CASE 01Design, engineering & open source
Package Health
- Collect
- Score
- Decide
- Explain
- Verify
Caution7 known vulnerabilities in your version
8 REGISTRIES · WEB, API & MCP · OPEN SOURCE
01The challenge
Choosing a dependency means piecing together download counts, release history, GitHub activity and security advisories from different places, and every ecosystem publishes them differently. Coding agents add dependencies too, usually from memory and without checking any of it.
02The approach
Built a LangGraph agent that checks each dependency in its own parallel subgraph: it collects facts from the registry, GitHub and OSV.dev, scores them with fixed rules, lets a decision model pick the verdict and has an LLM explain it. Suggested alternatives are verified against the registry before they are shown, and every step falls back to the rules when a model or data source fails. The same agent serves a React app, a streaming API and an MCP server.
03The result
A free, MIT-licensed tool covering eight registries and thirteen dependency file formats, live as a web app and a public MCP endpoint. There are no accounts: people bring their own GitHub and OpenRouter keys, which are used for each request and never stored, so the public server runs at no cost to anyone.