Pre-install Python Dependency Poison Scanner for AI Agents

A lightweight scanner that stops exploited CVEs and unmaintained packages before install, aimed at AI-agent users

Problem

A developer built an open-source Python dependency scanner because existing tools either only cover generic CVEs or ignore packages with no release or commit in 2 years, and they lack protection for AI agents that may casually install exploited packages.

Solution

A local CLI and pre-commit hook that scans dependencies before pip/uv install and before agent-generated code runs, flagging CISA Known Exploited CVEs, high FIRST EPSS risks, and packages with no release or commit in two years, with suggested alternatives. Integrates with mainstream AI coding tool hook mechanisms.

Users

Solo developers and small teams using AI coding tools, plus engineers responsible for Python supply-chain security.

MVP

Parse requirements/uv.lock; integrate CISA KEV and EPSS data; flag packages with no release/commit in 2 years; provide pre-commit and agent hooks; output readable reports and exit codes.

Revenue

Open-source core plus team subscription for private rules, CI integration, Slack alerts, and policy hosting.

Why now

AI agents make casual package installation the norm, widening exposure to unmaintained packages and exploited CVEs, while existing scanners do not intercept agent workflows.