Skip to content

Add Agnes #214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
huubhermsen wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add Agnes #214

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dc51c8a
Add Agnes
Nov 12, 2026
31110c0
Agnes: function ANALYSIS only; description says web app via GitHub App
Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions tools/agnes.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
{
"$schema": "https://cyclonedx.org/schema/tool-center-v2.tool.schema.json",
"specVersion": "2.0",
"tool": {
"name": "Agnes",
"publisher": "Agnes",
"description": "Web app that analyses the frontend code of GitHub and Bitbucket repositories every day. Each analysis generates a CycloneDX SBOM of the installed npm and Composer packages, with licences, the dependency graph and known vulnerabilities from OSV.",
"website_url": "https://agnes.dev/sbom",
"capabilities": [
"SBOM",
"VDR/VEX"
],
"availability": [
"FREEMIUM",
"SUBSCRIPTION"
],
"functions": [
"ANALYSIS"
],
"analysis": [
"SECURITY_VULNERABILITIES",
"LICENSE_REPORTING",
"OUTDATED_COMPONENTS"
],
"transform": [],
"packaging": [
"APPLICATION",

@jkowalleck jkowalleck Nov 12, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tool description read like a platform, not an application nor github app.
see https://cyclonedx.github.io/tool-center/tool.html#tool_packaging

"APPLICATION" - Standalone graphical or web-based application intended for end users.
"GITHUB_APP" - GitHub-integrated application with extended API access and repository permissions.

could you elaborate why you think the packaging is correct here?

@huubhermsen huubhermsen Nov 12, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agnes is a hosted web application (app.agnes.dev) that end users sign in to, so I read that as APPLICATION ("web-based application intended for end users"). It reads repositories through a GitHub App, "Agnes Code Quality", installed per repository with read-only Contents and Metadata permissions (it's also in review for the GitHub Marketplace), hence GITHUB_APP. There's no CLI, Action, plugin or self-hosted package. That matches how Socket's entry lists its hosted service.

I've reworded the description to say this up front ("Web app that analyses … GitHub and Bitbucket repositories"). If you'd rather have a hosted service listed differently, for example APPLICATION only, I'm happy to change it.

"GITHUB_APP"
],
"library": [],
"platform": [],
"lifecycle": [
"PRE-BUILD"
],
"supportedStandards": [
"CYCLONEDX",
"PACKAGE_URL"
],
"cycloneDxVersion": [
"CYCLONEDX_V1.6"
],
"supportedLanguages": [
"JAVASCRIPT/TYPESCRIPT",
"NODE.JS",
"PHP"
]
}
}