AI agents
Let AI agents read your notes and allowlist results over MCP, in VS Code, in JetBrains IDEs, in Visual Studio, or with an MCP key.
AI agents such as Claude Code, Cursor or Copilot can read your organization's notes and allowlist results while they work in a repository. They connect to Depos over MCP (Model Context Protocol). Each added repository has its own MCP server: the agent sees the notes that cover that repository.
What an agent can do
| Tool | What it does |
|---|---|
get_dependency_note | Reads the note of one package. |
list_dependency_notes | Lists the notes of the repository, optionally for one ecosystem. |
check_package | Gives a package's allowlist result: Allowed, Denied, Not listed or Not audited, with the reason. Agents are told to call it before they add a package. |
set_agent_fields | Replaces the agent fields of a note. Only when the agent may write. |
An agent never changes the human text of a note, only its agent fields. Every change it makes shows in Activity under the name of the person it acts as.
Ways to connect
- VS Code, with the Depos extension: signed in to Depos, the agents in VS Code get the server of each folder. No key.
- JetBrains IDEs, with the Depos plugin: the plugin copies the setup for you; the agent connects with an MCP key.
- Visual Studio, with the Depos extension: the extension copies the setup for you; Visual Studio asks for an MCP key.
- Any other agent — Claude Code in a terminal, Cursor, CI: an MCP key from an admin of your organization.
The rest of this guide, with the setup of each, is for signed-in Depos users.