run with lein run -m user

project.clj

(defproject example "0.0.1-SNAPSHOT"
  :dependencies [[org.clojure/clojure "1.10.1"]
                 ;; explict declared as dep but isn't required
                 [org.clojure/test.check "0.9.0"]
                 [clj-kondo/clj-kondo "2019.10.26"]])

;; OUTPUT:
;; $ lein run  -m user
;; [:on-project.clj-but-no-required (org.clojure/test.check)]
;; [:required-but-not-in-project.clj (cheshire/cheshire)]

src-user.clj

(ns user
  (:require                                                 ;; require without explicit declare as deps
    [cheshire.core :as c]
    [clj-kondo.core :as kondo]
    [clojure.java.io :as io]
    [clojure.edn :as edn]
    [clojure.string :as string])
  (:import (java.nio.file Paths)
           (java.net URI)))

(defn -main 
  [& _]
  (let [{:keys [namespace-usages]} (:analysis (kondo/run! {:lint   ["src"]
                                                           :config {:output {:analysis true}}}))
        url->splited-path #(into []
                                 (comp (map (memfn getFileName))
                                       (map str)
                                       (take-while (complement string/blank?)))
                                 (iterate (fn [x] (when x (.getParent x)))
                                          (Paths/get (new URI (-> (str %)
                                                                  (string/replace #"^jar\:"
                                                                                  "")
                                                                  (string/replace #"\!.+$"
                                                                                  ""))))))
        find-urls #(let [base (-> (namespace-munge %)
                                  (string/replace #"\." "/"))]
                     (for [suffix ["clj" "cljc" "cljs"]
                           :let [url (io/resource (str base "." suffix))]
                           :when url
                           :let [path (url->splited-path url)
                                 [jar version name & ns] path
                                 ns (drop 1 (drop-while (complement #{"repository"})
                                                        (reverse ns)))]
                           :when (or (seq ns)
                                     (prn [:warn url]))]
                       (symbol (string/join "." ns) name)))
        own (->> namespace-usages
                 (map :from)
                 set)
        {:keys [dependencies]} (rest (edn/read-string (slurp "project.clj")))
        deps-from-project (into (sorted-set)
                                (comp (map first)
                                      (map (fn [x]
                                             (if (simple-symbol? x)
                                               (symbol (name x) (name x))
                                               x))))
                                dependencies)
        deps-from-requires (->> namespace-usages
                                (map :to)
                                (remove own)
                                set
                                (mapcat find-urls)
                                (into (sorted-set)))]
    (prn [:on-project.clj-but-no-required (remove deps-from-requires deps-from-project)])
    (prn [:required-but-not-in-project.clj (remove deps-from-project deps-from-requires)])))