process · dependency-existence-check

Verify packages exist before installing

Check every suggested dependency against the registry and an allowlist before it is installed.

Intercept install commands and package additions from the agent. Confirm the package exists, is not newly registered, and matches an allowlist or a lockfile. Reject anything else and feed the rejection back so the model picks a real package.

Requires: Requires a registry lookup in the install path, and an allowlist for newly registered packages.

Addresses: Writing secure code and dependencies

Contexts: Coding agent

Does it work?

supported so far2 supporting · 0 contesting sources · last moved 2026-09-04

Efficacy claims — what this technique actually moves, under which conditions, and whether that has been contested.

observationsingle paper
Checking that every package an agent names actually exists catches the invented ones but not the missing ones: what agents declare is routinely a fraction of what their code imports at runtime, so generated projects fail in a clean environment even when every declared package is real. Existence is a necessary check, not a sufficient one.

Code

No repository linked yet. Contribute one.

Does it work?

Code

Sources