Novedades

Novedades de Agnes

Cada semana, lo que cambió para ti: nuevas comprobaciones, nuevas funciones y correcciones.

Las entradas están en inglés.

  1. Alerts, an SBOM for every run, what changed since the last analysis, and three more ways to sign in.

    • NuevoSign in with Bitbucket, next to GitHub, GitLab, Google and Microsoft. FAQ →
    • MejoradoThe sign-in buttons show each service's logo in its own colours.
    • NuevoA sample report to explore without signing up: a real analysis of shadcn-ui/taxonomy, linked from the homepage.
    • MejoradoError pages of our own: a page that isn't there, or that fails to load, says so in plain words, with a way back.
    • NuevoSign in with GitLab, Google or Microsoft, next to GitHub, email and passkeys. FAQ →
    • NuevoEmail alerts for new vulnerable packages and for a score that drops below your threshold.
    • NuevoAlerts in a Slack or Microsoft Teams channel, and a weekly digest every Monday (paid plans). Precios →
    • NuevoWhat changed since the last analysis: the new and the fixed findings of every run.
    • NuevoWhat to fix first: the rules ranked by the points their findings cost.
    • NuevoA software bill of materials (CycloneDX 1.6) to download from every run, and get_sbom for AI agents. SBOM →
    • NuevoA licence overview for npm, yarn, pnpm and bun lockfiles, broken down by kind of licence.
    • NuevoAccessibility findings grouped by WCAG 2.2 success criterion, as a page you can print.
    • NuevoScore history per category, next to the overall score.
    • MejoradoVulnerable packages show the version that fixes them, and the command to upgrade a direct dependency.
    • MejoradoUnused files and exports come as lists you can copy.
    • MejoradoThe run page shows the dependency step live; a recheck shows which tools' results it reused.
    • MejoradoFaster dependency step: licences already looked up for a package version are reused.
    • MejoradoThe project page says when the branch was last checked for new commits.
    • MejoradoIntentional side-effect imports (polyfills, styles) are allowed by import/no-unassigned-import, per project too. Herramientas →
    • NuevoAgnes is in the official MCP registry, and MCP clients can see its tools before you add a token. Agentes →
    • NuevoConnect Claude, ChatGPT and other MCP apps by signing in to Agnes instead of pasting a token; disconnect them in Settings. Agentes →
    • NuevoFree for open source: up to 10 public repositories per team are analysed for free on every plan, with up to 100,000 lines each. Precios →
    • NuevoA README badge and a public report page for public repositories: switch them on in the project's settings.
    • NuevoA page about the SBOM: what's in it, which lockfiles it reads, where to get it, and what it means for the Cyber Resilience Act. SBOM →
    • NuevoThis changelog: what changed for you, every week.
    • MejoradoSBOM licences: an SPDX id, a valid SPDX expression, or the licence's name, with the export tested against the official CycloneDX 1.6 schema. SBOM →
    • CorregidoAI agents no longer keep reconnecting to the MCP server. Agentes →

  2. Sign-up opens, paid plans arrive, and every analysis now has a run page like CI.

    • NuevoSign-up is open, with the Free plan, for repositories on GitHub and Bitbucket.
    • NuevoPaid plans: Essentials from 3 November, and all four plans from 7 November. Precios →
    • NuevoA run page for every analysis, like a CI pipeline, with live progress while it runs.
    • NuevoPaid plans re-check dependencies for new advisories on days without new commits; Free gets 3 manual re-runs a day. Precios →
    • NuevoSign in with a passkey: a fingerprint, your face or your device PIN.
    • NuevoIgnore rules per project, picked from a finding or edited in the settings.
    • NuevoA security check for XSS sinks, with Mozilla's no-unsanitized rules. Herramientas →
    • NuevoSearch your projects, re-run several at once, and add several repositories in one go.
    • MejoradoA wider, GitHub-style layout, with a project's pages as tabs.
    • MejoradoChoose what the dashboard's project cards show, and how big they are.
    • MejoradoThe app fits phones and tablets.
    • MejoradoKnip understands monorepo workspaces, Expo and React Native. Herramientas →
    • CorregidoOne oversized or vendored file no longer fails the complexity check.
    • CorregidoA deleted branch says so and offers another branch, instead of asking to reconnect.

  3. agnes.dev goes live, with templates, PHP dependencies and AI agents covered before the doors open.

    • Nuevoagnes.dev is live, first as a preview while sign-up was still closed.
    • NuevoServer-rendered templates are checked too: Blade, Twig, Nunjucks and Handlebars. Frameworks →
    • Nuevocomposer.lock is checked for known vulnerabilities, for PHP projects. Frameworks →
    • NuevoAI agents read your reports through an MCP server and an improve-score skill, with API tokens per team. Agentes →
    • NuevoA FAQ, in five languages. FAQ →
    • NuevoAccount emails: welcome, team, subscription and security changes.