Agent P in Sonatype AI Developer

Agent P helps teams keep open source dependencies in GitHub repositories up to date. It identifies upgrade opportunities, validates changes using your configured build and test commands, and opens pull requests for upgrades that pass validation.

Agent P is included with Sonatype AI Developer. Self-hosted Lifecycle customers can use Agent P if their license includes an AI Developer entitlement.

What Agent P does

For each connected repository, Agent P:

Finds projects and dependencies in npm, Maven, Gradle, Python, NuGet, and Go.
Recommends dependency versions based on Sonatype data.
Groups upgrades and creates a separate branch for each group.
Runs your configured build and test commands.
Opens a pull request for each upgrade group that passes validation.
Tracks pull requests through merge or close and can repair conflicts caused by later merges.

Agent P runs dependency analysis and validation in your CI environment, using GitHub Actions, the agp command-line tool, or the Agent P Jenkins plugin. AI Developer stores configuration, run history, findings, and pull request records, and displays them in the Agent P dashboard.

How Agent P works

Component	Role
AI Developer	Hosts Agent P pages, stores configuration and run history, and issues short-lived credentials to your CI environment.
GitHub App	Created through AI Developer. Agent P uses the app to access your repositories.
GitHub Actions workflow	Added to each repository through a setup pull request. Runs Agent P daily or on demand.
Your CI environment	Runs dependency analysis, validation, and pull request tasks.

Prerequisites

Requirement	Details
License	An AI Developer entitlement, either included in your license or enabled through the AI Developer opt-in. The opt-in is available with licenses that include a Lifecycle product.
Database	PostgreSQL
Source control	GitHub.com
GitHub access	Organization owner access, or personal account owner access, to create and install a GitHub App. GitHub Actions must be enabled.
Agent P administrator role	The Agent P Administrator role for the person setting up Agent P.

Without the AI Developer entitlement, Agent P and its related role and permission are not shown. Contact your Sonatype account representative to add AI Developer to your subscription or to get help claiming your AI Developer credits.

Note

The Agent P Administrator role by itself is not enough to complete initial setup. Setting your instance's base URL needs the "Edit System Configuration and Users" permission (held by the System Administrator role), and creating and installing the GitHub App needs "Edit IQ Elements" on the Root Organization. Once setup is complete, the Agent P Administrator role is sufficient for day-to-day use — connecting repositories, configuring defaults, and managing runs. See Enable Agent P and Connect and Onboard Repositories for where each permission is needed.

Supported ecosystems

Ecosystem	Manifest files	Lock files
npm	`package.json`	`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`
Maven	`pom.xml`	—
Gradle	`build.gradle`, `build.gradle.kts`	`poetry.lock`, `uv.lock`
Python	`pyproject.toml`, `requirements.txt`	—
NuGet	`.csproj`, `.fsproj`, `*.vbproj`	—
Go	`go.mod`	`go.sum`

Licensing

Agent P requires the AI Developer feature. Your organization can get this feature in either of these ways:

AI Developer is included in your license. The opt-in dialog does not appear. Enable Agent P for your instance as described in Enable Agent P.
AI Developer opt-in: If your license includes a Lifecycle product but does not list AI Developer, any signed-in user can accept the AI Developer terms to enable the feature for the organization. This requires an external PostgreSQL database. On embedded H2, the opt-in is recorded but does not enable the feature, and the product explains why.

The opt-in applies to the entire instance and cannot be withdrawn. After AI Developer is available, an administrator must complete the steps in Enable Agent P before Agent P can be used.

Roles and permissions

AI Developer adds a permission and a built-in role for managing Agent P.

Item	Name	Details
Permission category	Agent P	New permission category.
Permission	Manage Agent Organization Settings	Global permission that can be added to a custom role.
Built-in role	Agent P Administrator	Global role with the Manage agent organizartion settings permission.

The Agent P Administrator role is described as “Manages Agent P organization settings." No other built-in role, including System Administrator, includes this permission. The role and permission appear only when Agent P is available on your instance.

Note

A System Administrator who does not also have the Agent P Administrator role may see this message when opening Agent P: “Agent P is not connected. An administrator has to connect or finish setting up Agent P for this instance before repositories appear here.” Assign the Agent P Administrator role to give the user access.

Role capabilities

Action	Signed-in user	Agent P Administrator
View the dashboard, runs, findings, and pull requests	Yes (read-only)	Yes
Open repository configuration and Connections pages	No	Yes
Create and report runs through the CLI, GitHub Actions, or Jenkins plugin	Yes	Yes
Pause or resume a repository, or close an Agent P pull request, through the REST API	Yes, with API access	Yes
Pause, resume, or edit settings; disconnect a repository; or close a pull request in the UI	No	Yes
Link a GitHub App installation	No	Yes
Onboard repositories	No	Yes
Edit the default or repository configuration	No	Yes

Assign the Agent P Administrator role

Go to System Preferences > Administrators. You need the Edit System Configuration and Users permission.
Select Agent P Administrator.
Add the user or group, then save.

Using the REST API:

First, look up the role ID. Then assign the role to a user or group:

# Find the role ID
curl -u admin:admin123 -X GET http://localhost:8070/api/v2/roles

# Assign to a user
curl -u admin:admin123 -X PUT \
  http://localhost:8070/api/v2/roleMemberships/global/role/{roleId}/user/{username}

# Assign to a group
curl -u admin:admin123 -X PUT \
  http://localhost:8070/api/v2/roleMemberships/global/role/{roleId}/group/{groupName}