PkgDiet is a local MCP server that lets an AI coding agent evaluate npm packages against your repository's dependency policy before installing them.
Check a dependency before install — check_dependency takes a package name and returns a structured ALLOW / WARN / BLOCK verdict with evidence (health score, known CVEs via OSV, npm provenance, typosquat and dependency-confusion signals, pinning).
Find a better package — suggest_alternative returns lighter, healthier, maintained replacements for a blocked or risky package (e.g. moment → dayjs, date-fns).
Read the active policy — get_policy returns the repository's .pkgdietrc.json rules (health thresholds, blocked packages, failOn, security mode) so the agent knows what is allowed.
Together these let the agent vet and swap dependencies at generation time rather than after a risky install.
Enables CI/CD integration to parse package-lock.json diffs and block pull requests that introduce unhealthy dependencies.
Provides dependency intelligence for npm packages, enabling package health, size, maintenance, and alternative recommendations before installing or replacing dependencies.
Dependency policy for AI-assisted JavaScript and TypeScript development.
Put your node_modules on a diet.
The Problem: AI coding agents (Claude Code, Codex, Cursor, Windsurf, Cline) propose nonexistent, deprecated, vulnerable, or typosquatted packages. There is no built-in mechanism to stop them from running the install.
The Solution: PkgDiet intercepts every npm install / pnpm add / yarn add command your AI agent generates — using native agent hook APIs — and blocks unapproved installs before they execute.
Run this to see PkgDiet block real risky AI-generated dependencies in your terminal:
npx pkgdiet@2.0.1 demoExample output:
🔒 PkgDiet — Live AI Dependency Enforcement Demo
Simulating what happens when an AI agent tries to install these packages.
🟡 WARNING — moment
Context: AI suggested this for date formatting
Score: 100/100
Reason: Efficiency Flag: Better alternatives exist for moment.
Use this: dayjs, date-fns
🔴 BLOCKED — request
Context: AI suggested this for HTTP requests
Score: 15/100
Reason: Health score 15 is below minimum allowed (60).
Use this: undici, native fetch
CVEs: GHSA-p8p7-x288-28g6
🔒 PkgDiet blocked this risky AI-generated dependency before install.
🔴 BLOCKED — node-uuid
Context: AI suggested this for UUID generation
Score: 15/100
Reason: Health score 15 is below minimum allowed (60).
Use this: crypto.randomUUID(), uuid
🔒 PkgDiet blocked this risky AI-generated dependency before install.
🟡 WARNING — lodash
Context: AI suggested this for array utilities
Score: 80/100
Reason: Efficiency Flag: Better alternatives exist for lodash.
Use this: lodash-es, native JS
📊 Demo Summary: 2 blocked, 2 warned
These checks run automatically before every npm install in your AI agent.
Setup: npx pkgdiet@2.0.1 initFor machine-readable CI proof:
npx pkgdiet@2.0.1 demo --jsonRelated MCP server: dependency-health-mcp
npx pkgdiet@2.0.1 initThis single command creates:
File | Purpose |
| Repository dependency policy |
| GitHub Actions CI gate |
| Cursor MCP server |
| Cursor always-applied enforcement rule |
| Cursor advisory rule (legacy) |
| Windsurf advisory rule |
| Cline MCP server |
| GitHub Copilot MCP |
| Claude Code advisory rule |
| Claude Code PreToolUse hook registration |
| Claude Code bash install guard |
| Codex PreToolUse hook registration |
| Codex Node.js install guard |
PkgDiet uses each agent's native hook API to block installs — not just advisory rules:
Agent | Enforcement Mechanism | What it blocks |
Claude Code |
| npm/pnpm/yarn install before execution |
Codex (OpenAI) |
| npm/pnpm/yarn install before execution |
Cursor | MDC | Prevents AI from writing install commands |
Windsurf |
| Prevents AI from writing install commands |
Cline | MCP | Blocks before install via tool call |
GitHub Copilot | MCP | Blocks before install via tool call |
CI (GitHub Actions) |
| Blocks PR merge if any new package fails policy |
How PreToolUse hooks work: When Claude Code or Codex generates a Bash tool call containing
npm install, the registered hook script runs first. If PkgDiet returns a non-zero exit code, the agent sees the denial reason and aborts the install — the command never runs.
PkgDiet uses a shared core engine (@pkgdiet/core) so all interfaces apply the same evaluation logic.
Repository Policy: A single .pkgdietrc.json file dictates what is allowed, warned, or blocked for your project.
Agent Hook (Enforce): Native PreToolUse hooks for Claude Code and Codex intercept install commands before execution. MCP check_dependency instructs other agents before they write the command.
CI Gate (Fallback): npx pkgdiet ci runs in GitHub Actions, diffs package.json against the base commit, and fails the PR if any added package violates policy.
