Building an AI Agent That Can Actually Take Action

说明与用途

Portcullis 是一个 AI 代理，自动审核 npm 包，并在获得明确批准后才将其添加到仓库，从而降低恶意依赖的风险。

问题

Developers add npm dependencies without inspecting the code, risking malicious or insecure packages.

结果

Portcullis reduces risk by automatically inspecting npm packages and requiring explicit approval before modifying a repo, ensuring safe dependency management.

工作流

• Ask Portcullis if a package can be added
• Portcullis checks package name for typosquatting
• Collects registry metadata, download stats, OSV advisories
• Downloads tarball into sandbox, unpacks, inspects install hooks and code
• Diffs against GitHub source
• Presents verdict with evidence
• If approved, creates branch, commits dependency line, opens PR

证据

The agent gave me a confident, well‑structured verdict on express…

来源

The sandbox had no bash…

来源

The model mattered more than the prompt…

来源