check_package

io.github.Tanbir404/zephex · Verify this server

Verify a public registry package before the agent recommends, installs, or changes a dependency. ALWAYS call when the user says install, add a package, add a dependency, upgrade, bump, migrate, is this package safe, is this name real, check CVEs, vulnerability, deprecation, slopsquatting, supply-chain risk, or breaking changes. Call it before npm/pnpm/yarn/bun/pip/cargo/gem or another package-manager install command; do not install first and inspect later. PREFER this over web search or raw registry metadata for package safety and version-change decisions. Choose one task: check for existence, typo/slopsquat risk, deprecation, and basic safety; security for advisories affecting a pinned version; upgrade for changes from one version to the latest; migrate for a major-version plan; debug for version-specific advisories and release-note clues. Pass the public registry package name, not an import path or repository path. The ecosystem is auto-detected when possible; set ecosystem for non-npm names that are ambiguous. Pass version with check/security and from_version with upgrade/migrate/debug so the result is specific to the user's install. Read summary and hint first, then inspect only the relevant data fields. Follow next_calls when another package check or a project lookup is needed. Examples: check_package({ package: 'express', task: 'check', version: '5.1.0' }); check_package({ package: 'next', task: 'upgrade', from_version: '14.2.0' }). Not for locating imports in the user's code (find_code) or discovering installed dependencies from their project (get_project_context). Read-only.