Most of what your app runs is code your team never wrote. It comes from open-source packages, and those packages pull in other packages you have never heard of. A normal scanner lists a vulnerability for every one of them. Moolé does something simpler and smarter. It checks whether your code actually calls the broken part, and only flags the ones that can reach you.
In a modern application, it is normal for 80% or more of the shipped code to be open-source. You install a handful of packages, and each of those quietly brings along dozens more underneath. A traditional scanner reads that whole pile, matches every package against a list of known flaws, and grades each one by a generic severity score. The result is a wall of "critical" findings. But a critical flaw in a function your code never runs cannot hurt you. So teams spend their week chasing red badges that were never a threat, while the one that matters sits in the same undifferentiated list.
Reachability is the whole trick. Three packages here carry a "critical" CVE. Only lodash sits on a path your code actually runs, so it is the only one that can be exploited. The other two are shipped in your build but no line of your code ever calls them, so they cannot do anything. A generic scanner would page you for all three. Moolé shows you the one.
A list of every known flaw.
Or the few you actually call.
SCA in Moolé is not a single scan. It is three jobs working together: find everything you depend on, decide what is genuinely worth your time, and give you the paperwork to prove it.
Auto-scans your repositories and maps the full dependency graph, including the hidden transitive packages your direct dependencies pull in. It finds manifests and lockfiles on its own, so nothing you actually ship gets missed.
Ranks findings by real business impact using runtime reachability. It de-duplicates the same CVE showing up in ten places, and separates code that reaches production from packages that only exist in your dev and test tooling.
Generates an audit-ready Software Bill of Materials in SPDX and CycloneDX, tied to a specific build so you know exactly what shipped. It detects package licenses and enforces org-level policy across every repo.
Here is the exact situation from the graph above, the way each side of the industry handles it. One package is present but never called. One is genuinely reachable. Watch what happens to your sprint.
One of these packages was never a threat, and Moolé says so plainly instead of making you prove it. The other is real, so Moolé does the boring part for you and opens the upgrade as a pull request.
Findings live in the pull request and the pipeline, not in a portal your team forgets to open. Four ways Moolé fits into a normal day.
When a change adds or bumps a dependency into risky territory, Moolé gates it right on the pull request, so a bad package never quietly merges to main.
For reachable issues it opens a safe upgrade as its own pull request, and bundles related bumps together so you review one clean change instead of ten.
Rolls up findings across hundreds of repositories into one place, so a platform or security lead can see where real dependency risk actually sits.
Reads the license of every package it finds and flags the ones that break your policy, so a copyleft surprise does not reach production unnoticed.
Other tools hand your team homework.
Moolé hands them a merge button.