Agent Renovate

Behavior-aware dependency updates for AI agent skills, plugins, prompts, hooks, and MCP servers.

Package managers can tell you that an agent dependency changed. Agent Renovate helps answer the harder question:

Did the update change what my agent does?

Agent Renovate runs your dependency updater, inspects changes to agent-facing files, optionally evaluates the old and new behavior, and opens a pull request with the evidence.

upstream update
      ↓
APM updates the lockfile and deployed agent files
      ↓
Agent Renovate analyzes instructions, permissions, hooks, commands, and URLs
      ↓
Waza optionally evaluates behavior before and after
      ↓
GitHub pull request with risk and regression report

Why

Agent dependencies are not ordinary libraries. A valid update can still:

• grant a skill access to new tools or MCP servers;
• introduce shell commands or new network destinations;
• make an agent slower or more expensive;
• change which skill is selected;
• reduce task success without causing a build failure.

Agent Renovate treats skills and prompts as behavioral dependencies. It complements Microsoft APM for package management and Microsoft Waza for evaluation instead of replacing them.

Quick start

Add this workflow:

name: Agent dependency updates

on:
  workflow_dispatch:
  schedule:
    - cron: "17 4 * * 1"

permissions:
  contents: write
  pull-requests: write

jobs:
  update:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - run: pip install apm-cli

      - uses: hackermengzhi/agent-renovate@v1
        env:
          GH_TOKEN: ${{ github.token }}
        with:
          update-command: apm update --yes

When APM changes a dependency, Agent Renovate creates a branch, commits the update, and opens a pull request containing:

• changed Agent Skills, plugin manifests, MCP configuration, and instructions;
• newly added commands, URLs, secret access, permissions, and side effects;
• the highest detected risk level;
• dependency-update output;
• optional before/after evaluation results.

Add behavioral evaluation

Install Waza in the workflow and provide commands with placeholders:

- name: Install Waza
  run: curl -fsSL https://raw.githubusercontent.com/microsoft/waza/main/install.sh | bash

- uses: hackermengzhi/agent-renovate@v1
  env:
    GH_TOKEN: ${{ github.token }}
  with:
    update-command: apm update --yes
    eval-command: waza run --discover --output {output}
    compare-command: waza compare {before} {after}

The evaluation command runs once before the dependency update and once after it. {output}, {before}, and {after} are shell-quoted automatically.

CLI

Agent Renovate has no runtime dependencies and requires Node.js 20 or newer.

npx agent-renovate run --dry-run
npx agent-renovate inspect

Run with Waza:

agent-renovate run \
  --update-command "apm update --yes" \
  --eval-command "waza run --discover --output {output}" \
  --compare-command "waza compare {before} {after}" \
  --dry-run

inspect analyzes the current uncommitted diff without running an updater.

Configuration

Create .github/agent-renovate.json:

{
  "updateCommand": "apm update --yes",
  "evalCommand": "waza run --discover --output {output}",
  "compareCommand": "waza compare {before} {after}",
  "branchPrefix": "agent-renovate/update",
  "prTitle": "chore(agent): update agent dependencies",
  "labels": ["agent-dependencies"],
  "riskFailLevel": "critical"
}

Action inputs override configuration-file values.

| Setting | Default | Meaning | |---|---|---| | updateCommand | apm update --yes | Command that changes dependency files | | evalCommand | empty | Before/after evaluation command containing {output} | | compareCommand | empty | Comparison command containing {before} and {after} | | branchPrefix | agent-renovate/update | Update branch prefix | | prTitle | chore(agent): update agent dependencies | Pull request title | | labels | ["agent-dependencies"] | Pull request labels | | riskFailLevel | critical | Stop before commit at or above this level | | dryRun | false | Report only; do not create a branch or PR |

Built-in risk analysis

The first release reviews added lines in common agent surfaces:

• SKILL.md, AGENTS.md, and CLAUDE.md;
• .agents/, .claude/, .codex/, .cursor/, and .github/skills/;
• plugin and marketplace manifests;
• .mcp.json and MCP configuration;
• instruction files, hooks, and bundled scripts.

Rules flag:

• permission and tool-surface expansion;
• shell and package execution;
• destructive commands;
• secret and credential access;
• new network destinations;
• external writes such as sending, publishing, deploying, or deleting;
• strong prompt-control language.

The scanner deliberately reports evidence instead of claiming that an update is safe. It redacts common credential forms in reports.

Other package managers

The updater is intentionally command-based. You can use any tool that modifies tracked files:

with:
  update-command: gh skill update --all

Or a repository script:

with:
  update-command: ./scripts/update-agent-dependencies.sh

Commands configured in a repository run with the permissions of the GitHub Actions job. Review configuration changes as carefully as workflow changes.

Current limitations

• APM provides the best reproducible update flow; arbitrary installers may not produce lockfiles.
• Behavioral evaluation is opt-in because it consumes model quota.
• Static findings are heuristic and do not replace a security review.
• The first release opens one grouped update PR per run.
• GitHub is the only supported forge in v0.1.

Development

npm test
npm run lint

The project uses only Node.js built-ins. No install step is required for contributors.

License

MIT