> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/packages/secure-registry/inventory.md).

# Inventory

{% hint style="info" %}
Inventory is in **Beta** and is labeled **Beta** in the **Secure Registry** menu.
{% endhint %}

The **Inventory** page lists every package your teams requested through Secure Registry, with the licenses and known vulnerabilities of each version. Use it to see which packages are in use across your organization, to find every version affected by a specific advisory, and to find every version requested under a specific license.

To open it, go to **Secure Registry** > **Inventory**.

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2Fu0dG1Bh59dYqmywTf7lh%2FScreenshot%202026-10-26%20at%2015.46.50.png?alt=media&amp;token=5539e66e-f468-4082-8a4a-f46a9e5dcce5" alt=""><figcaption></figcaption></figure>

#### Page summary

The line under the page title summarizes the inventory:

* **Package count:** the number of packages in the inventory.
* **Updated:** how long ago the inventory was last refreshed.
* **Collected since:** the date from which request data is available. Requests made before this date are not included.
* **Request counts are approximate:** a retried request can be counted twice.

### Searching the inventory

Use the **Search** selector to choose what the search box matches, then enter a value.

| Search mode     | What to enter                                                                        | What it returns                            |
| --------------- | ------------------------------------------------------------------------------------ | ------------------------------------------ |
| **Package**     | A package name                                                                       | Matching packages                          |
| **License**     | A Software Package Data Exchange (SPDX) license identifier, for example `Apache-2.0` | Every version requested under that license |
| **Advisory ID** | An advisory ID or one of its aliases, for example `CVE-2021-23337`                   | Every version the advisory affects         |

When searching by **License**:

* Matching is case-insensitive, so `mit` and `MIT` return the same results.
* The identifier also matches inside SPDX license expressions, so a search for `MIT` also finds versions whose license is declared as an expression that includes `MIT`.
* The page suggests common identifiers below the search box, including `MIT`, `Apache-2.0`, `BSD-2-Clause`, `BSD-3-Clause`, `ISC`, `MPL-2.0`, `LGPL-2.1-only`, `LGPL-3.0-only`, `GPL-2.0-only`, `GPL-3.0-only`, `AGPL-3.0-only`, and `EPL-2.0`.

When searching by **Advisory ID**, you can enter the advisory's primary ID or any of its aliases, such as a Common Vulnerabilities and Exposures (CVE) ID.

Instead of entering a license or advisory ID, you can pick a value in the **Vulnerabilities** filter to list every affected version.

#### Filters and sorting

* **Ecosystem:** limit the list to one ecosystem: **npm**, **PyPI**, **Maven**, **NuGet**, **Go**, **RubyGems**, **Cargo**, or **PHP (Composer)**. The default is **All**.
* **Vulnerabilities:** filter by vulnerability severity. The default is **Any**. The options are:
  * **Vulnerable:** versions with at least one known vulnerability.
  * **Low or worse**, **Medium or worse**, **High or worse:** versions with at least one known vulnerability of that severity or higher.
  * **Critical:** versions with at least one known vulnerability of critical severity.
* **More filters:** narrow the list further with these fields:
  * **Version contains:** match versions that contain the text you enter, for example `4.17`.
  * **License (SPDX id):** match versions under a Software Package Data Exchange (SPDX) license identifier, for example `MIT`.
  * **Advisory ID:** match versions affected by an advisory. The field accepts Common Vulnerabilities and Exposures (CVE) IDs, GitHub Security Advisory (GHSA) IDs, and the IDs used by the Python (PYSEC), Go (GO), and Rust (RUSTSEC) advisory databases.
  * **License status:** filter by license status. The default is **Any**.
  * **Minimum CVSS score:** match versions with at least one vulnerability whose Common Vulnerability Scoring System (CVSS) score is at or above the value you enter, from 0 to 10.
* **Sort:** change the order of the list. The default is **Last pulled**.

