Dependency Auditor agent

The Dependency Auditor agent checks the supply chain. It identifies known vulnerabilities (CVEs), license problems and unmaintained packages in a project's dependencies, and gives an upgrade path for each.

Where it runs

Dependency Refresh is a maintenance workflow. The Dependency Auditor goes first, the Migration Specialist plans the upgrade, the Tester plans how to prove nothing broke, and the Security Auditor checks the result. In Release Readiness it is one of four checks before the Architect's go/no-go.

Inputs

• The session task, for example "refresh dependencies before the Q4 release".
• A read-only snapshot of relevant files from the project's repository, which can include manifests and lockfiles such as package.json or requirements.txt.
• Earlier steps, in Release Readiness.
• Tools from connected MCP servers, if your workspace policy allows them.

Outputs

A written audit, grouped by problem:

• Packages with known vulnerabilities, the affected versions and the first fixed version.
• Licenses that may conflict with how the project is distributed.
• Packages that look abandoned, with maintained alternatives.
• For each, an upgrade path and how risky the jump is, such as a patch release versus a new major version.

In Dependency Refresh, the next step plans the upgrade from this list, and the code pass writes the changed manifests into the diff.

Example run

Illustrative example, not a recorded session. In Dependency Refresh on a Node project, the Dependency Auditor lists an HTTP client two minor versions behind a fix for a known request-smuggling issue, a markdown library with no release in four years, and a test utility under a license the team may not want to ship. It recommends the patch upgrade first, a maintained replacement for the markdown library, and moving the test utility to dev dependencies. The Migration Specialist turns that into upgrade steps.

Limits

• Its vulnerability knowledge is the model's and can be out of date. Confirm critical items with a scanner.
• It only sees the files in the snapshot. Transitive dependencies are visible only through a lockfile it was shown.
• It is not legal advice on licenses.
• For project SBOMs, see DevSecOps and SBOMs.