GitHub Action · free for public repos

Catch risky Rust dependencies in the pull request, not in production

Tensorust Cargo Check comments on every PR that touches Cargo.toml or Cargo.lock: security advisories for the exact locked versions, yanked and outdated crates, licenses, the newest MSRV, and every new dependency the PR pulls in. One comment, kept up to date. No Rust toolchain, done in seconds.

Short answerAdd one workflow file (below). Free on public repos; private repos need a key at $9 a month per repo. Each finding links to the page that explains it: the advisory and its fix, the crate's real use, its feature flags.

Set it up in one minute

Pick what you want, copy the file to .github/workflows/cargo-check.yml, open a PR that bumps a dependency.

Fail on security advisories Fail on yanked versions Fail on copyleft licenses Private repo

name: Cargo Check
on:
  pull_request:
    paths: ['**/Cargo.toml', '**/Cargo.lock']

permissions:
  contents: read
  pull-requests: write

jobs:
  cargo-check:
    runs-on: ubuntu-latest
    steps:
      - uses: Mattbusel/tensorust-cargo-check@v1

Private repo: get a key ($9/month for this repo), then add it as a repository secret named TENSORUST_CARGO_CHECK_KEY. Without a key the check still passes and posts one line saying how to turn it on.

What the comment looks like

github-actions bot commented

Cargo Check: needs attention, 2 security advisories, 1 unmaintained or unsound notice, 13 a breaking release behind

Cargo.lock · 52 crates.io packages · newest MSRV in the tree: Rust 1.82 (windows-core)

Security advisories (2)

Crate	Locked	Advisory	Upgrade to
smallvec	1.6.0	RUSTSEC-2021-0003 Buffer overflow in SmallVec::insert_many	1.6.1
time	0.3.20	RUSTSEC-2026-0009 time vulnerable to stack exhaustion Denial of Service attack	0.3.47

Unmaintained or unsound (1)

rand

0.7.3

unsound: RUSTSEC-2026-0097 Rand is unsound with a custom logger using rand::rng()

A breaking release behind (13)

rand 0.7.3 → 0.10.3, getrandom 0.1.16 → 0.4.3, syn 2.0.119 → 3.0.9 ...

New dependencies in this PR (3 direct, 43 new in the lock file)

Added to Cargo.toml: chrono 0.4, rand 0.7 (features), smallvec =1.6.0

Licenses: no copyleft or missing licenses. Most common: MIT OR Apache-2.0 (41).

A real report: the fixture lock file in the action's tests (made with cargo generate-lockfile), checked Oct 24, 2026.

What it checks

Security advisories from OSV, which includes RustSec (the database cargo-audit uses) and GitHub advisories, matched to the exact versions in Cargo.lock, with the smallest upgrade that fixes each one.
Unmaintained and unsound notices, listed apart from real vulnerabilities so they do not cry wolf.
Yanked versions still sitting in the lock file, and crates a breaking release behind (by Cargo's own rule: a new major, or a new minor while on 0.x).
Licenses of every locked version, with GPL, LGPL, AGPL, MPL and other copyleft licenses, and missing ones, flagged.
MSRV: the newest rust-version in the tree, which is the oldest Rust that can build your project. See Rust versions.
New dependencies: what the PR adds to Cargo.toml, and every package new to Cargo.lock compared with the base branch.

Price

FreeEvery public repo, every feature, no key, no sign-up.

$9 / monthPer private repo. Same report. Cancel anytime from your key page.

Get the action on GitHub →Key for a private repo

Questions

Does my code leave GitHub?

No. It reads Cargo.toml and Cargo.lock through the GitHub API inside your own runner. Only crate names and versions go to crates.io and OSV. For private repos, the key and repo name come to us to check the key, and we store nothing.

How is this different from cargo-audit or cargo-deny?

Those are great on the command line and in CI logs. This puts advisories, licenses, yanked and outdated crates, MSRV and new dependencies in one comment on the PR, where the reviewer already is, with no Rust install and nothing to configure.

Can it block a merge?

Yes: fail-on: advisories (also yanked, unmaintained, copyleft) fails the check, and a branch rule turns that into a block.

Pull requests from forks?

GitHub gives forks a read-only token, so the comment cannot be posted there; the full report still lands in the job summary.

Next steps

Want a one-off check right now? Paste a Cargo.toml or Cargo.lock into the free checker.
An advisory already flagged? Every RustSec advisory, with the exact fix.
Picking a crate? Real downloads for 1,000 crates.

Up next

Try it right nowCargo.toml checkerPaste a Cargo.toml or Cargo.lock and get the same report in your browser.Read it next →

Also worth your time

Did this answer your question?