[huubhermsen]

Adds Agnes as tools/agnes.json.

Agnes is a hosted service that analyses frontend repositories every day. Every analysis produces a CycloneDX 1.6 JSON SBOM of the packages its lockfiles install (package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, bun.lock and composer.lock): each component with its purl, scope and licence (SPDX id or expression, otherwise a licence name), the dependency graph, and the known vulnerabilities from OSV linked to the components they affect. The SBOM is available on every plan, including the free one, as a download per analysis and through an MCP tool for AI agents. Its tests validate the export against the official CycloneDX 1.6 JSON schema.

The entry validates against schemas/tool.schema.json (v2.0). It is a commercial service with a free plan, so there's no repository URL. Disclosure: I'm Agnes's maker.

🤖 Generated with Claude Code

[jkowalleck]

tool description reads like an analysis tool that can gender SBOM.
it does not read like an authoring tool.

• see chore: fix false claims for function "AUTHOR" #130

Suggested change

"AUTHOR",

could you elaborate why you think "AUTHOR" is the correct functionof this tool?

[huubhermsen]

You're right: Agnes generates the SBOM automatically from the lockfiles on every analysis; nobody builds it by hand. I've removed AUTHOR, so the function is ANALYSIS only.

[jkowalleck]

tool description read like a platform, not an application nor github app.
see https://cyclonedx.github.io/tool-center/tool.html#tool_packaging

"APPLICATION" - Standalone graphical or web-based application intended for end users.
"GITHUB_APP" - GitHub-integrated application with extended API access and repository permissions.

could you elaborate why you think the packaging is correct here?

[huubhermsen]

Agnes is a hosted web application (app.agnes.dev) that end users sign in to, so I read that as APPLICATION ("web-based application intended for end users"). It reads repositories through a GitHub App, "Agnes Code Quality", installed per repository with read-only Contents and Metadata permissions (it's also in review for the GitHub Marketplace), hence GITHUB_APP. There's no CLI, Action, plugin or self-hosted package. That matches how Socket's entry lists its hosted service.

I've reworded the description to say this up front ("Web app that analyses … GitHub and Bitbucket repositories"). If you'd rather have a hosted service listed differently, for example APPLICATION only, I'm happy to change it.