schemaVersion: 1
dependencies:
  git:
    description: Immutable external skill checkout and source verification.
    source: https://git-scm.com/
    requiredBy: [external-skills]
    satisfiedBy: [git]
    installers:
      - platforms: [darwin, linux]
        requires: brew
        command: brew
        args: [install, git]
      - platforms: [win32]
        requires: winget
        command: winget
        args: [install, --id, Git.Git, --exact, --accept-source-agreements, --accept-package-agreements]
  uv:
    description: Pinned Serena runtime through uvx when a standalone Serena executable is unavailable.
    source: https://github.com/astral-sh/uv
    version: 0.12.3
    commit: c2681564218e41a73e99cc448ba0b25459920444
    requiredBy: [semantic-code]
    satisfiedBy: [serena, uvx]
    installers:
      - platforms: [darwin, linux]
        requires: brew
        command: brew
        args: [install, uv]
      - platforms: [darwin, linux, win32]
        requires: pipx
        command: pipx
        args: [install, uv==0.12.3]
      - platforms: [linux, win32]
        requires: python3
        command: python3
        args: [-m, pip, install, --user, uv==0.12.3]
      - platforms: [win32]
        requires: winget
        command: winget
        args: [install, --id, astral-sh.uv, --exact, --accept-source-agreements, --accept-package-agreements]
  go:
    description: Pinned-source builds for ToolHive and the SCIP command-line tool.
    source: https://go.dev/
    requiredBy: [hardened-mcp, persistent-symbol-graph]
    satisfiedBy: [go]
    installers:
      - platforms: [darwin, linux]
        requires: brew
        command: brew
        args: [install, go]
      - platforms: [win32]
        requires: winget
        command: winget
        args: [install, --id, GoLang.Go, --exact, --accept-source-agreements, --accept-package-agreements]
  ast-grep:
    description: AST-aware structural code search and controlled rewrites.
    source: https://github.com/ast-grep/ast-grep
    version: 0.43.0
    commit: 5aa00e1dd5e0077589a6c0c23c640e39947403ec
    requiredBy: [structural-search]
    satisfiedBy: [sg, ast-grep]
    installers:
      - platforms: [darwin, linux, win32]
        requires: npm
        command: npm
        args: [install, --global, "@ast-grep/cli@0.43.0"]
  repomix:
    description: Token-budgeted repository packing and map generation.
    source: https://www.npmjs.com/package/repomix
    version: 1.18.0
    commit: e3b15a406ed78d8a463620a032a059ce911bfc0e
    requiredBy: [repository-map]
    satisfiedBy: [repomix]
    installers:
      - platforms: [darwin, linux, win32]
        requires: npm
        command: npm
        args: [install, --global, "repomix@1.18.0"]
  probe:
    description: Local large-code search and MCP context engine.
    source: https://www.npmjs.com/package/@probelabs/probe
    version: 0.6.0-rc88
    commit: 868bae31b6141093e7e51c6a22322c99d972e0a8
    requiredBy: [large-code-search]
    satisfiedBy: [probe]
    installers:
      - platforms: [darwin, linux, win32]
        requires: npm
        command: npm
        args: [install, --global, "@probelabs/probe@0.6.0-rc88"]
  playwright-cli:
    description: Token-efficient browser automation for coding agents.
    source: https://www.npmjs.com/package/@playwright/cli
    version: 0.1.18
    commit: e2d8f311f38a4828fc44a1026481481442ed962b
    requiredBy: [browser-qa]
    satisfiedBy: [playwright-cli]
    installers:
      - platforms: [darwin, linux, win32]
        requires: npm
        command: npm
        args: [install, --global, "@playwright/cli@0.1.18"]
  chrome-devtools-mcp:
    description: Chrome inspection, browser debugging, and performance MCP server.
    source: https://www.npmjs.com/package/chrome-devtools-mcp
    version: 1.7.0
    commit: b58c613f4b05ade36bbf0d6ba44d5a525ec4d19a
    requiredBy: [web-performance]
    satisfiedBy: [chrome-devtools-mcp]
    installers:
      - platforms: [darwin, linux, win32]
        requires: npm
        command: npm
        args: [install, --global, "chrome-devtools-mcp@1.7.0"]
  dependency-cruiser:
    description: JavaScript and TypeScript dependency architecture analysis.
