🥗 PkgDiet

Check npm packages before you recommend or install them. Apply local policy, identify deprecated or unnecessarily heavy dependencies, and get safer alternatives-without an account or hosted service.

📖 Deep Dive: Read the definitive Architecture Masterclass (ARCHITECTURE.md) to see exactly how PkgDiet intercepts AI agents, scores packages, and enforces CI/CD gates.

---

🚀 Quickstart

Get started in under a minute. pkgdiet setup creates a local policy and, if you select supported agents, configures their MCP connection and dependency-safety rules. No account, hosted service, or GitHub App is required.

# Set up policy and selected AI agents in one guided flow
npx pkgdiet setup

# Check a package manually at any time
npx -y pkgdiet@2.0.0 check moment

🟡 moment
  Health:      100/100
  Verdict:     WARN
  Reasons:     Efficiency Flag: Better alternatives exist for moment.
  Added Size:  4.15MB
  Cost Impact: $0.032/mo CI
  Alternatives: dayjs, date-fns, luxon
  💡 Fix: Run `npm uninstall moment && npm install dayjs` for a lighter alternative.

---

🤖 Supported AI Agents

Agent	Status	Installation
Cursor	Supported	npx pkgdiet agent-setup --agent cursor
Claude Code	Supported	npx pkgdiet agent-setup --agent claude-code
Windsurf	Supported	npx pkgdiet agent-setup --agent windsurf
Claude Desktop	Supported	npx pkgdiet agent-setup --agent claude-desktop
Cline	Experimental	npx pkgdiet agent-setup --agent cline
Copilot	Experimental	npx pkgdiet agent-setup --agent copilot
Antigravity	Experimental	npx pkgdiet agent-setup --agent antigravity

Distribution Channels

Surface	Status	Install
npm CLI	Available	npx -y pkgdiet@2.0.0 setup
Generic stdio MCP	Available	npx -y pkgdiet@2.0.0 mcp
Cursor	Supported after E2E verification	pkgdiet agent-setup --agent cursor
Claude Code	Supported after E2E verification	pkgdiet agent-setup --agent claude-code
Windsurf	Supported after E2E verification	pkgdiet agent-setup --agent windsurf
GitHub Action	Available after real CI test	uses: om-tajne/pkgdiet@v2
VS Code extension	Beta	Marketplace or VSIX
GitHub App/dashboard	Not released	Not required

Limitation: PkgDiet provides policy and risk signals. It is not a substitute for vulnerability scanning, code review, package testing, or an organization’s broader supply-chain security program.

---

🤝 Contributing & Alternatives Dataset

The PkgDiet alternatives dataset (packages/core/data/alternatives.json) is community-driven. We welcome contributions!

Please see our CONTRIBUTING.md to submit:

• New package alternatives.
• False positive/negative reports.
• Agent configuration improvements.

See SECURITY.md for reporting vulnerabilities.

---

🔬 Experimental Features

The apps/ directory in this repository contains highly experimental prototypes for a future Enterprise control plane (Dashboard, Webhooks, Postgres). No hosted PkgDiet service exists. These are internal playgrounds and are not supported for production use.

🔄 Related Servers (Alternatives)

If PkgDiet doesn't fit your needs, check out these excellent alternatives on Glama:

• dependency-health-mcp by power-tester
• mcp-packagephobia by pipeworx-io
• mcp-bundlephobia by pipeworx-io
• mcp-shipcheck by mcp-tool-shop-org
• pkg-intel-mcp by JanMaa
• DepHealth MCP by hasarahman