When using Anthropic's CLI coding agent, Claude Code, developers often encounter a significant issue: the AI's hallucination of package versions. For instance, it might suggest npm install [email protected] when a newer version exists, or worse, propose a version entirely absent from the registry. This propensity for hallucination, extending to package versions, introduces considerable supply-chain risks, potentially leading to outdated dependencies, missing security patches, or broken installations.
To mitigate this, a developer has created "Version Sentinel," a Claude Code plugin designed to enforce dependency version integrity. The plugin leverages Claude Code's hook system to hard-block any proposed dependency change until the user verifies that the specified version is legitimate and current.
How It Works
- PreToolUse Hooks: Intercept edits to manifest files (e.g.,
package.json,requirements.txt,pyproject.toml,Cargo.toml,*.csproj) and installation commands (e.g.,npm install,pip install,cargo add,dotnet add). - If no fresh version check has been performed, the action is blocked (exit code 2).
- Users must then run
WebSearchto verify the latest version, followed by/vs-recordto log the verified version. - Claude subsequently retries the action, which proceeds successfully with the confirmed version.
- PostToolUse Hooks: Automatically record successful installs, ensuring that verified packages remain unblocked for future operations.
Supported Ecosystems
Version Sentinel provides support across several key development ecosystems:
| Ecosystem | Manifest | Registry |
|---|---|---|
| npm | package.json | registry.npmjs.org |
| pip | requirements*.txt, pyproject.toml | pypi.org |
| Cargo | Cargo.toml | crates.io |
| .NET | *.csproj | api.nuget.org |
Bonus Feature: /check-versions
Beyond its blocking mechanism, Version Sentinel includes a /check-versions command. This utility audits all dependencies within a project against their respective upstream registries. It reports version drift without blocking operations, clearly indicating which dependencies are outdated versus those intentionally pinned to specific versions, aiding in comprehensive dependency management.
Installation
The Version Sentinel plugin can be installed directly via the Claude CLI:
claude plugin add KSEGIT/Version-SentinelThe plugin's source code is available on GitHub (KSEGIT/Version-Sentinel) under an MIT License. Prerequisites for operation include bash, jq, curl, and python3.