SCA-Agent reconstructs a dependency's trace across Code, Build, Release, Deploy and Runtime and beats the best traditional SCA tool by 18.76 points of F1

arXiv 2609.18391·medium signalXBlueskyLinkedInCopy link

Conventional software composition analysis reads one stage (a manifest, a container, a runtime snapshot) and cannot say both where a component came from and where it ended up, because dependencies get resolved, removed, repackaged and transformed between stages. SCA-Agent adaptively explores project-specific analysis paths, gathers stage-specific evidence, and correlates it to recover identities, versions, introduction paths, propagation relationships and final lifecycle states. On 105 real-world Java, JavaScript and Python projects it achieved the highest component detection F1 at every lifecycle stage and every ecosystem, and reached 96.69% F1 on vulnerability exposure assessment, 18.76 percentage points above the best traditional tool. That gap is large enough to matter for anyone whose SBOM currently comes from a single manifest scan.