    source: https://www.npmjs.com/package/dependency-cruiser
    version: 18.2.0
    commit: ec603451d07d699280234808f91c4c8d3813f6e8
    requiredBy: [dependency-architecture]
    satisfiedBy: [depcruise]
    installers:
      - platforms: [darwin, linux, win32]
        requires: npm
        command: npm
        args: [install, --global, "dependency-cruiser@18.2.0"]
  agent-scan:
    description: Agent, MCP, prompt, and skill supply-chain scanning.
    source: https://pypi.org/project/snyk-agent-scan/
    version: 0.5.17
    requiredBy: [agent-supply-chain]
    satisfiedBy: [snyk-agent-scan]
    installers:
      - platforms: [darwin, linux, win32]
        requires: uv
        command: uv
        args: [tool, install, "snyk-agent-scan==0.5.17"]
      - platforms: [darwin, linux, win32]
        requires: pipx
        command: pipx
        args: [install, "snyk-agent-scan==0.5.17"]
      - platforms: [darwin, linux, win32]
        requires: python3
        command: python3
        args: [-m, pip, install, --user, "snyk-agent-scan==0.5.17"]
  osv-scanner:
    description: Dependency vulnerability scanning against the OSV database.
    source: https://github.com/google/osv-scanner
    version: 2.5.0
    commit: 0af25542cef1b8980cdad15d8bddc3d953cb2de2
    requiredBy: [dependency-vulnerability]
    satisfiedBy: [osv-scanner]
    installers:
      - platforms: [darwin, linux]
        requires: brew
        command: brew
        args: [install, osv-scanner]
      - platforms: [darwin, linux, win32]
        requires: go
        command: go
        args: [install, "github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.5.0"]
  zizmor:
    description: Static analysis for GitHub Actions workflows.
    source: https://crates.io/crates/zizmor
    version: 1.29.0
    commit: b4393f9e92dcff49337fdba0a491e20640073a60
    requiredBy: [action-security]
    satisfiedBy: [zizmor]
    installers:
      - platforms: [darwin]
        requires: brew
        command: brew
        args: [install, zizmor]
      - platforms: [darwin, linux, win32]
        requires: cargo
        command: cargo
        args: [install, zizmor, --version, 1.29.0, --locked]
        versionCheck:
          command: rustc
          args: [--version]
          minimum: 1.97.0
      - platforms: [linux]
        requires: brew
        command: brew
        args: [install, zizmor]
  promptfoo:
    description: LLM evaluation and red-team workflow runner.
    source: https://www.npmjs.com/package/promptfoo
    version: 0.122.0
    commit: be44f8389bcd234e7144861957f670548ce85326
    requiredBy: [evals]
    satisfiedBy: [promptfoo]
    installers:
      - platforms: [darwin, linux, win32]
        requires: npm
        command: npm
        args: [install, --global, "promptfoo@0.122.0"]
  qmd:
    description: Local BM25, vector, and reranked knowledge search.
    source: https://www.npmjs.com/package/@tobilu/qmd
    version: 2.5.3
    commit: 53232770867ccb16538c2c6034e7d891dffc9ce3
    requiredBy: [local-knowledge]
    satisfiedBy: [qmd]
    installers:
      - platforms: [darwin, linux, win32]
        requires: npm
        command: npm
        args: [install, --global, "@tobilu/qmd@2.5.3"]
  toolhive:
    description: Hardened MCP execution, policy, and lifecycle management.
    source: https://github.com/stacklok/toolhive
    commit: 52ad2932e0b41f2ad7cb37ac50abddd3556252c7
    requiredBy: [hardened-mcp]
    satisfiedBy: [thv]
    installers:
      - platforms: [darwin, linux, win32]
        requires: go
        command: go
        args: [install, "github.com/stacklok/toolhive/cmd/thv@52ad2932e0b41f2ad7cb37ac50abddd3556252c7"]
  semgrep:
    description: Multi-language static analysis and deep security scanning.
