# Your agent installs packages nobody reviewed.

Coding agents add dependencies from a model’s suggestion and run the install themselves. There is no pull request to review and no human in the loop at the moment it matters — the moment an install script executes.

Human version: https://installsafe.io/for/ai-coding-agents

## The review step quietly disappeared

A developer adding a dependency reads the name, maybe glances at the download count, and makes a judgement. An agent adding a dependency has already run the install by the time you read the diff. The install scripts ran too, with your shell, your environment variables and your credentials.

The failure does not need the model to be malicious. A hallucinated package name that a squatter has already registered, or a real package whose latest version was compromised an hour ago, both land the same way — and both are invisible in a diff that only shows package.json gaining a line.

## What changes on the machine the agent runs on

### Point the registry once

One line in .npmrc, on your machine or in the agent’s container. Nothing about how the agent works changes; it keeps running npm install exactly as it does now.

### Bad versions never resolve

The proxy filters vulnerable versions out of the metadata npm reads, so the agent’s resolver never sees them. It picks the newest clean version instead — and the install it reports as successful genuinely is.

### Tarballs are checked a second time

A lockfile install skips metadata entirely, which is how most scanners get bypassed. The tarball request is checked against your policy independently, so npm ci is gated too.

## Doesn’t this just break my agent’s workflow?

It does not add a step. There is no CLI to install and no wrapper to invoke — the agent shells out to npm and npm talks to a different registry, so agents that never heard of us are covered by the same config line. If you want an agent to check a package before it reaches the install, there is an MCP server at installsafe.io/mcp — optional, and the proxy does not need it.

When a package is refused, the agent gets an ordinary npm error naming the advisory. In practice they read it and try the fixed version, which is the outcome you wanted from a review anyway.

## Questions

### Which agents does this work with?

Any agent that shells out to npm, pnpm, yarn or bun — Claude Code, Cursor, Copilot, Codex, Devin, or a script you wrote yourself. There is no integration, so there is no list to maintain.

### Does it stop the agent installing anything at all?

No. It refuses versions that match your policy — a known advisory at or above your severity threshold, or a release too new to have been looked at. Everything else installs normally.

### What happens to an install the proxy could not check?

When our advisory sources are unreachable the proxy is configured to fail open: it serves the package rather than breaking every install. We would rather tell you that plainly than claim a guarantee we do not keep.

### Do you have an MCP server?

Yes, at installsafe.io/mcp. It lets an agent ask whether a package has known advisories, and what the highest version without them is, before it runs the install. The proxy works without it — the MCP server is for agents that would rather ask first than be refused.

### Can I see what an agent installed while I was away?

Yes. Every install through your token is recorded with the package, version and any advisories involved, so the diff you review afterwards is not the only record.