cargo-deny review
A Rust-focused policy checker for Cargo dependency graphs, with CI and pre-commit support.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Rust teams that need policy checks on Cargo dependency graphs can use cargo-deny as a command-line tool, a CI step, or a local pre-commit hook. It evaluates dependencies against project-defined rules, covering crate licenses, known security advisories, unmaintained or yanked crates, duplicate versions, banned crates, and dependency source locations. Its Rust library API also supports programmatic use. This makes it a focused option for teams that want dependency review to be part of their development workflow rather than a broader, cross-language SCA system.
The tool’s strongest fit is its range of Cargo-specific controls. License checks use SPDX expressions, while source policies can allow or restrict registries, Git sources, and paths. Teams can lint the dependency graph and apply those checks to pull requests through GitHub Actions, or catch issues locally with pre-commit. It supports Rust, Cargo, crates.io, Git registries, and Git repositories, and is self-hosted. That scope suits Rust projects with explicit rules for acceptable licenses, sources, and dependency versions; it is not a general dependency-policy layer for teams working across different ecosystems.
cargo-deny is open source, and the documented options include local installation from source or precompiled binaries. The listed integrations—GitHub Actions and pre-commit—cover CI and developer workflows, while the library API offers another route for embedding checks. Its narrow focus is also a boundary: teams seeking a broader SCA tool should compare alternatives if they need cross-ecosystem coverage, SBOM generation, or reachability analysis. Choose cargo-deny when Cargo policy enforcement is the priority; look elsewhere when those broader capabilities are central to the evaluation.
cargo-deny pros and cons
- Where it wins
- Checks crate licenses, security advisories, and unmaintained or yanked crates
- Controls banned crates, duplicate versions, and dependency sources
- Runs in GitHub Actions and pre-commit, with a Rust library API
- Where it doesn't
- Focused on Rust and Cargo rather than multiple ecosystems
- Requires teams to define and maintain dependency policies
- No verified SBOM generation or reachability analysis
cargo-deny fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update