The Next Dependency Problem Is Inside Your AI Agent

Managing external dependencies for a software project has become an integral part of the software supply chain. Whether it’s application dependencies with tools like npm, Yarn, Composer, and so on. Or dependencies used by CI/CD workflows with tools like GitHub Actions, we’ve made considerable progress in managing dependencies across these layers. Now that AI agents are an indispensable part of how we build our software, it’s important that we manage dependencies around them as well. You might wonder what dependencies an AI agent actually relies on. Well, when we think about an AI coding agent, we tend to focus on the model and the instructions we give it. But an agent’s behaviour increasingly depends on external components like skills, prompts, instructions, plugins, MCP servers, and so on. These components need the same things traditional application dependencies do: versioning, reproducible installation, update management, and security controls. The good news is that we have a tool…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town