Depos

JavaScript, Rust, JVM, Elixir, Zig, Python, Ruby, PHP/Composer, Go, .NET/NuGet and C/C++ package manifests say what you depend on. Depos adds why.

Depos was formerly called Pacmon. Nothing changes for a repository that keeps its notes in .pacmon/; see Repositories from before the rename.

Every dependency gets a short note: why it is here, what must not change, what to check before an upgrade. The note shows in the manifest on hover, and you write it from there.

Notes live in Markdown files under .depos/, next to the manifest they describe. No database, no service, no account: files that you read, diff and commit like any other. AI coding agents read the same files before they touch a dependency, and keep their own lines in them.

Supported manifests

VS Code supports every manifest in the table. JetBrains supports npm, Rust, Maven, Gradle, Mix, Gleam, Zig, Python, Ruby, PHP/Composer, NuGet, Go, vcpkg and Conan. The Visual Studio 2022+ VSIX currently supports the .NET/NuGet row only and reads the same .depos/nuget/DEPENDENCY-NOTES.md files, so NuGet notes move between all three IDEs without conversion.

Depos reads a manifest as text and never runs npm, Cargo, Maven, Gradle, Mix, Gleam, Zig, Python, pip, Poetry, uv, Ruby, Bundler, RubyGems, PHP, Composer, Go, .NET, MSBuild, NuGet, vcpkg, Conan or Python recipe code. It sees the direct dependencies written in the file:

• npm: dependencies, devDependencies, peerDependencies and optionalDependencies.
• Rust: [dependencies], [dev-dependencies], [build-dependencies] and their [target.…] forms. A member's serde.workspace = true counts; [workspace.dependencies] itself does not.
• Maven: the <dependencies> of the project and its profiles, not <dependencyManagement> or plugin dependencies. Parent POMs are not read.
• Gradle: module coordinates and libs.* aliases in a dependencies block, not plugins, constraints, project(…), files(…) or catalog bundles. The script is never run, so a dependency added by code is not seen.
• Elixir / Mix: literal dependency tuples in def/defp deps or an inline deps: [...] list, including Hex, Git, path and umbrella dependencies. Static only and targets options are shown as scopes; dynamically assembled lists are not run or guessed.
• Gleam / Hex: direct keys in [dependencies] and [dev_dependencies] in gleam.toml, including version, Hex, Git and path declarations. manifest.toml, transitive packages and other tables are not read.
• Zig: direct fields of the top-level .dependencies struct in build.zig.zon, including URL/hash, path and lazy dependencies. build.zig, system libraries and transitive dependencies are not evaluated.
• Python: named dependencies in standard project metadata, optional dependencies, dependency groups and build requirements; Poetry dependency tables and groups; uv legacy development dependencies; and named pip requirements. Includes, constraints, tool options, unnamed paths and lock files are not dependencies. Package names are matched case-insensitively with ., _ and - treated alike.
• Ruby: literal gem calls in Gemfile or gems.rb, with literal group and platform scopes; plus literal add_dependency, add_runtime_dependency and add_development_dependency calls on the active specification receiver in *.gemspec. Ruby is never evaluated. Dynamic names, method/class/module bodies, eval_gemfile, Gemfile.lock and transitive gems are ignored. Gem names are matched exactly.
• .NET / NuGet: literal PackageReference Include items in C#, F# and VB project files; and PackageVersion Include/Update plus GlobalPackageReference Include items in Directory.Packages.props. Package IDs are matched case-insensitively. Imports, MSBuild expressions, project/framework references, downloads and transitive packages are not evaluated.
• Go: module paths in require directives of go.mod, including // indirect ones, shown with their own scope. A tool directive points at the required module that provides it. replace, exclude, retract, go.work and vendor/ are not read as dependencies.
• vcpkg: string and object entries in the root dependencies array and in features.<name>.dependencies. Host dependencies keep a separate scope. Overrides, baselines, requested dependency features, configuration files, installed trees and transitive packages are not dependencies.
• Conan: references in the requires, tool_requires, test_requires and legacy build_requires sections of conanfile.txt; literal strings, lists or tuples in matching conanfile.py class fields; and literal first arguments to matching self.* calls. Dynamic expressions, lockfiles and transitive packages are not evaluated.
• PHP / Composer: package and platform requirements in the root require and require-dev objects of composer.json, including php, php-*, hhvm, ext-*, lib-* and Composer API packages. Names are matched case-insensitively. provide, replace, conflict, suggest, composer.lock and transitive packages are not dependencies.

