List your dependencies
Add one row per package name and version — paste them in as an AI coding assistant left them, wildcard versions and all.
CURSOR / GITHUB COPILOT / REPLIT / LOVABLE COMPARISONS
Dependency Guard AI
Paste the dependencies an AI coding assistant added or changed — name and version — and get rules-based flags for wildcard versions, risky name patterns, pre-release tags, and duplicate-functionality packages. No external lookups, just transparent pattern checks.
- Updates live — no submit button
- Rules-based checks only, no external API calls
- All input stays in your browser
Results update automatically as you edit rows.
Risk score 0/100
Duplicate functionality
Flagged dependencies
How it works
Rules-based checks run automatically
Each dependency is checked for wildcard/missing versions, unpinned ranges, pre-release tags, and risky name patterns, and the whole list is scanned for packages that duplicate functionality (two HTTP clients, two date libraries, and so on).
See a risk score and flagged dependencies
A 0-100 risk score, a duplicate-functionality summary, and a flagged-dependency list with plain-language reasons show exactly what to review before merging AI-generated changes.
Continue learning: How AI-generated code creates dependency risks · Can automated scanners secure AI-generated code?
Frequently asked questions
Does this check real vulnerability databases or npm registry data?
No — this tool runs local, rules-based pattern checks only (wildcard versions, name patterns, duplicate categories). It does not call any external API or vulnerability database, so it will not catch a specific CVE.
Why is a wildcard version flagged as high risk?
A wildcard or missing version (*, empty, or "latest") means any future release — including a breaking or malicious one — gets installed automatically with no warning, which is a common way AI-assisted changes introduce instability.
What is a "duplicate functionality" package?
When two or more dependencies in the same list solve the same problem — for example both axios and node-fetch for HTTP, or both moment and dayjs for dates — it usually means an AI assistant added a new dependency instead of reusing one already in the project.
Why are some risky name patterns flagged?
Certain package name shapes (tiny "is-x" utility packages, generic "-utils" grab-bags, or names matching packages with documented supply-chain incidents) carry above-average risk and are worth a second look before trusting them blindly.
Is a flagged dependency automatically unsafe?
No — flags point at patterns worth reviewing, not confirmed problems. A caret range on a well-maintained package is often fine; the point is to make you look rather than accept every AI-added dependency unreviewed.
How We Compare
| Feature | MVPHub | GitHub Copilot | Replit |
|---|---|---|---|
| Flags wildcard versions and risky name patterns | Included | Not included | Not included |
| Detects duplicate-functionality dependencies | Included | Not included | Not included |
| Instant and free, no external API calls | Included | Not included | Included |
| Live vulnerability database lookups (CVEs) | Not included | Not included | Not included |
GitHub Copilot and Replit add dependencies quickly as part of AI-assisted coding, but neither flags risky patterns in what gets added. MVPHub gives an instant, transparent second look at a dependency list before you merge AI-generated changes.
Related tools
Embed this tool
Add this tool to your site with the canonical iframe below. It remains hosted and maintained by MVPHub.