Dependency updates
## Dependabot MCP Server: Automated Dependency Security Management The **Dependabot MCP Server** integrates GitHub automated dependency updates and security alerts into Google Antigravity, helping teams maintain secure and up-to-date dependencies with minimal manual intervention. ### Why Dependabot MCP? - **Automated Updates**: Receive automatic pull requests for outdated dependencies across all supported package ecosystems - **Security Alerts**: Get immediate notifications about known vulnerabilities in your project dependencies - **Version Strategy**: Configure update strategies from conservative patch updates to aggressive major version bumps - **Grouped Updates**: Combine related dependency updates into single PRs for cleaner review workflows - **Compatibility Scoring**: See compatibility scores and changelog summaries to assess update risk ### Key Features #### 1. Dependency Status ```python from anthropic import Anthropic client = Anthropic() response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1024, messages=[{ "role": "user", "content": "Show all outdated dependencies in my project and categorize by severity of version lag" }] ) ``` #### 2. Security Vulnerabilities ```python # Check security alerts response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1024, messages=[{ "role": "user", "content": "List all security vulnerabilities in dependencies and show available patches" }] ) ``` #### 3. Update Management ```python # Manage update PRs response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1024, messages=[{ "role": "user", "content": "Show pending Dependabot PRs and auto-merge those with passing CI for patch updates" }] ) ``` #### 4. Configuration ```python # Configure update rules response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1024, messages=[{ "role": "user", "content": "Update Dependabot config to group all React-related dependencies into single PRs" }] ) ``` ### Configuration ```json { "mcpServers": { "dependabot": { "command": "npx", "args": ["-y", "@anthropic/mcp-server-dependabot"], "env": { "GITHUB_TOKEN": "your-github-token", "GITHUB_OWNER": "your-org", "GITHUB_REPO": "your-repo" } } } } ``` ### Use Cases **Security Compliance**: Maintain SOC2 and other compliance requirements by ensuring dependencies are patched within required timeframes. **Update Triage**: Quickly review and prioritize dependency updates based on security severity and compatibility risk. **Automated Maintenance**: Set up auto-merge rules for low-risk updates to reduce manual review burden. **Vulnerability Response**: Rapidly respond to new CVEs by identifying affected projects and applying patches systematically. The Dependabot MCP Server automates the tedious work of dependency management, ensuring your projects stay secure and current without consuming valuable development time.
{
"mcpServers": {
"dependabot": {
"mcpServers": {
"dependabot": {
"env": {
"GITHUB_TOKEN": "your-github-token"
},
"args": [
"-y",
"dependabot-mcp-server"
],
"command": "npx"
}
}
}
}
}