    source: https://pypi.org/project/semgrep/
    version: 1.172.0
    commit: 4fadea628509108b6b8b621236779f37bf52a08e
    requiredBy: [deep-security]
    satisfiedBy: [semgrep]
    installers:
      - platforms: [darwin, linux, win32]
        requires: uv
        command: uv
        args: [tool, install, "semgrep==1.172.0"]
      - platforms: [darwin, linux, win32]
        requires: pipx
        command: pipx
        args: [install, "semgrep==1.172.0"]
  d2:
    description: Polished architecture and report diagram export.
    source: https://github.com/d2lang/d2
    version: 0.8.1
    commit: 0a1b5d9be6f6956169c8a4e49f8b3a51bdf9ad9a
    requiredBy: [visual-export]
    satisfiedBy: [d2]
    installers:
      - platforms: [darwin, linux, win32]
        requires: go
        command: go
        args: [install, "github.com/d2lang/d2@v0.8.1"]
      - platforms: [darwin, linux]
        requires: brew
        command: brew
        args: [install, d2]
  trivy:
    description: Container image, filesystem, and repository vulnerability scanning.
    source: https://github.com/aquasecurity/trivy
    version: 0.74.0
    commit: e1fd17a0ea4a8cf24bc4b4dd7e2cfbf4bb31b994
    requiredBy: [container-security]
    satisfiedBy: [trivy]
    installers:
      - platforms: [darwin, linux]
        requires: brew
        command: brew
        args: [install, trivy]
      - platforms: [darwin, linux, win32]
        requires: go
        command: go
        args: [install, "github.com/aquasecurity/trivy/cmd/trivy@v0.74.0"]
        environment:
          GOEXPERIMENT: jsonv2
  joern:
    description: Code property graph construction and querying.
    source: https://github.com/joernio/joern
    version: 4.0.600
    commit: d661fa90174a423c5e9aa871280bd023b5ac526f
    requiredBy: [code-property-graph]
    satisfiedBy: [joern]
    installers:
      - platforms: [darwin, linux]
        requires: brew
        command: brew
        args: [install, joern]
  scip:
    description: Language-agnostic persistent symbol graph tooling.
    source: https://github.com/scip-code/scip
    version: 0.9.0
    commit: e8ee0ae6038f8298e2195812eea9d7b1196748ae
    requiredBy: [persistent-symbol-graph]
    satisfiedBy: [scip]
    installers:
      - platforms: [darwin]
        architectures: [arm64]
        artifact:
          url: https://github.com/scip-code/scip/releases/download/v0.9.0/scip-darwin-arm64.tar.gz
          sha256: 3078af4c0a9e809089a0bba8befc618add950cf4e429e92c78392bb5d4c99c9a
          archive: tar.gz
          executable: scip
          target: go-bin
      - platforms: [darwin]
        architectures: [x64]
        artifact:
          url: https://github.com/scip-code/scip/releases/download/v0.9.0/scip-darwin-amd64.tar.gz
          sha256: 39d8b16cafd6b331532d935c230c7a8f3d03d83d50fa972be3ab269f2d8267e8
          archive: tar.gz
          executable: scip
          target: go-bin
      - platforms: [linux]
        architectures: [arm64]
        artifact:
          url: https://github.com/scip-code/scip/releases/download/v0.9.0/scip-linux-arm64.tar.gz
          sha256: e97aaf597ab6a6b6fbb1bbc43993e6efb596284aaea9c3fa5b20d75186367c5e
          archive: tar.gz
          executable: scip
          target: go-bin
      - platforms: [linux]
        architectures: [x64]
        artifact:
          url: https://github.com/scip-code/scip/releases/download/v0.9.0/scip-linux-amd64.tar.gz
          sha256: fc2e7273e110be9f35924da1066000183791e8bfdb0391355de6eaaa070fec75
          archive: tar.gz
          executable: scip
          target: go-bin