Dependency pre-flight for coding agents

Drop one file into your project and your agent checks maintenance, license, CI/tests, and known repository-level CVEs before adding an npm dependency. Other ecosystems work when the agent supplies the official GitHub repository.

Claude Code

Save as CLAUDE.md in your project root (or append to an existing one).

markdown

CLAUDE.md

# RepoPilot dependency pre-flight

Before adding a new npm dependency, check its repository-level evidence:

```bash
curl -s "https://repopilot.app/api/v2/check?package=npm:PACKAGE"
```

For another ecosystem, resolve the official GitHub repository yourself and use:

```bash
curl -s "https://repopilot.app/api/v2/check?repo=OWNER/REPO"
```

Read `status`, `recommendation`, `concerns`, `signals`, and `evidence`:
- `proceed_with_review`: no blocking repository-level signal was found. Show the
  receipts, then still verify the exact package version, compatibility, provenance,
  and deployment requirements before installing.
- `review`: explain the concerns or incomplete evidence and ask the user before installing.
- `avoid`: do not install without explicit user confirmation; suggest maintained alternatives.
- `not_analyzed`, resolution failure, or API failure: say the dependency was not verified.
  Never convert missing evidence into an approval.

RepoPilot is decision support, not a security audit. It does not prove that an exact
package version is safe or compatible. Do not re-check dependencies already present in
the project unless the user is evaluating an upgrade.

Or run: curl -s https://repopilot.app/rules/claude.md >> CLAUDE.md

Cursor

Save as .cursor/rules/repopilot.mdc

markdown

.cursor/rules/repopilot.mdc

---
description: Run a RepoPilot pre-flight before adding dependencies
alwaysApply: true
---

# RepoPilot dependency pre-flight

Before adding a new npm dependency, check its repository-level evidence:

```bash
curl -s "https://repopilot.app/api/v2/check?package=npm:PACKAGE"
```

For another ecosystem, resolve the official GitHub repository yourself and use:

```bash
curl -s "https://repopilot.app/api/v2/check?repo=OWNER/REPO"
```

Read `status`, `recommendation`, `concerns`, `signals`, and `evidence`:
- `proceed_with_review`: no blocking repository-level signal was found. Show the
  receipts, then still verify the exact package version, compatibility, provenance,
  and deployment requirements before installing.
- `review`: explain the concerns or incomplete evidence and ask the user before installing.
- `avoid`: do not install without explicit user confirmation; suggest maintained alternatives.
- `not_analyzed`, resolution failure, or API failure: say the dependency was not verified.
  Never convert missing evidence into an approval.

RepoPilot is decision support, not a security audit. It does not prove that an exact
package version is safe or compatible. Do not re-check dependencies already present in
the project unless the user is evaluating an upgrade.

Or run: mkdir -p .cursor/rules && curl -s https://repopilot.app/rules/cursor.mdc > .cursor/rules/repopilot.mdc

How it works

Your agent reads the rules file on every prompt.
Before npm install foo, it calls /api/v2/check?package=npm:foo.
It shows evidence and unknowns. A favourable result still requires an exact-version, compatibility, and provenance review.

Cached checks are free. Live analysis allowances and cost controls are configured by the operator and can change without a deploy.