process · dependency-existence-check TEC-0007 · ratchet: gate

Verify packages exist before installing

Check every suggested dependency against the registry and an allowlist before it is installed.

Intercept install commands and package additions from the agent. Confirm the package exists, is not newly registered, and matches an allowlist or a lockfile. Reject anything else and feed the rejection back so the model picks a real package.

Requires: Requires a registry lookup in the install path, and an allowlist for newly registered packages.

Addresses: Writing secure code and dependencies

Contexts: Coding agent

Does it work?

supported so far2 supporting · 0 contesting sources · last moved 2026-09-04

Efficacy claims — what this technique actually moves, under which conditions, and whether that has been contested.

Needs: an environment where code can run

Cost: low

Fails when:

The missing package is one the agent never declared. Existence checks catch invented packages, not omitted ones, so the project still fails in a clean environment. (helps, narrowly)

observationsingle paper
Checking that every package an agent names actually exists catches the invented ones but not the missing ones: what agents declare is routinely a fraction of what their code imports at runtime, so generated projects fail in a clean environment even when every declared package is real. Existence is a necessary check, not a sufficient one.
- supports AI-Generated Code Is Not Reproducible (Yet): An Empirical Study of Dependency Gaps in LLM-Based Coding Agents (2025)
- supports We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (2024)

Code

No repository linked yet. Contribute one.

Sources

Either way, bring evidence: a link, or what you saw.

Whether a technique works is a claim. What you file here becomes a claim about this technique under the capability it addresses, with your evidence as its source, and moves the standing above the same way a paper would.