Building an AI Agent That Can Actually Take Action

Description and use

Portcullis is an AI agent that audits npm packages and adds them to a repository only after explicit approval, reducing the risk of malicious dependencies.

Problem

Developers add npm dependencies without inspecting the code, risking malicious or insecure packages.

Outcome

Portcullis reduces risk by automatically inspecting npm packages and requiring explicit approval before modifying a repo, ensuring safe dependency management.

Workflow

• Ask Portcullis if a package can be added
• Portcullis checks package name for typosquatting
• Collects registry metadata, download stats, OSV advisories
• Downloads tarball into sandbox, unpacks, inspects install hooks and code
• Diffs against GitHub source
• Presents verdict with evidence
• If approved, creates branch, commits dependency line, opens PR

Evidence

The agent gave me a confident, well‑structured verdict on express…

Source

The sandbox had no bash…

Source

The model mattered more than the prompt…

Source