on your Mend version and requires testing. For very large organizations, implement pagination on both the projects and dependencies endpoints.
This method provides an accurate, automated report. While it requires some engineering effort, it's more reliable and scalable than manual aggregation from individual project dashboards.
null