A second thought before the install.

Agents can move from a suggestion to a package installation quickly. That makes the installation step a useful place to check known vulnerabilities before a dependency becomes part of a project.

The approach

Refuse combines a package-manager shim with a checking server. The CLI intercepts installation requests, asks the server to evaluate a package version and refuses known-vulnerable versions with a safer-version suggestion. The same idea applies to a developer’s shell, an agent and CI.

  1. 1Install request
  2. 2Advisory check
  3. 3Allow or refuse
  • A CLI layer wraps package managers so checks sit in the existing install workflow.
  • The server can be self-hosted; the project also offers a hosted backend.
  • MCP integration connects the checks to agent tooling.

Explore & contribute

Explore the server and CLI repositories, reproduce an issue, or propose a focused improvement. The repositories include the current contribution and security guidance.