#### Inventory columns

| Column              | What it shows                                                                                            |
| ------------------- | -------------------------------------------------------------------------------------------------------- |
| **Package**         | The package name and its ecosystem. Hover over a long name to see it in full.                            |
| **Last pulled**     | The most recently pulled version, how long ago it was pulled, and the source identifier of that request. |
| **Requests**        | The number of package file requests and the number of metadata requests for the package.                 |
| **Licenses**        | The license of the requested versions.                                                                   |
| **Vulnerabilities** | Known vulnerabilities for the requested versions, or **No known vulnerabilities**.                       |
| **Blocked**         | Blocked requests for the package. A dash (**-**) means no requests were blocked.                         |

### Package details

Click a package to open its details panel. The header shows the package name, its ecosystem, and its license. When the package has known vulnerabilities, the header also shows a severity badge, for example **Critical**.

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FkqAmkqmtXW3PSiszemJI%2FScreenshot%202026-10-26%20at%2015.50.20.png?alt=media&amp;token=42ae8d5f-6aad-4eb4-a7f9-1debc1d27105" alt=""><figcaption></figcaption></figure>

#### **Summary**

| Card                      | What it shows                                                                                                                                                                                                                     |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **First seen**            | The date the package was first requested through Secure Registry.                                                                                                                                                                 |
| **Last pulled**           | The most recently pulled version and how long ago it was pulled.                                                                                                                                                                  |
| **Pulled by**             | The source identifier and source type (for example, **Developer Machine**) of the most recent pull. When a request carries no source identifier, this card shows the client Internet Protocol (IP) address and **No source set**. |
| **Package file requests** | The number of requests to download the package's files.                                                                                                                                                                           |
| **Metadata requests**     | The number of metadata requests, and how many of those responses were modified by a control.                                                                                                                                      |
| **Blocked requests**      | The number of blocked requests for the package. **Never blocked** means none were blocked.                                                                                                                                        |

To show a source identifier in **Pulled by** instead of an IP address, set up source attribution in your clients. See [Setting up source attribution](/packages/secure-registry/setup-guide.md#setting-up-source-attribution).

#### **Versions**

The **Versions** section lists every requested version of the package, newest pull first. Use **Filter versions** to find a specific version.

Each row shows the version, its vulnerability status, its license, its request count, and how long ago it was last pulled. A version with known vulnerabilities shows the number of advisories that affect it, for example **3 advisories**. A version with none shows **No known vulnerabilities** and when vulnerabilities were last checked.

Expand a row to see the details for that version:

* **Upgrade guidance:** a banner names the version to upgrade to, or later, to clear every advisory for this version. For example: "Upgrade to 16.4.1 or later to clear all 3 advisories for this version."
* **Advisories:** each advisory that affects the version, with:
  * its severity, for example **Critical** or **High**
  * its Common Vulnerability Scoring System (CVSS) score, or **No CVSS score** when the advisory has none
  * its title
  * its advisory ID and any aliases, for example a GitHub Security Advisory (GHSA) ID and a Common Vulnerabilities and Exposures (CVE) ID
  * **Fixed in:** the versions that fix it. An advisory can list a fix on more than one release line, for example `15.5.28` and `16.4.1`.
* **License and checks:** the version's license, and when the vulnerability and license checks last ran.

#### **Recent pulls**

The **Recent pulls** table lists the last five allowed pulls of the package.

| Column               | What it shows                                                                                                                                |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| **Time**             | When the pull happened, in Coordinated Universal Time (UTC).                                                                                 |
| **Version**          | The version that was pulled.                                                                                                                 |
| **Source**           | The source type (for example, **Developer Machine**) and the source identifier, or **No source set** when the request carried no identifier. |
| **IP (as reported)** | The client IP address, as reported with the request.                                                                                         |
| **Client**           | The client that made the request, as it identified itself (for example, `npm`).                                                              |

Blocked requests do not appear in **Recent pulls**. To investigate a blocked or modified request, and to see which control acted on it, use [Policy Evaluations](/packages/secure-registry/policy-evaluations.md).

### Request counts

Request counts on this page are approximate: a retried request can be counted twice. To review individual requests and the result of each control, use Policy Evaluations. For request totals over time, use [Statistics](/packages/secure-registry/statistics.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stepsecurity.io/packages/secure-registry/inventory.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.