Guide · AI agents · October 2026 · by Stefan Tsezarov

Give your agent a second opinion before it acts

You ask your coding agent to fix a build. It reads the README, checks an issue thread, and finds a suggestion:

A plausible fix. One small change. The agent prepares the install command.

But that missing hyphen matters. crossenv was a real malicious package, removed from npm in 2017 after it was found stealing environment variables—the place developers often keep keys and tokens.

The exchange above is an example. The package wasn’t.

01When a suggestion becomes a command

Coding agents read plenty of text you may never see: documentation, issue comments, web pages, and error messages. That context helps them solve problems. It can also steer them toward a bad dependency.

Installing a package deserves particular care. npm packages can include scripts that run during installation, so code may execute before you’ve had a chance to inspect it.

SaveSaveSaveSave’s pre-install guard adds a check at that point. Before a supported install command runs, it looks up the package and applies a policy you’ve chosen.

02What happens to an install?

Consider three commands an agent might propose.

A registry package that raises no flags

npm install cross-env

The guard allows the command to continue. Your usual approval prompt still applies. This means the checks found no reason to object; it isn’t a guarantee that the package is safe.

A package reported as malicious

cd app && npm install --save-dev crossenv

The guard denies the command and tells the agent why. It recognises the install even when it follows another command.

Code fetched directly from GitHub

npx github:someone/setup-script

In the default mode, the guard asks for human review. A Git URL falls outside its npm registry checks, so it cannot provide the same assessment.

Supported commands include installs through npm, pnpm, yarn, and bun, along with npx, npm ci, command chains using &&, and commands wrapped in bash -c "…".

03You choose the rules

The scan supplies evidence: what it checked, what it found, and what it couldn’t assess. A policy running on your machine determines what happens next.

Choose one of three modes:

Use observe to see how the guard behaves in your workflow. Choose guard to block known malicious packages and review uncertain cases. Choose strict when an inconclusive result should stop the install.

04Add it to your workflow

For Claude Code, add this hook to your project’s .claude/settings.json. If the file already contains settings, merge the hook into them.

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "npx -y savesavesavesave@0.1.5 hook claude-code --mode observe"
          }
        ]
      }
    ]
  }
}

The hook checks proposed Bash commands. Commands without a recognised install pass through.

For another agent or script, put the guard before the install command:

npx savesavesavesave@0.1.5 guard --mode guard -- npm install some-package

Its exit codes tell your integration how to proceed:

• 0: allow
• 1: request human review
• 2: deny

Your integration needs to respect those results.

Agents with MCP support can also request checks directly. Client setup instructions are on the For agents page.

No account or API key is required. The examples pin a version so you can review a specific release before using it.

05Know what the check covers

The guard reads information published by the npm registry and OSV.dev. It doesn’t download or execute the package, and it currently covers npm packages, not ecosystems such as PyPI or crates.io.

That leaves a few practical limits:

• It checks supported commands it receives. Installs hidden inside script files, unsupported package managers, or downloaded binaries may fall outside its view. Stronger restrictions require controls on the agent’s network and filesystem access.
• An unreported threat can pass. “No objection” means the available checks found no known risk.
• The hook must run for the policy to work. If you use strict mode, follow the package README’s instructions for blocking commands when the hook itself fails to start.

A coding agent can fix a build quickly. It can also act quickly on a convincing suggestion from someone you don’t know.

Before that suggestion gets access to your machine, give it a second opinion.

Your next step: add the hook in observe mode, review its results, and choose the policy that fits your workflow.