Dependency vulnerabilities
Each version of your app is checked against known vulnerabilities, at build time and then every day. A serious vulnerability to fix wakes your agent.
Updated November 9, 2026.
You, to your agent: Are there vulnerabilities to fix before the production deployment?
When to use it
The inventory is always there: each version is checked against the known vulnerabilities, and your agent reads them before production, with get_app_status { include: ["vulnerabilities"] }.
How it works
Each version has the list of components of its whole image, system packages included, checked against the known vulnerabilities at its build and then every day. A serious vulnerability to fix opens the “Serious vulnerabilities” incident, which wakes the agent.
What to know
get_app_status { include: ["vulnerabilities"] } lists them, checked by UpdateFOMO. A provided image (image:) is only inventoried if it carries its list of components (docker buildx build —sbom=true). The vulnerabilities of an embedded tool (esbuild…) or without a published fix are shown without opening an incident.
For the app’s runtime (Python, Node.js, Ruby, PHP, Go), a vulnerability fixed only in a more recent branch stays to be watched, even high: the advice is to migrate (change branch, then test), not to update. Actively exploited (KEV list), it opens the incident anyway.
Your agent’s MCP tools
Your agent handles it with the get_app_status tool.