Knowledge · Guidelines · architecture

Dependency Research Protocol

Cross-platform guideline ensuring agents research dependencies thoroughly before adoption. Uses context7 MCP for current documentation, investigates known issues, prefers official/battle-tested packages, vets third-party deps, and always consumes libraries through SBX wrapper packages.

Metadata

architecture

Procedures

Showing 3 of 9

  1. DRP-001 Use context7 MCP (resolve-library-id → query-docs) for current docs of any library being used or considered
    Before writing any code that imports a library:
  1. Call mcp__context7__resolve-library-id with the library name
  2. Call mcp__context7__query-docs with the resolved ID for current API, examples, and migration notes
This catches breaking changes, deprecated APIs, and version-specific behavior.
    auto-trigger
  2. DRP-002 Search StackOverflow / GitHub Issues for known problems before adopting any third-party package
    Web search for: "{library} known issues", "{library} gotchas", "{library} breaking changes"
Check GitHub Issues for open bugs, especially those tagged 'bug' or 'breaking'.
Document any risks found in the package.yml or decision record.
    auto-trigger
  3. DRP-003 Research official/established packages first — prefer battle-tested over hand-rolled
    Examples of preferred packages:
  Go: pgx (postgres), golang-jwt (JWT), bcrypt (crypto), chi (router)
  Svelte: svelte-i18n, bits-ui, sveltekit built-ins
Only consider alternatives when established packages have documented limitations
for the specific use case.
    code-review