AI CodeOps

Software composition analysis (SCA)

SCA finds the open-source components in your code and flags known vulnerabilities and license risks. What it does, and how it fits next to AI CodeOps.

Software composition analysis (SCA) is the practice, and the tooling, of identifying the open-source and third-party components a codebase depends on, then checking each one for known vulnerabilities, license issues and signs that it's outdated or unmaintained.

What it is

An SCA tool reads manifests and lockfiles (or the built artifact), resolves the full dependency tree, including transitive dependencies, and matches each package version against vulnerability databases and license data. The output is a list of problems with suggested upgrades, and often an SBOM of everything it found.

SCA looks at code you didn't write. SAST looks at code you did. Most teams run both.

Why it matters

Most of the code in a typical application comes from dependencies. A vulnerability in one of them is a vulnerability in your product, and the fix is usually an upgrade, if you know you need it. AI agents add packages as readily as they add functions, so the dependency list can grow faster than anyone reviews it.

In AI CodeOps

AI CodeOps is not an SCA tool, and it's plain about that: it has no CVE scanner and doesn't query an advisory database. Keep your SCA tool in CI. What AI CodeOps adds around it:

An AI dependency review. The Dependency Auditor agent runs in the Dependency Refresh and Release Readiness workflows:

Dependency Refresh:  Audit (Dependency Auditor) → Upgrade (Migration Specialist)
                     → Test (Tester) → Verify secure (Security Auditor)

It reads the project's manifest (package.json, pyproject.toml, go.mod, Cargo.toml or pom.xml) and reports packages with known vulnerabilities, license conflicts and abandoned packages, each with an upgrade path. Its knowledge comes from the model, which has a training cut-off, and it doesn't read lockfiles, so treat it as a reviewer, not a scanner. A remote MCP server you connect can give it live data.

Findings that gate. The end-of-session findings review records concrete issues with the category dependency, security or compliance. Open high or critical findings block the pull request until someone triages them.

Your scanner's results, recorded. When you record a project's SBOM, vulnerableCount is the number your SCA tool reported. The project page shows that count as Vulnerable components (latest SBOM).

License rules in CI. The release check's disallowedLicenses option enforces a license policy against the latest SBOM.

To run an audit, open Develop → AI Sessions, choose New session, pick Dependency Refresh and your project, and start it. To run it regularly, schedule the workflow under Release → Schedules.

Frequently asked questions

Is there an SCA scanner in AI CodeOps?

No. There's no CVE database scanner. The Dependency Auditor agent reviews dependencies with the model's knowledge, and SBOM records hold the vulnerability counts your own tools report.

Does the Dependency Auditor see transitive dependencies?

Mostly not. It reads the manifest and other matching files, not lockfiles, so it sees your direct dependencies.

Can dependency findings block a pull request?

Yes. The findings review records them with the dependency category, and open high or critical ones block like any other finding.