Changelog

What's new in Agnes

Every week, what changed for you: new checks, new features and fixes.

  1. Alerts, an SBOM for every run, what changed since the last analysis, and three more ways to sign in.

    • NewSign in with Bitbucket, next to GitHub, GitLab, Google and Microsoft. FAQ →
    • ImprovedThe sign-in buttons show each service's logo in its own colours.
    • NewA sample report to explore without signing up: a real analysis of shadcn-ui/taxonomy, linked from the homepage.
    • ImprovedError pages of our own: a page that isn't there, or that fails to load, says so in plain words, with a way back.
    • NewSign in with GitLab, Google or Microsoft, next to GitHub, email and passkeys. FAQ →
    • NewEmail alerts for new vulnerable packages and for a score that drops below your threshold.
    • NewAlerts in a Slack or Microsoft Teams channel, and a weekly digest every Monday (paid plans). Pricing →
    • NewWhat changed since the last analysis: the new and the fixed findings of every run.
    • NewWhat to fix first: the rules ranked by the points their findings cost.
    • NewA software bill of materials (CycloneDX 1.6) to download from every run, and get_sbom for AI agents. SBOM →
    • NewA licence overview for npm, yarn, pnpm and bun lockfiles, broken down by kind of licence.
    • NewAccessibility findings grouped by WCAG 2.2 success criterion, as a page you can print.
    • NewScore history per category, next to the overall score.
    • ImprovedVulnerable packages show the version that fixes them, and the command to upgrade a direct dependency.
    • ImprovedUnused files and exports come as lists you can copy.
    • ImprovedThe run page shows the dependency step live; a recheck shows which tools' results it reused.
    • ImprovedFaster dependency step: licences already looked up for a package version are reused.
    • ImprovedThe project page says when the branch was last checked for new commits.
    • ImprovedIntentional side-effect imports (polyfills, styles) are allowed by import/no-unassigned-import, per project too. Tools →
    • NewAgnes is in the official MCP registry, and MCP clients can see its tools before you add a token. Agents →
    • NewConnect Claude, ChatGPT and other MCP apps by signing in to Agnes instead of pasting a token; disconnect them in Settings. Agents →
    • NewFree for open source: up to 10 public repositories per team are analysed for free on every plan, with up to 100,000 lines each. Pricing →
    • NewA README badge and a public report page for public repositories: switch them on in the project's settings.
    • NewA page about the SBOM: what's in it, which lockfiles it reads, where to get it, and what it means for the Cyber Resilience Act. SBOM →
    • NewThis changelog: what changed for you, every week.
    • ImprovedSBOM licences: an SPDX id, a valid SPDX expression, or the licence's name, with the export tested against the official CycloneDX 1.6 schema. SBOM →
    • FixedAI agents no longer keep reconnecting to the MCP server. Agents →

  2. Sign-up opens, paid plans arrive, and every analysis now has a run page like CI.

    • NewSign-up is open, with the Free plan, for repositories on GitHub and Bitbucket.
    • NewPaid plans: Essentials from 3 November, and all four plans from 7 November. Pricing →
    • NewA run page for every analysis, like a CI pipeline, with live progress while it runs.
    • NewPaid plans re-check dependencies for new advisories on days without new commits; Free gets 3 manual re-runs a day. Pricing →
    • NewSign in with a passkey: a fingerprint, your face or your device PIN.
    • NewIgnore rules per project, picked from a finding or edited in the settings.
    • NewA security check for XSS sinks, with Mozilla's no-unsanitized rules. Tools →
    • NewSearch your projects, re-run several at once, and add several repositories in one go.
    • ImprovedA wider, GitHub-style layout, with a project's pages as tabs.
    • ImprovedChoose what the dashboard's project cards show, and how big they are.
    • ImprovedThe app fits phones and tablets.
    • ImprovedKnip understands monorepo workspaces, Expo and React Native. Tools →
    • FixedOne oversized or vendored file no longer fails the complexity check.
    • FixedA deleted branch says so and offers another branch, instead of asking to reconnect.

  3. agnes.dev goes live, with templates, PHP dependencies and AI agents covered before the doors open.

    • Newagnes.dev is live, first as a preview while sign-up was still closed.
    • NewServer-rendered templates are checked too: Blade, Twig, Nunjucks and Handlebars. Frameworks →
    • Newcomposer.lock is checked for known vulnerabilities, for PHP projects. Frameworks →
    • NewAI agents read your reports through an MCP server and an improve-score skill, with API tokens per team. Agents →
    • NewA FAQ, in five languages. FAQ →
    • NewAccount emails: welcome, team, subscription and security changes.