Vulnerability-aware dependency upgrade orchestrator. Detects outdated packages across npm, Python, Go, Rust, Java, Kotlin, and C# ecosystems; recommends the safest-yet-most-recent version per package using OSV.dev; executes upgrades wave-by-wave with build/typecheck/test verification and clean git rollback on failure.
Not in a marketplace yet, so it loads for one session with --plugin-dir.
Plugin migration-runner in MisterVitoPro/migration-runner. Commands read from the repo's manifest — 1 month ago.
This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.
migration-runner:detectScan the repo for outdated dependencies across all detected ecosystems (npm, Python, Go, Rust, Java, Kotlin, C#), query OSV.dev for vulnerabilities, and produce a vulnerability-aware upgrade plan at docs/migration-runner/migration-plan.md and plan.json. Recommends "latest with no unfixed HIGH/CRITIC
migration-runner:runExecute the upgrade plan written by /migration-runner:detect, one package per wave, verifying build + typecheck + tests after each upgrade. On verifier failure: hard reset to pre-wave SHA, write fix-plan.md, halt. Resumable with --resume.
migration-appliermigration-runner pipeline agent that applies a single package upgrade for one wave. Calls the ecosystem adapter's apply-upgrade subcommand and reports the outcome.
migration-detectormigration-runner pipeline agent that reports outdated dependencies in ONE ecosystem. Calls the ecosystem adapter via Bash and returns a strict JSON object with the outdated list. Invoked once per ecosystem detected in the repo.
migration-plannermigration-runner pipeline agent that turns merged detector output into a wave-ordered upgrade plan. For each outdated package, queries OSV.dev and the ecosystem registry, applies the version-ranker (safety vs recency), topologically sorts, and writes docs/migration-runner/migration-plan.md and plan.
migration-verifiermigration-runner pipeline agent that runs the ecosystem's verify commands (build, typecheck, tests) after a wave's upgrade and reports pass/fail with the failed step and a tail of stdout.
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-start.js"
Configure, run, and interpret HawkScan DAST results. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into prioritized fix tasks for your coding agent.
1 skill · hooks
Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts
1 skill
25-skill pentest pack with engagement governance, network/code/dependency scans, OWASP Top 10 mapping, and exec-readable reporting. Heavy-hitter compliant; chain-of-custody attestable.
26 skills · 2 commands
Check npm packages for malware, known vulnerabilities, typosquats and maintainer takeovers before installing, via npmscan.com's free, read-only MCP server (23 tools, no API key).
5 skills · 1 MCP server
Implements automated security scanning for dependencies, code, and containers using tools like Trivy, Snyk, and npm audit. Use when setting up CI/CD security gates, conducting pre-deployment audits, or meeting compliance requirements.
1 skill
Validation and quality enforcement for Apache Maven projects with dependency management, build lifecycle, and plugin configuration skills.
3 skills · hooks
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.