pkgdiet — Claude Code MCP server: block risky npm installs
Catches the package install commands your AI agent writes and stops the bad ones before they run.
claude mcp add pkgdiet -- npx -y pkgdietWhat pkgdiet does
Coding agents happily suggest packages that are abandoned, vulnerable, or simply do not exist. pkgdiet sits in front of npm install and checks the package first. In Claude and Codex a PreToolUse hook runs before the command, so a rejected package never gets installed at all.
Setup is one command: npx pkgdiet init. It writes .pkgdietrc.json with your dependency policy, plus hook files for Claude and Codex, MCP configs for Cursor, Cline and GitHub Copilot, and a GitHub Actions workflow. Every interface reads the same policy through the shared @pkgdiet/core engine.
For Claude the MCP server goes in separately with claude mcp add pkgdiet -- npx -y pkgdiet. Node.js 20 or newer is required. Agents without hook support only get advice: pkgdiet tells them not to write the install line, but cannot stop it.
What it helps with
- stop a package with a known CVE from reaching the lockfile
- find dependencies nothing in the codebase imports
- keep one dependency policy across a team
- fail a pull request when a new package breaks the rules
- point the agent at a lighter alternative to a heavy library
Example prompts for the agent
- Audit the dependencies in this repo and list what we can drop
- Check
requestwith pkgdiet before you install it - Set up pkgdiet for this project
How to install pkgdiet
Platform CLI
claude mcp add pkgdiet -- npx -y pkgdietPlatform CLI
codex mcp add pkgdiet -- npx -y pkgdietConfig file
{
"mcpServers": {
"pkgdiet": {
"command": "npx",
"args": [
"-y",
"pkgdiet"
]
}
}
}Config file
{
"servers": {
"pkgdiet": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"pkgdiet"
]
}
}
}Platform CLI
gemini mcp add pkgdiet npx -y pkgdietStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about pkgdiet
How do I install pkgdiet in Claude Code?
Run claude mcp add pkgdiet -- npx -y pkgdiet. For actual blocking, also run npx pkgdiet init to generate the hooks and the policy file.
What does pkgdiet do?
It intercepts npm install, pnpm add and yarn add calls from your AI agent and blocks the ones that break your repository policy. It also audits existing dependencies for health, size and unused packages.
How is the hook different from the MCP server?
The PreToolUse hook in Claude and Codex stops the command before it executes. In Cursor, Cline and GitHub Copilot the check_dependency MCP tool only warns the agent, and the agent decides what to do next.
