superagent_

// context guardrails

Packages

Score a registry package before an agent installs it, using the same supply chain pipeline as pull request scans.

Score a registry package before an agent installs it. Superagent uses the same supply chain pipeline as pull request supply chain scanning and maps that intelligence into identity, behavior, and content scores.

How scoring works

A package scan accepts ecosystem:name@version, for example npm:lodash@4.17.21 or pypi:requests@2.32.3. The scan runs in three tiers:

  1. Identity — package age, weekly downloads, maintainers, quality, and maintenance signals from package intelligence.
  2. Behavior — install hooks, network access, and other package-scoped alerts.
  3. Content — the same LLM risk assessment used by supply chain scanning on pull requests, inverted into a 0–100 safety score.

The identifier is the lowercase SHA-256 digest of the canonical coordinate. Aliases pip (PyPI), gem (RubyGems), and actions (GitHub Actions) are accepted.

Supported ecosystems

Supported ecosystems are npm, PyPI, Go, RubyGems, and GitHub Actions. Scan failures fail closed, producing package_unscannable rather than a safe result.

Pull request dependency checks continue to use this pipeline automatically when a supported lockfile changes.

Threats

When details=true or the verdict is suspicious / dangerous, package scans may emit package_network_access, package_install_hooks, package_credential_access, and package_unscannable when package intelligence or the risk assessment reports those behaviors.

Use it

  • Dashboard: open Agents → Context, paste a package coordinate, and open the result for identity, behavior, and content scores.
  • REST API: POST /api/v1/context/package to score a coordinate and GET /api/v1/context/package/{identifier} to look up a previous result by SHA-256. See the Context Guardrails API.
  • MCP: scan_package.
curl "https://superagent.sh/api/v1/context/package?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"npm:lodash@4.17.21"}'
curl "https://superagent.sh/api/v1/context/package/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."

GET never starts a new scan.

Next steps