Check that a package exists before your AI agent installs it

说明与用途

在 AI 代理安装前检查包是否存在，可降低安装不存在或不安全包的风险。

问题

AI agents may suggest non‑existent or unsafe packages, leading to failed installs or security risks.

结果

The pre‑install check prevents installation of nonexistent or risky packages, reducing failures and security incidents.

工作流

• 1. Agent proposes a package name.
• 2. Agent calls a safety‑checker API with ecosystem and name.
• 3. API returns package metadata and a verdict (ok, caution, not‑found).
• 4. If verdict is not‑found, agent refuses to install.
• 5. If verdict is caution, agent presents reasons to a human for review.
• 6. If verdict is ok, agent proceeds with installation.

证据

AI coding assistants are good at writing code and surprisingly confident about package names. Every so often they suggest one that does not exist.

来源

If an agent in your workflow runs npm install or pip install on its own, one cheap check closes most of that gap: before installing, ask the registry whether the package is real, how old it is, and whether anything is known to be wrong with it.

来源

I wrapped those checks into one endpoint that returns the same shape for all six ecosystems:

来源

The answer includes exists, the latest version and release date, age in days, version count, weekly downloads for npm, licences, deprecation, known advisories with severity, and a verdict of ok, caution or not-found with the reasons.

来源

In an agent, the rule is simple: if the verdict is not-found, refuse; if it is caution, show the reasons to a human before installing.

来源

The free tier covers 50 checks a month: Package Safety Checker on RapidAPI.

来源