Changelog

Wat is er nieuw in Agnes

Elke week wat er voor jou veranderde: nieuwe controles, nieuwe functies en oplossingen.

De berichten zijn in het Engels.

  1. Alerts, an SBOM for every run, what changed since the last analysis, and three more ways to sign in.

    • NieuwSign in with Bitbucket, next to GitHub, GitLab, Google and Microsoft. FAQ →
    • VerbeterdThe sign-in buttons show each service's logo in its own colours.
    • NieuwA sample report to explore without signing up: a real analysis of shadcn-ui/taxonomy, linked from the homepage.
    • VerbeterdError pages of our own: a page that isn't there, or that fails to load, says so in plain words, with a way back.
    • NieuwSign in with GitLab, Google or Microsoft, next to GitHub, email and passkeys. FAQ →
    • NieuwEmail alerts for new vulnerable packages and for a score that drops below your threshold.
    • NieuwAlerts in a Slack or Microsoft Teams channel, and a weekly digest every Monday (paid plans). Prijzen →
    • NieuwWhat changed since the last analysis: the new and the fixed findings of every run.
    • NieuwWhat to fix first: the rules ranked by the points their findings cost.
    • NieuwA software bill of materials (CycloneDX 1.6) to download from every run, and get_sbom for AI agents. SBOM →
    • NieuwA licence overview for npm, yarn, pnpm and bun lockfiles, broken down by kind of licence.
    • NieuwAccessibility findings grouped by WCAG 2.2 success criterion, as a page you can print.
    • NieuwScore history per category, next to the overall score.
    • VerbeterdVulnerable packages show the version that fixes them, and the command to upgrade a direct dependency.
    • VerbeterdUnused files and exports come as lists you can copy.
    • VerbeterdThe run page shows the dependency step live; a recheck shows which tools' results it reused.
    • VerbeterdFaster dependency step: licences already looked up for a package version are reused.
    • VerbeterdThe project page says when the branch was last checked for new commits.
    • VerbeterdIntentional side-effect imports (polyfills, styles) are allowed by import/no-unassigned-import, per project too. Tools →
    • NieuwAgnes is in the official MCP registry, and MCP clients can see its tools before you add a token. Agents →
    • NieuwConnect Claude, ChatGPT and other MCP apps by signing in to Agnes instead of pasting a token; disconnect them in Settings. Agents →
    • NieuwFree for open source: up to 10 public repositories per team are analysed for free on every plan, with up to 100,000 lines each. Prijzen →
    • NieuwA README badge and a public report page for public repositories: switch them on in the project's settings.
    • NieuwA page about the SBOM: what's in it, which lockfiles it reads, where to get it, and what it means for the Cyber Resilience Act. SBOM →
    • NieuwThis changelog: what changed for you, every week.
    • VerbeterdSBOM licences: an SPDX id, a valid SPDX expression, or the licence's name, with the export tested against the official CycloneDX 1.6 schema. SBOM →
    • OpgelostAI agents no longer keep reconnecting to the MCP server. Agents →

  2. Sign-up opens, paid plans arrive, and every analysis now has a run page like CI.

    • NieuwSign-up is open, with the Free plan, for repositories on GitHub and Bitbucket.
    • NieuwPaid plans: Essentials from 3 November, and all four plans from 7 November. Prijzen →
    • NieuwA run page for every analysis, like a CI pipeline, with live progress while it runs.
    • NieuwPaid plans re-check dependencies for new advisories on days without new commits; Free gets 3 manual re-runs a day. Prijzen →
    • NieuwSign in with a passkey: a fingerprint, your face or your device PIN.
    • NieuwIgnore rules per project, picked from a finding or edited in the settings.
    • NieuwA security check for XSS sinks, with Mozilla's no-unsanitized rules. Tools →
    • NieuwSearch your projects, re-run several at once, and add several repositories in one go.
    • VerbeterdA wider, GitHub-style layout, with a project's pages as tabs.
    • VerbeterdChoose what the dashboard's project cards show, and how big they are.
    • VerbeterdThe app fits phones and tablets.
    • VerbeterdKnip understands monorepo workspaces, Expo and React Native. Tools →
    • OpgelostOne oversized or vendored file no longer fails the complexity check.
    • OpgelostA deleted branch says so and offers another branch, instead of asking to reconnect.

  3. agnes.dev goes live, with templates, PHP dependencies and AI agents covered before the doors open.

    • Nieuwagnes.dev is live, first as a preview while sign-up was still closed.
    • NieuwServer-rendered templates are checked too: Blade, Twig, Nunjucks and Handlebars. Frameworks →
    • Nieuwcomposer.lock is checked for known vulnerabilities, for PHP projects. Frameworks →
    • NieuwAI agents read your reports through an MCP server and an improve-score skill, with API tokens per team. Agents →
    • NieuwA FAQ, in five languages. FAQ →
    • NieuwAccount emails: welcome, team, subscription and security changes.