Dependency Watch

An agent reads the security updates Dependabot or Renovate opens, searches your code for the affected package, and tells you which advisories actually reach code you run.

The three that matter, out of thirty — Most advisories concern a function you never call, in a package that only runs in your test suite. The agent reads each one and checks your repository for usage, so the short list it posts is the list worth your afternoon. Evidence, not a verdict — For each advisory you get the affected package and versions, where the package is imported, whether that code runs in production or only in development, and the CI status of the update. “No usage found” is reported as exactly that, with the search it ran. Built on what GitHub already raises — It works from the pull requests Dependabot or Renovate open, which carry the advisory text and the fixed version. There is no separate scanner to install and no second vulnerability database to keep in sync.

Connects to: GitHub, Slack.

Runs on your own machine with AGNT. Free, unlimited local runs, no per-operation metering. Full write-up: https://agnt.gg/marketplace/monitor-dependency-advisories