Launched this week
Agentinel
Stop AI agents from installing malicious packages.
27 followers
Stop AI agents from installing malicious packages.
27 followers
Because your AI loves slopsquatting, Agentinel is a zero-cost, locally-run package guardrail for autonomous AI coding agents (like Claude Code and Cursor). It integrates directly at the hook level to intercept hallucinated and malicious npm packages before they execute, checking them against a 60,000+ threat database in under 2ms
Hey Product Hunt, I am thrilled to launch Agentinel today.
LLMs are incredible coders, but they are genuinely terrible at remembering exact npm package names. They frequently hallucinate packages or fall victim to slopsquatting, where attackers publish malicious packages with names that AIs are known to hallucinate. If you use autonomous agents like Claude Code or Copilot Workspace, your terminal is executing these installs automatically.
Agentinel acts as a security layer that sits between your AI agent and your package manager. It doesn't just scan your repo after the fact; it intercepts the AI's intended command and validates every package before it runs. It executes in under fast using local heuristics and a lightweight offline database, and it is 100% free and open source.
I built this because I wanted the speed of autonomous AI coding without the constant anxiety of what it was installing in the background.
Would love to hear your thoughts, feedback, or any wild AI hallucination stories you've experienced. I will be hanging out in the comments all day to answer questions!
Would love to see support for PyPI in addition to npm since most of my projects mix Python and JS, and the threat landscape is just as real on that side. Could be a huge win for polyglot codebases.
@damlakplapkz05 Thank you, Damla! Yes, PyPI support is definitely in our plans and will be coming very soon.
Hooked it up to Claude Code and it flagged a sketchy npm package in under a second, way faster than I expected. The local-first approach is a nice touch.
@brahimo9zc Thanks, Ibrahim! Keeping it local-first was the only way to make sure it runs in under a second. Really glad it's keeping your environment safe without slowing you down.
honestly this is super relevant right now with all the slop attacks going around. one thing though, it would be really helpful if you could add a dry-run mode that logs any blocked package to a file or stdout without actually stopping execution, basically so teams can audit what their agent tried to install over a week before fully enforcing the block
@sedatvw1m great point on the slop attacks, Sedat. We hadn't considered a dry-run audit mode, but that makes total sense for team adoption. Going to write up an issue for this right now, appreciate the feedback
Hooked it into Claude Code and watched it actually flag a suspicious package before install. Genuinely impressed how fast the checks run locally without slowing things down.
@kayralazoljvn6, this made my day! Keeping the local checks lightning fast was non-negotiable for us. Let us know if you run into any weird edge cases as you keep using it 🙌
Finally got around to setting up the hook in Claude Code and it really did block a sketchy package the agent tried to install, whole check was basically instant. Solid little safety net for anyone running agents unsupervised.
@remzi698130 This is exactly what we built it for, Remzi! Having that instant safety net so you can actually trust unsupervised agents is a game changer. Appreciate you checking it out!
slop guard was getting out of hand on my cursor projects, this hooks right in and flags sketchy packages before they sneak into a build. under 2ms really is no noticeable lag
@yaz2013053 Love to hear this yağız! Cursor is such a beast, but it definitely needs those guardrails for slop packages. Really glad the under 2ms speed is keeping things smooth for you!