### Preflight Checklist - [x] I have searched [existing requests](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20label%3Aenhancement) and this feature hasn't been requested yet - [x] This is a single feature request (not multiple features) ### Problem Statement A common issue when using agentic coding tools like Claude Code is the occasional hallucination or installation of deprecated npm packages (like `request` or `moment`) into modern codebases. This creates technical debt

[FEATURE] Plugin Proposal: PkgDiet Dependency Guardrail

Status Open

Maintainer reply None cached

Activity 0 comments · opened Sep 21, 2026

Preflight Checklist

[x] I have searched existing requests and this feature hasn't been requested yet
[x] This is a single feature request (not multiple features)

Problem Statement

A common issue when using agentic coding tools like Claude Code is the occasional hallucination or installation of deprecated npm packages (like request or moment) into modern codebases. This creates technical debt and potential maintenance issues before the code even reaches a human reviewer.

Proposed Solution

I have built an open-source, local-first dependency-policy tool called PkgDiet. I am proposing the addition of a PkgDiet plugin/skill to the official plugins/ directory.

This plugin pairs a .claude.json MCP server integration with a SKILL.md prompt. The prompt instructs Claude to pre-vet dependencies using npx pkgdiet before running any package manager install commands. If a package is deprecated or unhealthy, Claude automatically blocks the install and suggests a modern alternative.

Alternative Solutions

Currently, developers have to catch these bad dependencies during code review, rely on static analysis, or wait for CI pipeline failures. Moving the guardrail directly into Claude Code prevents the hallucinated install from happening in the first place.

Priority

Medium - Would be very helpful

Feature Category

MCP server integration

Use Case Example

User tells Claude Code: "Install a library to make HTTP requests."
Claude attempts to install the legacy request package.
Because of the SKILL.md prompt, Claude first invokes the PkgDiet MCP tool check_dependency.
PkgDiet returns a BLOCK verdict because request is deprecated.
Claude informs the user and uses suggest_alternative to recommend installing undici or axios instead.

Additional Context

Since Pull Requests are currently restricted to collaborators, I wrote the README.md and SKILL.md for this plugin on my personal fork. You can view the proposed code here:
👉 https://github.com/om-tajne/claude-code/tree/add-pkgdiet-plugin/plugins/pkgdiet

View original on GitHub ↗