# Dependency Guard — AI Package Safety Check (`blueberry_delicacy/dependency-guard`) Actor

Catch the fake, malicious and typosquatted packages your AI told you to install — before they ship.

- **URL**: https://apify.com/blueberry\_delicacy/dependency-guard.md
- **Developed by:** [Laurent Ferrenti](https://apify.com/blueberry_delicacy) (community)
- **Categories:** Developer tools, AI, MCP servers
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $30.00 / 1,000 results

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Dependency Guard 🛡️

**Catch the fake and malicious packages your AI told you to install.**

AI assistants hallucinate package names that don't exist — and attackers
register those names with malware ("slopsquatting"). Dependency Guard checks
every dependency in your project against real package registries, known-malware
advisories, and a maintained list of AI-hallucinated names, then tells you in
plain English what's safe and what to delete.

### Who is this for?

- **Vibe coders & non-technical builders** — you didn't write it, we'll vet it
- **AI coding agents (via MCP)** — verify a package BEFORE you install it
- **Bootcamps & learners** — a safety net against copy-paste malware
- **Small teams & freelancers** — real checks, no enterprise price

### What you get (per package)

Name, whether it actually exists, a 0-100 Risk Score, the reason (hallucinated /
malicious / typosquat / suspicious), the closest legit package you probably
meant, and a plain-English recommendation.

### It knows the difference that matters

A pure-malware package (`lodash-utils`, 2 downloads/week) is flagged **DANGER**.
A mainstream package where only one version was ever compromised (`axios`,
110M downloads/week) gets a calm "make sure you're not on the affected version"
— not a false alarm. That distinction is the whole product.

### Example

Paste your `package.json` → 7 packages checked → `lodash-utils` and
`unused-imports` are malware, `expres` is a typo of `express`, the rest are fine.
Fix them before you ship. Verdict: DANGER.

### Why this matters in 2026

AI writes ~41% of all code, and slopsquatting is a real, growing supply-chain
attack: `huggingface-cli` (an AI hallucination) got 30,000 downloads;
`react-codeshift` spread through 237 repos. One bad install = one breach.

### Inputs

Paste a `package.json`, `requirements.txt` or `pyproject.toml`, give a list of
package names, or point it at a public GitHub repo. npm and PyPI supported.

### MCP-ready

Use it from Claude, Cursor or any MCP client:
"Before you install anything, check it with Dependency Guard."

### Pricing

Pay per scan. A typical project costs a few cents. No subscription.

***

### Need something custom?

Need a custom scraper, MCP server or AI agent? We build them.
**→ \[SLING Studio — get a quote]**

# Actor input Schema

## `manifestContent` (type: `string`):

Paste a package.json, requirements.txt or pyproject.toml. The format is auto-detected.

## `packages` (type: `array`):

Or list package names directly, e.g. \["react", "reqwuests", "express@4.18.0"].

## `repoUrl` (type: `string`):

Or a public GitHub repo URL — its manifest will be fetched automatically.

## `ecosystem` (type: `string`):

npm, pypi, or auto-detect.

## `minRisk` (type: `integer`):

Only report packages with a risk score at or above this (0-100). Default 40 = only real problems (typosquat, suspicious, hallucinated, malicious). Lower it to include everything checked.

## Actor input object example

```json
{
  "ecosystem": "auto",
  "minRisk": 40
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("blueberry_delicacy/dependency-guard").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("blueberry_delicacy/dependency-guard").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call blueberry_delicacy/dependency-guard --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=blueberry_delicacy/dependency-guard",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/acts/KZhpXyzCPLQ94mbPh/builds/Bs8DCIdy4rbuaqeHg/openapi.json