Nouveautés

Les nouveautés d’Agnes

Chaque semaine, ce qui a changé pour vous : nouvelles vérifications, nouvelles fonctionnalités et corrections.

Les entrées sont en anglais.

  1. Alerts, an SBOM for every run, what changed since the last analysis, and three more ways to sign in.

    • NouveauSign in with Bitbucket, next to GitHub, GitLab, Google and Microsoft. FAQ →
    • AmélioréThe sign-in buttons show each service's logo in its own colours.
    • NouveauA sample report to explore without signing up: a real analysis of shadcn-ui/taxonomy, linked from the homepage.
    • AmélioréError pages of our own: a page that isn't there, or that fails to load, says so in plain words, with a way back.
    • NouveauSign in with GitLab, Google or Microsoft, next to GitHub, email and passkeys. FAQ →
    • NouveauEmail alerts for new vulnerable packages and for a score that drops below your threshold.
    • NouveauAlerts in a Slack or Microsoft Teams channel, and a weekly digest every Monday (paid plans). Tarifs →
    • NouveauWhat changed since the last analysis: the new and the fixed findings of every run.
    • NouveauWhat to fix first: the rules ranked by the points their findings cost.
    • NouveauA software bill of materials (CycloneDX 1.6) to download from every run, and get_sbom for AI agents. SBOM →
    • NouveauA licence overview for npm, yarn, pnpm and bun lockfiles, broken down by kind of licence.
    • NouveauAccessibility findings grouped by WCAG 2.2 success criterion, as a page you can print.
    • NouveauScore history per category, next to the overall score.
    • AmélioréVulnerable packages show the version that fixes them, and the command to upgrade a direct dependency.
    • AmélioréUnused files and exports come as lists you can copy.
    • AmélioréThe run page shows the dependency step live; a recheck shows which tools' results it reused.
    • AmélioréFaster dependency step: licences already looked up for a package version are reused.
    • AmélioréThe project page says when the branch was last checked for new commits.
    • AmélioréIntentional side-effect imports (polyfills, styles) are allowed by import/no-unassigned-import, per project too. Outils →
    • NouveauAgnes is in the official MCP registry, and MCP clients can see its tools before you add a token. Agents →
    • NouveauConnect Claude, ChatGPT and other MCP apps by signing in to Agnes instead of pasting a token; disconnect them in Settings. Agents →
    • NouveauFree for open source: up to 10 public repositories per team are analysed for free on every plan, with up to 100,000 lines each. Tarifs →
    • NouveauA README badge and a public report page for public repositories: switch them on in the project's settings.
    • NouveauA page about the SBOM: what's in it, which lockfiles it reads, where to get it, and what it means for the Cyber Resilience Act. SBOM →
    • NouveauThis changelog: what changed for you, every week.
    • AmélioréSBOM licences: an SPDX id, a valid SPDX expression, or the licence's name, with the export tested against the official CycloneDX 1.6 schema. SBOM →
    • CorrigéAI agents no longer keep reconnecting to the MCP server. Agents →

  2. Sign-up opens, paid plans arrive, and every analysis now has a run page like CI.

    • NouveauSign-up is open, with the Free plan, for repositories on GitHub and Bitbucket.
    • NouveauPaid plans: Essentials from 3 November, and all four plans from 7 November. Tarifs →
    • NouveauA run page for every analysis, like a CI pipeline, with live progress while it runs.
    • NouveauPaid plans re-check dependencies for new advisories on days without new commits; Free gets 3 manual re-runs a day. Tarifs →
    • NouveauSign in with a passkey: a fingerprint, your face or your device PIN.
    • NouveauIgnore rules per project, picked from a finding or edited in the settings.
    • NouveauA security check for XSS sinks, with Mozilla's no-unsanitized rules. Outils →
    • NouveauSearch your projects, re-run several at once, and add several repositories in one go.
    • AmélioréA wider, GitHub-style layout, with a project's pages as tabs.
    • AmélioréChoose what the dashboard's project cards show, and how big they are.
    • AmélioréThe app fits phones and tablets.
    • AmélioréKnip understands monorepo workspaces, Expo and React Native. Outils →
    • CorrigéOne oversized or vendored file no longer fails the complexity check.
    • CorrigéA deleted branch says so and offers another branch, instead of asking to reconnect.

  3. agnes.dev goes live, with templates, PHP dependencies and AI agents covered before the doors open.

    • Nouveauagnes.dev is live, first as a preview while sign-up was still closed.
    • NouveauServer-rendered templates are checked too: Blade, Twig, Nunjucks and Handlebars. Frameworks →
    • Nouveaucomposer.lock is checked for known vulnerabilities, for PHP projects. Frameworks →
    • NouveauAI agents read your reports through an MCP server and an improve-score skill, with API tokens per team. Agents →
    • NouveauA FAQ, in five languages. FAQ →
    • NouveauAccount emails: welcome, team, subscription and security changes.