News

Claude Code Plugin 'Version Sentinel' Combats AI Hallucinations for Secure Dependency Management

Claude Code Plugin 'Version Sentinel' Combats AI Hallucinations for Secure Dependency Management

When using Anthropic's CLI coding agent, Claude Code, developers often encounter a significant issue: the AI's hallucination of package versions. For instance, it might suggest npm install [email protected] when a newer version exists, or worse, propose a version entirely absent from the registry. This propensity for hallucination, extending to package versions, introduces considerable supply-chain risks, potentially leading to outdated dependencies, missing security patches, or broken installations.

To mitigate this, a developer has created "Version Sentinel," a Claude Code plugin designed to enforce dependency version integrity. The plugin leverages Claude Code's hook system to hard-block any proposed dependency change until the user verifies that the specified version is legitimate and current.

How It Works

  • PreToolUse Hooks: Intercept edits to manifest files (e.g., package.json, requirements.txt, pyproject.toml, Cargo.toml, *.csproj) and installation commands (e.g., npm install, pip install, cargo add, dotnet add).
  • If no fresh version check has been performed, the action is blocked (exit code 2).
  • Users must then run WebSearch to verify the latest version, followed by /vs-record to log the verified version.
  • Claude subsequently retries the action, which proceeds successfully with the confirmed version.
  • PostToolUse Hooks: Automatically record successful installs, ensuring that verified packages remain unblocked for future operations.

Supported Ecosystems

Version Sentinel provides support across several key development ecosystems:

EcosystemManifestRegistry
npmpackage.jsonregistry.npmjs.org
piprequirements*.txt, pyproject.tomlpypi.org
CargoCargo.tomlcrates.io
.NET*.csprojapi.nuget.org

Bonus Feature: /check-versions

Beyond its blocking mechanism, Version Sentinel includes a /check-versions command. This utility audits all dependencies within a project against their respective upstream registries. It reports version drift without blocking operations, clearly indicating which dependencies are outdated versus those intentionally pinned to specific versions, aiding in comprehensive dependency management.

Installation

The Version Sentinel plugin can be installed directly via the Claude CLI:

claude plugin add KSEGIT/Version-Sentinel

The plugin's source code is available on GitHub (KSEGIT/Version-Sentinel) under an MIT License. Prerequisites for operation include bash, jq, curl, and python3.

↗ Read original source