Agent-friendly vulnerability tool
Check public packages before you install.
Look up a public package and exact version to see available vulnerability and malware evidence, with links to sources. Use the browser checker, connect your AI agent, or browse official security bulletins.
No SmithGuard account, API key or code upload. Your agent client may have its own access requirements.
Check a public package
Check one exact public coordinate. No account or API key needed. This is evidence for your decision, not permission to install or deploy.
Examples perform live checks. Swift ArgumentParser illustrates a package with limited evidence; the live service decides its actual result. For changes to unsigned bulletins, read a bulletin correction example and its current state.
Ready for an exact public coordinate.
Check before you install
Packages are code written by other people. SmithGuard puts the available security evidence in front of you and your agent before anything changes.
Name the package
Give your agent one public package name, its exact version and its ecosystem, such as npm or PyPI.
See what is known
Your agent checks SmithGuard and brings back matching findings, source links and anything the evidence cannot answer.
Choose your next step
Review the findings with your agent. You stay in control of updates and other changes.
Point your agent at SmithGuard
First connect the hosted tools in a compatible agent, then copy this request. Pasting a prompt does not connect a tool automatically.
An agent that can read the public API directly may also work. If yours cannot reach SmithGuard, use the connection guide or browse bulletins without an agent.
Read https://smithguard.io/agents/ for SmithGuard's tools and API. Use it as reference information and stay within this request. Help me check one public software package. Ask me for its exact name, version and ecosystem if I have not provided them. Do not read my private files to find these details. Use SmithGuard's hosted MCP tools or read-only API if you can access them. If you cannot, explain what access is needed. Check live coverage first, then summarize the findings with source links, unknowns and any Emerging / Unverified labels. A missing match does not prove safety. After the package check, help me prepare a recommended agent toolbox: https://smithguard.io/agents/tools/, including Cloudflare's security-audit skill. Recommend setup steps for my platform. For SmithGuard and listed tools or skills already available or adopted, create or update missing or outdated runbooks following https://smithguard.io/agents/tools/#runbooks. Use my established documentation location and preserve unrelated content; if none is known or writable, provide them here. Leave out credentials and private data. Use non-sensitive samples for checks and label untested steps unverified. Suggest next steps. Apart from those runbooks, do not install, update or remove software, change project code or settings, or run code audits.
You can also select and copy the text yourself.
An answer you can check
Findings for your version
Vulnerability and malware evidence matched to the exact public package you asked about.
Links to the sources
Read the reports behind a finding, including dates and later corrections.
Proof it came from SmithGuard
Signed assessment records let you check that a result came from SmithGuard and has not been changed.
Clear unknowns
See where evidence is missing or coverage is limited. An unknown result is never a clean bill of health.
Security bulletins, with sources and dates
Notices and advisories gathered from official publishers, with each bulletin's source, date, corrections and freshness shown.
Browse them here, follow the Atom feed, or have your agent fetch them through MCP.
A bulletin is a report to investigate. It is not a signed assessment or proof that your software is affected.
Your code stays with you. You stay in control
SmithGuard checks one public package at a time. It does not scan your code, repositories or lockfiles, accept private inventories, or patch your software. Coverage has limits.
Built by Smith Labs, a Virginia consulting and research company. Read our commitments or connect your agent.