Each ecosystem keeps its own notes file, even when two manifests share a folder. A manifest without a notes file of its own uses the nearest one above it for the same ecosystem.

Repositories from before the rename

A repository that started with Pacmon keeps its notes under .pacmon/ instead of .depos/, in the same layout. It works as before: Depos reads .pacmon/, and new notes in that repository still go there, so a teammate on an older version sees them too. Once everyone working in it has updated, Depos: Move Notes to .depos/ moves the repository to .depos/ in one step, together with AGENT-RULES.md, the header of each notes file and the pointer in AGENTS.md and the like. Where both directories hold a file for the same manifest, the .depos/ one is read and the other is marked as ignored.

The notes file

One ## section per direct dependency. People write under the heading. Agents write under ### Agent notes.

## express

HTTP API layer (SEC-1234).
Do not upgrade to v5 — the auth middleware is incompatible.

### Agent notes

- purpose: HTTP framework; serves the public REST API and the webhook receiver
- constraint: stay on ^4 — v5 changes router path matching and the session API
- verify: `vitest src/api` and the login e2e (`pnpm e2e:auth`)
- log: 2026-03 agent tried 5.0.1, 14 auth tests failed, reverted (PR [#402](https://github.com/kontratek/depos/issues/402))
- verified: 4.19.2

The file renders on GitHub as it is. A complete npm example is in docs/example-repo.

The file is the only place a note lives. Open it and write a section by hand, and the manifest shows it at once: the mark before the dependency fills in, and the first line of the note appears at the end of the line. Nothing is generated, and nothing is cached anywhere else.

Features

• Hover a dependency in its manifest to read its note.
• The first line of the note shows at the end of the dependency line.
• A mark before each dependency: filled when it has a note, hollow when it does not.
• Write a note from the manifest: in a side panel, a peek editor, or an input box.
• Documentation Coverage lists which dependencies have a note and which do not.
• Problems in the notes file show as warnings, most with a one-click fix.

Dependency review and allowlisting

A notes file can serve as the allowlist of the packages a project has reviewed and accepted. Each accepted package gets a note that says why it was allowed, and the agent layer records its risk (security exposure, native code, licence obligations, maintenance), where it runs (runtime), whether it handles untrusted input (exposure), and a dated log of advisories, upgrades and rejected proposals. A dependency added to a manifest without a note shows a hollow mark and appears in Documentation Coverage, so an unreviewed dependency stands out. Depos makes it visible; it does not block the dependency.

Getting started

1. Install Depos from the VS Code Marketplace. VSCodium, Cursor, Windsurf, code-server and other editors that use Open VSX install it from there. Rider, IntelliJ IDEA, RustRover, Android Studio, WebStorm and the other JetBrains IDEs install it from the JetBrains Marketplace. Visual Studio 2022 and newer install it from the Visual Studio Marketplace.
2. Open a supported manifest, such as package.json, Cargo.toml, pom.xml, build.gradle, mix.exs, gleam.toml, build.zig.zon, pyproject.toml, a supported requirements file, Gemfile, a gemspec, composer.json, go.mod, Directory.Packages.props, a .NET project file, vcpkg.json, conanfile.py or conanfile.txt. A hollow mark appears before every dependency that has no note yet.
3. Right-click a dependency and choose Add/Edit Dependency Note, or click the mark. Write one line.
4. The note now shows on hover and at the end of the line. Depos created the notes file for that ecosystem next to the manifest, and .depos/AGENT-RULES.md at the root of the workspace; commit them together with the manifest.

AI agents

Every section has a second layer, ### Agent notes, for AI coding agents. They write - key: value lines there: purpose, constraint, verify, log, verified and a few more. Agents never edit the text people wrote.

Run Depos: Set Up AI Instructions once. It writes the rules and the field list to .depos/AGENT-RULES.md and adds a three-line pointer to the instruction files your agents already read: AGENTS.md, CLAUDE.md, .cursor/rules/, .github/copilot-instructions.md. The rules say where each ecosystem keeps its notes and how it names its sections. From then on, an agent reads a dependency's section before it adds, upgrades or removes the dependency, and records what it did. Depos checks the agent lines: an unknown field or an empty value shows as a warning, with a fix.

