Map and Analyze Software Dependencies

Dependency Mapper Agent analyzes, visualizes, and manages software dependencies: classifying them as direct, transitive, circular, optional, development, or runtime, automated discovery across Node, Python, Java, and .NET ecosystems, manual Python import extraction, graph and Dependency Structure Matrix visualizations, critical-path and circular-dependency detection, CI and build-system integration with caching, and dependency-health risk assessment covering freshness, security, maintenance, license, and bundle size.

Use it when mapping a project's dependency graph - extracting direct and transitive dependencies with ecosystem-specific tools, visualizing the graph with D3 or Mermaid, building a Dependency Structure Matrix, detecting circular dependencies or the most-depended-upon critical nodes, wiring dependency caching and reporting into CI, or setting a policy blocking high-severity vulnerabilities or disallowed licenses. It's an analysis and tooling agent, not a package manager itself - it wraps and interprets output from tools like npm, pipdeptree, and mvn dependency:tree rather than resolving dependencies on its own.

Input is a project's source tree or its existing dependency manifests, such as package.json, requirements, pom.xml, or a .csproj. Output includes CLI commands per ecosystem (npm ls, npx depcheck, pipdeptree --graph-output png, mvn dependency:tree, dotnet list package --include-transitive); a Python extract_imports/map_project_dependencies pair walking a repo's Python files via ast to build an import map; D3.js and Mermaid graph data structures for visualization; a pandas-based Dependency Structure Matrix built from a module-to-module dependency dict; a find_critical_dependencies function ranking modules by in-degree and a detect_circular_dependencies DFS that returns each cycle found; a GitHub Actions step caching npm dependencies and generating license and unused-dependency reports; a multi-stage Dockerfile separating production dependencies, build, and runtime layers; and a JSON dependency policy blocking high-severity vulnerabilities, allow-listing MIT, Apache-2.0, and BSD-3-Clause licenses, and flagging dependencies over 365 days stale for review.

Wraps ecosystem tooling - npm and depcheck for Node, pipdeptree and pip-licenses for Python, Maven and Gradle for Java, the dotnet CLI for .NET - plus D3.js and Mermaid for visualization, GitHub Actions for CI caching, and Docker for multi-stage builds:

def detect_circular_dependencies(graph):
    visited = set()
    rec_stack = set()
    cycles = []
    
    def dfs(node, path):
        if node in rec_stack:
            cycle_start = path.index(node)
            cycles.append(path[cycle_start:] + [node])
            return
        
        if node in visited:
            return
        
        visited.add(node)
        rec_stack.add(node)
        
        for neighbor in graph.get(node, []):
            dfs(neighbor, path + [node])
        
        rec_stack.remove(node)
    
    for node in graph:
        if node not in visited:
            dfs(node, [])
    
    return cycles

Engineering teams managing complex dependency graphs who want the surrounding process, not just the graph - a documented dependency inventory with justification, Architecture Decision Records for major dependency choices, a review process for new additions, regular audits with automated security scanning, gradual migration and rollback plans for major version updates, and architectural moves like dependency inversion and adapter patterns to reduce circular coupling.