SCA-Agent reconstructs a dependency across five lifecycle stages and beats the best traditional tool by 18.76 F1 points.

arXiv 2609.18391 points out conventional software composition analysis reads one stage (a manifest, a container, a runtime snapshot) and can't say both where a component came from and where it ended up, because dependencies get resolved, removed, repackaged and transformed in between. SCA-Agent adaptively explores project-specific analysis paths, gathers stage-specific evidence, and correlates it to recover identities, versions, introduction paths, propagation relationships and final states. On 105 real Java, JavaScript and Python projects it had the highest detection F1 at every stage and ecosystem, reaching 96.69% F1 on vulnerability exposure assessment. If your SBOM comes from a single manifest scan, that gap is your blind spot.