Skip to main content

Sonatype Guide Agent P

Agent P is a dependency management capability in Sonatype Guide that helps teams keep open source dependencies up to date. It continuously scans repositories, identifies upgrade opportunities, validates proposed changes by running the validation commands defined in your Agent P configuration, and creates pull requests for your team to review and merge. Agent P currently uses a deterministic approach to dependency upgrades. An AI-powered approach is coming soon.

Note

The distributed Agent P container image includes third-party components required to run Agent P, including the Claude Agent SDK, Claude Code CLI, and package-management tools for the languages and ecosystems supported by Agent P.

For licensing and copyright information, see Anthropic Commercial Terms.

For details about the third-party components, package managers, licensing, and copyright notices included in the image, see Third-party Notices.

Prerequisites and Recommendations

Before setting up Agent P, ensure you have the following requirements in place. Some prerequisites require assistance from your GitHub organization administrator or Sonatype team. We recommend confirming access and credentials before beginning the setup process.

GitHub Organization Administrator Access

Agent P is installed as a GitHub App. You must have administrator access to your GitHub organization to install the app, grant repository permissions, and modify GitHub Actions settings.

If you do not have the required permissions, contact your GitHub organization administrator before proceeding.

GitHub Actions Pull Request Permissions

Agent P creates pull requests through GitHub Actions. To allow this behavior, GitHub Actions must be permitted to create and approve pull requests.

To enable this setting:

  1. In GitHub, navigate to your organization's Settings.

  2. Select Actions > General.

  3. Under Workflow permissions, enable Allow GitHub Actions to create and approve pull requests.

Note

This setting must be allowed at the organization level and enabled for the repository. A repository cannot override an organization-level restriction, but an organization-level allow does not automatically enable the setting for each repository.

To enable it for a repository, go to Repository Settings > Actions > General > Workflow permissions.

Reproducible Project Build

Before onboarding a repository, make sure the project can be built and validated from a clean checkout.

Agent P validates upgrades by running the validation commands defined in your Agent P configuration inside the Agent P container. It does not run your repository's GitHub Actions workflows. If you do not configure validation commands, Agent P opens pull requests without validating the upgrades.

Authentication

Agent P authenticates with Sonatype Guide using GitHub Actions OIDC. You do not need to create Agent P API tokens or organization-level secrets for this authentication.

Supported Ecosystems

Agent P supports dependency upgrade workflows for npm-compatible JavaScript projects, Maven, Gradle, Python, NuGet, and Go. The Agent P image includes package-management and build tooling for the supported ecosystems.

How Agent P Works

The setup lifecycle is:

  1. Connect - Install the Sonatype Guide GitHub App and connect the repositories you want Agent P to manage.

  2. Onboard - Select up to 500 accessible repositories in a batch. Agent P creates setup pull requests as needed.

  3. Configure Defaults - Organization owners define default configuration; repository-specific overrides can be added where needed.

  4. Run - After the setup workflow is on the default branch, Agent P can run manually or on its default daily schedule.

The 500-repository limit is the maximum size of a single onboarding batch, regardless of organization role.

To configure Agent P, see Connect and Onboard Repositories.

Roles and Configuration Permissions

Agent P permissions depend on the user’s organization role and repository access.

Role

Capabilities

Organization owner

Configure Agent P for the organization, onboard repositories, and manage organization-wide settings.

Organization member

Onboard repositories they have access to and view repositories already configured for the organization

Agent P configuration is governed centrally through Sonatype Guide:

  • Default Configuration: Organization owners define org-wide settings that apply to all repositories.

  • Repository Overrides: Customize settings for specific repositories when needed

Agent P retrieves the applicable governed configuration when a run starts. Configuration changes made in Guide are applied to subsequent runs.

How Agent P Runs

When the GitHub Actions workflow runs:

  • The gate job checks whether the repository should run and retrieves the applicable Agent P configuration.

  • If the gate directs the workflow to continue, the agp job analyzes the repository for dependency upgrade opportunities.

  • Agent P runs the configured validation commands inside the Agent P container for proposed upgrades.

  • Agent P creates pull requests for eligible upgrades according to the configured feature settings, limits, wait periods, and validation behavior.