Commands:
audit Audit existing dependencies for policy, health, size, and unused-package signals
check Evaluate npm packages against this repository's dependency policy
demo Show live proof that PkgDiet blocks risky AI-generated dependencies before install
mcp Start the MCP JSON-RPC server over stdio for MCP-compatible AI coding agents
ci Enforce policy for dependency changes introduced by this branch
init Set up PkgDiet — creates policy, CI workflow, and all AI agent configs
agent-setup Configure PkgDiet for AI coding agents (codex, cursor, claude-code, ...)
alternatives Browse the PkgDiet alternatives dataset
drift Scan project for dependency health drift over time
policy-check Validate the repository's .pkgdietrc.json policy.pkgdietrc.json){
"minHealthScore": 70,
"warnHealthScore": 80,
"blockDeprecated": true,
"blockKnownVulnerabilities": true,
"blockTyposquats": false,
"requirePinnedVersions": true,
"maxPackageSizeBytes": 15728640,
"failOn": "BLOCK",
"securityMode": "fail-open",
"blockedPackages": ["moment", "request"],
"internalNamePrefixes": [],
"environments": {
"ci": { "minHealthScore": 80, "failOn": "BLOCK", "securityMode": "fail-closed" },
"dev": { "minHealthScore": 60, "failOn": "BLOCK", "securityMode": "fail-open" }
}
}PkgDiet acts as a local Model Context Protocol (MCP) server.
When your AI coding agent connects to PkgDiet, it gains access to:
check_dependency: Evaluates an npm package against your local .pkgdietrc.json policy and returns structured ALLOW, WARN, or BLOCK verdicts with evidence.
suggest_alternative: Queries PkgDiet's curated dataset to find modern, lighter, and maintained alternatives for blocked packages.
Intelligence included (all free, no paid services):
OSV vulnerability database — checks known CVEs for the package version
npm registry provenance — verifies signed npm attestations
Typosquat detection — edit-distance check against 15+ popular package names
Lockfile pinning validation — requires exact version pins in CI
Dependency confusion detection — blocks internal-prefix packages found on public registry
GitHub Repository: om-tajne/pkgdiet
Report an Issue: Issue Tracker
License: MIT
Check a dependency (e.g. npm package) for health, risk, and cost before installing.
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior. The phrasing 'check ... before installing' implies a read-only, non-mutating operation, which is useful. However, it does not describe the output format, whether the check contacts a registry/network, auth requirements, or possible side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler. It front-loads the operation, states the resource, and enumerates what is checked. Every word contributes to the agent's understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (one required string, no nested objects), and the description covers what it checks and when to use it. However, since there is no output schema, the description should say more about what the agent will receive back; 'health, risk, and cost' implies the result dimensions but not their shape or interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only declares 'package' as a required string with no description. The tool description adds meaning by identifying the value as a dependency such as an npm package. It does not, however, specify accepted formats (e.g. bare name vs. versioned specifier), so it only partially compensates for 0% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Check' and the resource 'a dependency', and it names the evaluation dimensions: health, risk, and cost. It also gives an example ('npm package') and a usage stage ('before installing'). It stops short of 5 because it does not explicitly contrast this tool with its siblings suggest_alternative and get_policy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'before installing' provides clear usage context: this is a pre-install evaluation tool. It does not, however, state when not to use it or explicitly point to suggest_alternative or get_policy as alternatives, so it misses the highest bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the active PkgDiet dependency policy for this repository.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description itself must convey behavior. 'Get' clearly signals a read-only retrieval, and the zero-parameter shape means there is no input-triggered side-effect risk. It does not disclose error or missing-policy behavior, but for a simple getter this is mostly sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that immediately states the action, target, and scope. There is no filler, repetition, or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema getter, the description is sufficiently complete: an agent can invoke it without further setup and can infer that the return value is the active policy. No additional prerequisites or edge cases are necessary to understand the call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema description coverage is effectively 100%. The baseline for a zero-parameter tool is 4, and the description adds no conflicting or missing parameter information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and a clearly identified resource ('active PkgDiet dependency policy for this repository'). This is distinct from the sibling tools check_dependency and suggest_alternative, which imply different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool should be used when the active policy needs to be retrieved, and it scopes that to 'this repository.' However, it provides no explicit guidance about when to choose this tool over check_dependency or suggest_alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Suggest a lighter, healthier alternative for a package.
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavior. It only states the action and gives no indication of side effects, whether this is read-only, or what the output looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with the action and object front-loaded. The qualifiers 'lighter, healthier' add some vagueness but do not make the description bloated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description leaves the return format, input semantics, and behavioral context mostly unspecified. It is enough to guess the intent, but not sufficient for confident, correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only references 'a package' without clarifying the expected format, allowed values, or examples. It minimally confirms that the package is the input, but does not meaningfully compensate for the missing schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Suggest') and names a clear target ('lighter, healthier alternative for a package'), so the tool's basic purpose is understandable. It does not explicitly differentiate from sibling tools, but the intent is not ambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives like check_dependency or get_policy. The only usage signal is implied by the verb 'Suggest,' which is not enough for reliable tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.2.1check_dependencyget_policysuggest_alternativeScored across 3 tools
Each tool targets a distinct action: evaluating a dependency, suggesting an alternative, and retrieving policy. There is no overlap in purpose, so an agent can easily select the right tool.
All tool names follow a consistent verb_noun snake_case pattern (check_dependency, suggest_alternative, get_policy). The naming is predictable and uniform.
With only 3 tools, the set is tightly scoped to the domain of dependency health analysis. Each tool serves a clear, non-redundant purpose and fits within the ideal 3-15 tool range.
The tool surface covers checking, suggesting alternatives, and viewing policy, which supports a typical dependency-review workflow. A minor gap is the absence of any policy update or management tool, but this may be intentionally out of scope.
Packagephobia MCP — install-size analysis for npm packages
Provide AI-powered real-time analysis and intelligence on NPM packages, including security, depend…
Check an npm or Python package, or a package.json, for vulnerabilities and upkeep.
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups