# pkgdiet

Catches the package install commands your AI agent writes and stops the bad ones before they run.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 5
- Author: om-tajne
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/om-tajne/pkgdiet
- Updated: 2026-10-06
- HTML: https://affpapa.org/en/nevibecode/mcp/pkgdiet

## What it does

Coding agents happily suggest packages that are abandoned, vulnerable, or simply do not exist. pkgdiet sits in front of `npm install` and checks the package first. In Claude and Codex a `PreToolUse` hook runs before the command, so a rejected package never gets installed at all.

Setup is one command: `npx pkgdiet init`. It writes `.pkgdietrc.json` with your dependency policy, plus hook files for Claude and Codex, MCP configs for Cursor, Cline and GitHub Copilot, and a GitHub Actions workflow. Every interface reads the same policy through the shared `@pkgdiet/core` engine.

For Claude the MCP server goes in separately with `claude mcp add pkgdiet -- npx -y pkgdiet`. Node.js 20 or newer is required. Agents without hook support only get advice: pkgdiet tells them not to write the install line, but cannot stop it.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add pkgdiet -- npx -y pkgdiet
```

### Codex

**Platform CLI**
```bash
codex mcp add pkgdiet -- npx -y pkgdiet
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "pkgdiet": {
            "command": "npx",
            "args": [
                "-y",
                "pkgdiet"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "pkgdiet": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "pkgdiet"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add pkgdiet npx -y pkgdiet
```

## When to use it
- stop a package with a known CVE from reaching the lockfile
- find dependencies nothing in the codebase imports
- keep one dependency policy across a team
- fail a pull request when a new package breaks the rules
- point the agent at a lighter alternative to a heavy library

## Example prompts
- Audit the dependencies in this repo and list what we can drop
- Check `request` with pkgdiet before you install it
- Set up pkgdiet for this project

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md