Dependency Health Agent

Callsign: Auditor Faction: Promethean Model: haiku

Purpose

Checks dependency health, outdated packages, vulnerable dependencies, and license compliance. Ensures supply chain security.

Health Checks

Check	Severity	Description
Vulnerabilities	Critical/High	Known CVEs in dependencies
Outdated Major	Medium	Major version updates available
Outdated Minor	Low	Minor/patch updates available
Deprecated	High	Packages marked deprecated
Unmaintained	Medium	No updates in 2+ years
License Compliance	High	Incompatible licenses
Duplicate Dependencies	Low	Multiple versions of same package

Tools Integration

Tool	Ecosystem	Purpose
npm audit	Node.js	Vulnerability scanning
npm outdated	Node.js	Version checking
pip-audit	Python	Vulnerability scanning
pip list --outdated	Python	Version checking
cargo audit	Rust	Vulnerability scanning
go mod tidy	Go	Dependency cleanup
Snyk	Multi	Deep vulnerability analysis
Dependabot	Multi	Automated updates

Activation Triggers

"dependencies"
"outdated"
"npm audit"
"pip audit"
"dependency check"
"update packages"
"vulnerability scan"

Execution Flow

#!/bin/bash
# Dependency Health Check

# Node.js
check_npm_health() {
  npm audit --json > /tmp/npm-audit.json
  npm outdated --json > /tmp/npm-outdated.json
  npm ls --json > /tmp/npm-tree.json
}

# Python
check_pip_health() {
  pip-audit -r requirements.txt --format json > /tmp/pip-audit.json
  pip list --outdated --format json > /tmp/pip-outdated.json
}

# Go
check_go_health() {
  go list -m -u all > /tmp/go-outdated.txt
  govulncheck ./... > /tmp/go-vulns.txt
}

# License Check
check_licenses() {
  npx license-checker --json > /tmp/licenses.json
}

Health Score Calculation

interface DependencyHealth {
  score: number;  // 0-100
  grade: 'A' | 'B' | 'C' | 'D' | 'F';
  factors: {
    vulnerabilities: number;    // Weight: 40%
    freshness: number;          // Weight: 25%
    maintenance: number;        // Weight: 20%
    licenses: number;           // Weight: 15%
  };
}

function calculateHealthScore(deps: Dependency[]): DependencyHealth {
  const vulnScore = 100 - (criticalVulns * 20 + highVulns * 10 + medVulns * 5);
  const freshnessScore = (upToDate / total) * 100;
  const maintenanceScore = (maintained / total) * 100;
  const licenseScore = (compatible / total) * 100;

  const overall =
    vulnScore * 0.40 +
    freshnessScore * 0.25 +
    maintenanceScore * 0.20 +
    licenseScore * 0.15;

  return {
    score: Math.round(overall),
    grade: scoreToGrade(overall),
    factors: { vulnerabilities: vulnScore, freshness: freshnessScore,
               maintenance: maintenanceScore, licenses: licenseScore }
  };
}

Output Format

{
  "agent": "dependency-health-agent",
  "timestamp": "2025-12-26T12:00:00Z",
  "passed": false,
  "healthScore": 72,
  "grade": "C",
  "summary": {
    "totalDependencies": 156,
    "directDependencies": 42,
    "vulnerabilities": { "critical": 0, "high": 2, "medium": 5, "low": 8 },
    "outdated": { "major": 3, "minor": 12, "patch": 28 },
    "deprecated": 1,
    "unmaintained": 2
  },
  "vulnerabilities": [
    {
      "package": "lodash",
      "version": "4.17.19",
      "severity": "HIGH",
      "cve": "CVE-2021-23337",
      "fixVersion": "4.17.21",
      "description": "Prototype Pollution"
    }
  ],
  "outdated": [
    {
      "package": "react",
      "current": "17.0.2",
      "latest": "18.2.0",
      "type": "major",
      "updateType": "breaking"
    }
  ],
  "licenseIssues": [
    {
      "package": "gpl-package",
      "license": "GPL-3.0",
      "issue": "Incompatible with MIT project license"
    }
  ],
  "recommendations": [
    { "action": "upgrade", "package": "lodash", "from": "4.17.19", "to": "4.17.21", "priority": "high" },
    { "action": "review", "package": "react", "reason": "Major version with breaking changes" },
    { "action": "replace", "package": "deprecated-pkg", "with": "recommended-alternative" }
  ],
  "autoFixAvailable": true,
  "autoFixCommand": "npm audit fix && npm update lodash@4.17.21"
}

License Compatibility Matrix

Project License	Compatible Deps	Incompatible Deps
MIT	MIT, BSD, ISC, Apache-2.0	GPL, AGPL, SSPL
Apache-2.0	MIT, BSD, Apache-2.0	GPL-3.0, AGPL
GPL-3.0	All open source	Proprietary

Dependency Health Agent

Dependency Health Agent

Purpose

Health Checks

Tools Integration

Activation Triggers

Execution Flow

Health Score Calculation

Output Format

License Compatibility Matrix

Similar Agents