4DA-Systems/4DA

---
**4DA knows every dependency on your machine and tells you — and your coding agent — what changed and exactly what to run. Privately, locally.**
It reads npm, pnpm, Yarn, Bun, Cargo, Python and Go lockfiles today, with early support for Ruby and PHP; Maven, Gradle and .NET projects are not covered yet.
It reads the lockfiles across all your projects, checks the exact installed versions against OSV advisories and registry releases, and names the fix: the version that clears each advisory and, where the lockfile shows it, whether a lockfile refresh is enough or which parent package to upgrade. No account, and your source code never leaves the machine.
- **Version-confirmed findings.** An advisory counts only when the version in your lockfile falls inside its affected range. Dev-only and transitive copies are labelled as such, and a crate your build never compiles on this host is marked as unreachable rather than raised as urgent.
- **The fix, not just the alert.** Each finding carries the version that clears it (per release line, where a fix exists). The Upgrade Plan orders the work across projects and says when a transitive copy needs its parent upgraded instead.
- **The Brief.** One answer to "anything I need to do today?", grounded in those same facts.
- **Your coding agent sees it too.** The free, Apache-2.0 MCP server gives Claude Code, Cursor and other MCP hosts the same lockfile-grounded answers: what an upgrade changes, which of your files import the package, which vulnerabilities a bump fixes.
4DA also reads developer news (Hacker News, Reddit, RSS and 20+ other sources) and score it against your stack. That reading is a supporting extra that serves the engine, not the product; the scoring section below explains how it works.
The fastest way to try it
Already using Claude Code, Cursor, or Windsurf? One command:
This scans your project, detects your stack, and gives your AI assistant live vulnerability scanning, dependency health, upgrade planning, and ecosystem intelligence. No API keys. No accounts. Works standalone — no desktop app required. Full MCP documentation.
---
How It Works
Scoring
This section covers the news reading: articles, releases and discussions from 20+ sources, scored against what you actually build. Dependency findings above do not go through it; they come from your lockfiles and the advisory databases.
Benchmarked across 9 developer personas against a 245-item labeled corpus (1,997 scored evaluations): 93% of content is rejected, and 98.9% of labeled noise is correctly rejected. You can reproduce these figures in one command. When the engine improves, it re-judges everything it already holds: yesterday's noise becomes tomorrow's signal.
Four axes score each item today, with a fifth reserved. An item must pass **2 or more** to surface. Single-axis matches are hard-capped at 28% — no matter how strong one signal is, it cannot pass alone.
| Axis | What it measures |
|------|-----------------|
| **Context** | Semantic similarity to your active codebase |
| **Interest** | Alignment with your declared topics |
| **ACE** | Real-time signals from your Git commits and file edits |
| **Dependency** | Direct matches against your installed packages |
| **Learned** | Reserved — held out of scoring until it can be validated against your explicit feedback |
What passes the gate goes through 12 quality multipliers: content depth, novelty detection, competing tech penalties, title-body coherence, and intent scoring from recent work. Every constant is calibrated across 9 simulated developer personas with 245 labeled test items.
LLM Verification
After keyword scoring, an LLM layer verifies the top items against your full developer context — stack, dependency names, topics derived from your recent git activity (never the commit messages themselves), anti-technologies, and the titles of items you saved. Strict 1-5 rubric:
- **5 = MUST-READ**: Security alert for YOUR dependency, breaking change YOU must act on
- **3 = WORTH KNOWING**: Useful tool that fits YOUR exact stack
- **1 = NOISE**: Mentions your tech but isn't actionable
This is where the gold surfaces — articles the keyword pipeline misses because there's no keyword overlap, but the LLM understands the conceptual relevance to your specific project.