Should we add a deps scanner to starlog?
Why
As you know, starlog contains facts and manifest data that are point-in-time — sourced and dated, but a decision aid, not ground truth. Not all agents realize this, and could potentially lead to vulnerable packages being used and added. Utilizing a simple tool such as Socket or Snyk being added along or packaged with starlog could effectively mitigate this issue.
How
Pretty simple: Just have the starlog init command add the socket/snyk mcp sse url added to agent configs.
Should we add a deps scanner to starlog?
Why
As you know, starlog contains facts and manifest data that are point-in-time — sourced and dated, but a decision aid, not ground truth. Not all agents realize this, and could potentially lead to vulnerable packages being used and added. Utilizing a simple tool such as Socket or Snyk being added along or packaged with starlog could effectively mitigate this issue.
How
Pretty simple: Just have the
starlog initcommand add the socket/snyk mcp sse url added to agent configs.