Depos does not call any AI service. Agents use their own tools; Depos gives them the files and the rules.

Settings

The Depos view in the activity bar switches these without opening the settings editor. Before the rename these settings were named pacmon.*; those names are still read where the new ones are not set.

Visual Studio exposes the corresponding choices in Tools → Options → Depos and in its Depos tool window, which opens beside Solution Explorer. Its native entry modes are ToolWindow, QuickInput and OpenBeside; it also provides Quick Info, a clickable Depos mark beside each package ID, inline previews, Ctrl+click navigation and Quick Actions in NuGet manifests. Its commands are under Tools → Depos.

Organization notes

The Depos web app holds one note per package for a whole organization, shared by all its repositories. In VS Code, JetBrains IDEs and Visual Studio (preview), sign in and every workspace folder — in a JetBrains IDE, the project's folder and each content root; in Visual Studio, the git folder of the solution and of each of its projects — whose GitHub repository is added to one of your organizations works in org mode:

• The hover, the note editor, the end-of-line preview and coverage show the organization's notes from Depos. DEPENDENCY-NOTES.md is not read or changed; an error at its top (in Visual Studio, a bar above it and an Error List entry) says it is no longer used and should be deleted.
• Organization admins edit these notes in the note editor, and the change goes to Depos. Other members read them.
• If someone else changed the note first, the save is refused and the editor fetches the new version.
• The organization's allowlist shows at each manifest line: Denied and Not listed packages are a warning in Audit and an error in Enforce, and the hover and the note editor show the result, its reason and a link to the package in Depos. A line you just added is checked at once.
• Depos keeps a copy of the notes and allowlist results on your machine, asks the server only for what changed, and uses the copy while the server cannot be reached. Signing out removes the copy.
• AI agents in VS Code (Copilot and others) get a "Depos notes" MCP server for the folder: they read the notes and check a package against the organization's allowlist before they add it. An admin's agent can also write agent fields, never the human text. Agents outside VS Code connect with an MCP key from Depos → Settings → AI agents. JetBrains IDEs have no way for a plugin to add an MCP server, so there Copy MCP Setup puts an .mcp.json for the folder's repository on the clipboard; it reads the key from DEPOS_MCP_KEY. In Visual Studio, Tools → Depos → Copy MCP Setup copies the same server in Visual Studio's .mcp.json format, which asks for the key when the server starts.

To sign in, run Depos: Sign In (or use the Organization section of the Depos view; in a JetBrains IDE, Tools → Depos → Sign In, or Sign in in the Depos tool window; in Visual Studio, Tools → Depos → Sign In, or Sign in in the Organization group of the Depos tool window's settings, which keeps the sign-in in Windows Credential Manager). Your browser opens Depos; check that it shows the same code and approve. Every other folder, and everything while you are signed out, works from the notes files as before. The rules are in docs/format.md.

Requirements

VS Code 1.101 or newer, a JetBrains IDE 2025.2 or newer, or Visual Studio 2022 or newer on Windows. Nothing else: Depos reads the manifests itself, so it needs no language runtime or package manager installation, and it reads and writes files in your workspace without making network requests. The one exception is the optional Depos connection in VS Code, JetBrains IDEs and Visual Studio: it makes requests only while you are signed in, to sign in and out, to fetch your organization's notes and allowlist results, and to save a note you change. RubyMine or the Ruby plugin supplies Ruby editor integration in JetBrains IDEs; Depos still does not require a Ruby SDK. In VS Code it also works in VS Code for the Web (vscode.dev, github.dev), Remote-SSH, WSL and dev containers.

Format reference

npm notes use the dependency-notes/1 format. Cargo, Maven, Gradle, Mix, Gleam, Zig, Python, Ruby, Composer, Go, NuGet, vcpkg and Conan notes use dependency-notes/2, whose frontmatter also names the ecosystem. VS Code and JetBrains support every listed ecosystem, and the Visual Studio extension currently supports NuGet. The reference is docs/format.md.

Contributing and license

Depos is an early preview and does not accept pull requests yet. Bug reports and feature requests are welcome as issues; see CONTRIBUTING.md. Security problems: see SECURITY.md.

Apache License 2.0 — see LICENSE. "Depos" and the logo are trademarks of Kontra; see TRADEMARK.md.