Claude-reviewed, injection-safe Dependabot automation for GitHub. It auto-updates your dependencies, auto-reviews every PR with a Claude agent, and auto-merges only when it’s safe — decided by a fully deterministic gate, not by the model.
> /plugin marketplace add raphaelcm/dep-steward
> /plugin install dep-steward@dep-steward
Then run /dep-steward:install in the repo you want to protect.
A steward is entrusted to manage something with care and judgment on your behalf. For dependency updates, that means three jobs, in sequence — and a hard line between the one that judges and the one that decides.
Dependabot opens the PRs on a schedule you set. Routine minor and patch bumps arrive grouped into one PR; majors arrive individually, each on its own merits.
A Claude cloud agent reads each PR — the changelog, the breaking changes, and a grep of your code for affected usage — then writes a structured verdict. It never merges anything.
A fully deterministic gate decides the merge. Routine bumps sail through once CI is green. Anything uncertain — a major, a doubt, a red build — finds a human instead.
The reviewer is a language model, so dep-steward treats its verdict as testimony — never as authority. The merge is decided by plain, deterministic code.
AUTOMERGE-DECISION-V1 block, or no merge.
Anything uncertain is escalated the moment it’s found: the PR is labelled needs-human-review, assigned to you, and explained in a comment — once per PR, not once per wake-up.
That includes the refusals that could never resolve on their own. A security update that can’t land shouldn’t look like one nobody needed — so even the pipeline’s dead ends reach a person, instead of a log nobody reads.
Escalated: major bump. The changelog lists a breaking rename, and the reviewer found affected usage in src/pad.js. Holding for a human decision.
When a bump breaks CI, an autofix agent reads the failure and proposes a clean, minimal fix. When the break isn’t clearly the bump’s fault, would need real code changes or a new dependency, or it simply isn’t confident — it escalates, exactly like the review job does. On by default; ask /dep-steward:install to leave it off.
dep-steward is a Claude Code plugin and its own marketplace, so it installs in two commands, straight from the repo. These three then work in every repo you open:
> /plugin marketplace add raphaelcm/dep-steward
> /plugin install dep-steward@dep-steward
Checks the prerequisites in whatever repo you’re in, shows you each file it will write, then installs. Gives you the commands for the one step that needs a browser: minting the token.
A read-only readout: what was auto-merged, what was escalated and why, any security updates it landed, and an honest time-saved estimate. Takes a window: /dep-steward:summary 90d.
Removes the pipeline from a repo — the files, the label, and the token from both secret stores. Forgetting the second one is the usual half-uninstall.
/dep-steward:install checks your repo, shows you each file it will write, and writes them: three short workflow files that run dep-steward’s pipeline at a version your repo pins, plus your Dependabot config. Running it again is safe.
repo + workflow scopes.CLAUDE_CODE_OAUTH_TOKEN, minted with claude setup-token and stored in both of the repo’s secret stores. The install gives you the exact commands.> /dep-steward:install
New versions arrive as a Dependabot PR, which dep-steward always leaves to you. Full details (the files it writes, the FAQ, the security model) are in the README.