Where the machine stops.
One Cloud Run service carries both the dashboard and the run endpoint, so the scheduled run and the page you are reading are the same deployment. The model sits on a branch off the main line. It reads, it explains, and the branch ends there: it holds no GitHub tool and cannot reach the part that writes.
Architecture
Run it yourself
cp .env.example .env # GEMINI_API_KEY, GITHUB_TOKEN, DEMO_REPO
npm ci && npm run dev # Node 24, no cloud account needed
npm run deploy # one Cloud Run service in europe-west1
schedule 0 6,18 * * * # the Cloud Scheduler job, OIDC signed
The full step by step, including the invoker service account and the Secret Manager entries, is in README.md. With no Google Cloud project configured the service still starts and serves this dashboard from an in-memory store, which is how it can be read before it is deployed.
Where the data comes from
GitHub REST for each watched repository's manifest, lockfile, releases and tag compares.
npm registry for versions, publish times, deprecation, engines and peer ranges.
deps.dev for publish time, deprecation and OSV advisory keys. Severity is derived from the CVSS v3 score, because the API returns no qualitative rating.
gemini-3.5-flash reads that material and writes the explanation, through the Agent Development Kit for TypeScript, with four read only tools and a schema its answer has to satisfy.
All free, no scraping. A source that cannot be read is recorded as missing and scored as missing, never guessed.