Check that a package exists before your AI agent installs it

Описание и применение

Проверка существования пакета перед установкой AI‑агентом снижает риск установки несуществующих или опасных пакетов.

Задача

AI agents may suggest non‑existent or unsafe packages, leading to failed installs or security risks.

Результат

The pre‑install check prevents installation of nonexistent or risky packages, reducing failures and security incidents.

Рабочий процесс

• 1. Agent proposes a package name.
• 2. Agent calls a safety‑checker API with ecosystem and name.
• 3. API returns package metadata and a verdict (ok, caution, not‑found).
• 4. If verdict is not‑found, agent refuses to install.
• 5. If verdict is caution, agent presents reasons to a human for review.
• 6. If verdict is ok, agent proceeds with installation.

Доказательства

AI coding assistants are good at writing code and surprisingly confident about package names. Every so often they suggest one that does not exist.

Источник

If an agent in your workflow runs npm install or pip install on its own, one cheap check closes most of that gap: before installing, ask the registry whether the package is real, how old it is, and whether anything is known to be wrong with it.

Источник

I wrapped those checks into one endpoint that returns the same shape for all six ecosystems:

Источник

The answer includes exists, the latest version and release date, age in days, version count, weekly downloads for npm, licences, deprecation, known advisories with severity, and a verdict of ok, caution or not-found with the reasons.

Источник

In an agent, the rule is simple: if the verdict is not-found, refuse; if it is caution, show the reasons to a human before installing.

Источник

The free tier covers 50 checks a month: Package Safety Checker on RapidAPI.

Источник