Limits and errors

Size and counts

Limit	Value
package.json size	256 KB
dependencies	300
focus entries	50
minAgeDays	0 to 365

A file over the size limit is answered with 413 payload_too_large, a file with too many dependencies with too_many_dependencies. For a monorepo, plan one package.json at a time, as in the guide.

Rate limit

About 30 requests per minute with a burst of 10, over REST. Beyond that you get 429 rate_limited. The limit protects the service for everyone, so a script that runs in a loop should pause between calls. Retrying after a short wait is safe: a plan changes nothing on your side.

Time

A plan has 60 seconds. The first plan for a project can be slow, because the package data has to be loaded from the registry. If the time runs out you get 504 plan_timeout over REST, or the same code in an MCP error. Call again with the same request: the data loaded so far is cached, so the second call is much faster. Set your own client timeout above 60 seconds, and the script exits with code 3 so a CI step can retry once.

Package data

The data comes from the public npm registry and is cached for 10 minutes. A package published a minute ago may not be visible yet. When the registry is briefly unavailable, expired data may be served, and meta.stale is true. If the registry cannot be reached and nothing is cached, you get registry_unreachable.

Only stable versions are used, and only package data that the registry's JSON API provides. Ripedeps downloads no package archives.

Files from a URL

With packageJsonUrl the service downloads your file, so the address is checked. Only https on port 443 is accepted, with no credentials in the URL, at most 2048 characters, at most 3 redirects and 10 seconds. Private and reserved addresses are blocked, including after DNS resolution and redirects. Use the raw file URL: an HTML page is rejected. The URL is not stored and is logged without its query string.

What it does not do

• It reads no lockfile and no workspace configuration. The only input is package.json.
• It has no vulnerability data. See what the age gate is not.
• It proposes no prerelease versions and never tightens or loosens your range prefix.
• It adds and removes no @types entries.
• It has no exception list for single packages. A focus does the job.

The reasons are in the FAQ, and privacy lists what is kept.

Errors

Every error has the same shape and a stable code; the message is for people. The same codes come back over REST, MCP and the script (--json). The full format is on the API page.