pi-dependency-guard

---

🛡️ Overview

pi-dependency-guard prevents AI hallucinations and supply-chain vulnerabilities from entering your project through Pi Coding Agent.

LLMs commonly hallucinate non-existent package names when writing import statements or proposing installation commands (e.g. npm i fast-auth-helper-ai). Attackers actively exploit this via package hallucination typosquatting, registering fabricated names on npm and PyPI with malicious payloads.

pi-dependency-guard intercepts install commands and validates every dependency against the official registries in real time before execution.

┌─────────────────┐       proposes install       ┌────────────────────────┐
│                 │ ───────────────────────────> │                        │
│    Pi Agent     │                              │  pi-dependency-guard   │
│                 │ <─────────────────────────── │                        │
└─────────────────┘        risk evaluation       └───────────┬────────────┘
                                                             │
                                          queries registry   │
                                                             ▼
                                                 ┌────────────────────────┐
                                                 │   npm / PyPI API       │
                                                 │ (404 -> Hallucinated)  │
                                                 └────────────────────────┘

---

✨ Features

• 🚫 Zero Hallucinations: Instantly flags non-existent packages as CRITICAL risk.
• 🌐 Direct Registry Verification: Hits official registry.npmjs.org and pypi.org endpoints without middlemen.
• ⏳ Age & Download Analysis: Warns on packages newer than 7 days or with fewer than 100 monthly downloads.
• ⚡ Multi-Ecosystem Parsing: Detects packages in npm install, pnpm add, yarn add, and pip install.
• 🤖 Agent Self-Audit Tool (audit_package): Enables Pi to self-verify library existence before generating code.

---

🚀 Installation

Via Pi Package Registry (Recommended)

pi install npm:pi-dependency-guard

Direct from GitHub

pi install git:https://github.com/lleontor705/pi-dependency-guard.git

From Local Source

git clone https://github.com/lleontor705/pi-dependency-guard.git
cd pi-dependency-guard
npm install && npm run build
pi install ./

---

📖 Usage & Commands

Slash Commands

Command	Description
/guard check npm <pkg>	Queries the npm registry for release date, version, and monthly downloads.
/guard check pypi <pkg>	Queries PyPI for Python packages.
/guard scan <command>	Parses an entire command (e.g., npm i express lodash-es) and audits all packages.

Agent Autonomous Tool (audit_package)

Pi uses this tool before proposing any unfamiliar library:

{
  "packageName": "express-jwt-easy",
  "ecosystem": "npm"
}

Response:

{
  "packageName": "express-jwt-easy",
  "ecosystem": "npm",
  "exists": false,
  "isHallucinated": true,
  "riskLevel": "CRITICAL",
  "reasons": [
    "Package \"express-jwt-easy\" does NOT exist in the official npm registry (Hallucination detected)."
  ]
}

Pi immediately halts the hallucinated suggestion and proposes a real package like express-jwt.

---

🏗️ Architecture & Development

# Clone
git clone https://github.com/lleontor705/pi-dependency-guard.git
cd pi-dependency-guard

# Install & Build
npm install
npm run build

---

📄 License

MIT © Luis Leon