Composer

Composer is PHP's package manager for declaring dependencies, resolving version constraints, and maintaining composer.json and composer.lock in an application or library. It also exposes package search, dependency inspection, security audits, and global tool installation from the same CLI.

• Add, update, remove, and lock PHP packages for a project, then install the exact dependency set in CI or production.
• Search repositories, inspect package metadata, list outdated packages, and explain dependency or version conflicts before changing constraints.
• Audit installed packages for vulnerabilities or abandonment, check platform requirements, and install global PHP tools or run vendored binaries and scripts.

• Commands are mostly non-interactive, support --no-interaction and --working-dir, and return stable exit codes, which fits repo automation well.
• Real JSON output exists for search, show, outdated, fund, licenses, check-platform-reqs, and audit, but install and update flows are still text-first.
• Best fit for agents already operating inside a PHP repo, where Composer becomes the inspect and change layer for dependency state and build-related scripts.

• install, update, exec, and plugin or script hooks can execute third-party code, so unattended runs need trusted inputs or flags like --no-plugins --no-scripts.
• Many useful commands depend on local composer.json and composer.lock state, repository credentials, and network access, so results vary with project context.