nodisrupt / laravel-agent

v0.2.1 2026-10-08 09:11 UTC

Requires

• php: ^8.1
• illuminate/console: ^10.0 || ^11.0 || ^12.0 || ^13.0
• illuminate/contracts: ^10.0 || ^11.0 || ^12.0 || ^13.0
• illuminate/http: ^10.0 || ^11.0 || ^12.0 || ^13.0
• illuminate/support: ^10.0 || ^11.0 || ^12.0 || ^13.0

Requires (Dev)

• orchestra/testbench: ^8.0 || ^9.0 || ^10.0 || ^11.0
• phpunit/phpunit: ^10.0 || ^11.0

MIT

• security
• composer
• monitoring
• laravel
• vulnerability
• nodisrupt

Published on Packagist.org on 2026-10-08 09:19 UTC

README

Reports your Laravel app's installed Composer dependencies to NoDisrupt, so each package can be matched against known vulnerabilities.

A Laravel app can't be versioned from the outside — there's no version header, tag or feed — and on managed hosting (Laravel Cloud, Vapor) there's no server to install a host agent on. This package runs inside the app: it reads what Composer actually installed and posts the list when the app starts and then on your app's scheduler. No host access required.

Install

composer require nodisrupt/laravel-agent

Then set two environment values — generate them in NoDisrupt under Monitor → Vulnerabilities → Add the package. On Laravel Cloud / Vapor, set them in the dashboard's environment (not in the repo — NODISRUPT_KEY is a live credential):

NODISRUPT_KEY=<your key>
NODISRUPT_MONITOR_ID=<your monitor id>

That's it. The agent reports shortly after your app starts — so a fresh install or a new deploy shows up in seconds — and then keeps it current on a schedule, once a day by default. The boot report runs after the response is sent, so it never slows a request, and is throttled so it sends at most once per deploy rather than on every request (this uses your cache). The scheduled report needs your app's scheduler running (php artisan schedule:run each minute, or your platform's scheduler — on by default on Laravel Cloud).

Reporting now

You don't normally need to — install or deploy and the first report follows on its own. To send one immediately (or after changing dependencies):

php artisan nodisrupt:report-inventory

What it sends

The package name and resolved version of every installed Composer package (dev dependencies flagged as such), read from Composer's runtime InstalledVersions. Nothing else — no code, no environment, no secrets. It POSTs to NODISRUPT_API_BASE/v1/agent/inventory (default https://api.production.nodisrupt.com).

Configuration

Publish the config to change the schedule cadence (hourly, twiceDaily, daily, weekly) or to turn off the boot-time report (NODISRUPT_REPORT_ON_BOOT=false, leaving the scheduler alone):

php artisan vendor:publish --tag=nodisrupt-config

License

MIT.