About lurq
Coding agents choose most of the dependencies now, from a snapshot of the ecosystem frozen at training time. lurq is the layer they check first: live signals where metadata is enough, and a real sandbox where it isn't.
The problem
For twenty years a developer chose the dependency. Now an agent does, in seconds, from a snapshot frozen at training time and ranked by how often a name appeared in text rather than by whether the package is healthy today.
The cost lands on you: a dependency that looked fine in the diff but hasn't shipped a release in three years, carries an open advisory, or never existed at all. That last one is measurable — published research puts hallucinated package names at over 5% of commercial-model recommendations, and the same fake names recur across runs, which is what makes them registrable by an attacker.
What lurq does
lurq ingests public signals from npm, GitHub, and deps.dev and scores each package on health and quality, then exposes the result as an MCP server, a CLI, an HTTP API, and an installable skill. Your agent asks before it picks; lurq answers with something short, scored, and checkable.
Where the evidence comes from
Most of what you can know about a package is readable: downloads, release cadence, advisories, bundle size. Some of it is not. Whether a package installs cleanly, whether it imports without throwing, whether two versions can coexist in one tree — those are only knowable by running them. So lurq runs them, in an isolated sandbox, and keeps the result alongside the score.
That is also why plan exists. Six individually healthy packages can still refuse to install together, and no amount of per-package scoring catches it. Compatibility is mined from real co-installs, so a stack is checked as a set rather than as a list.
Where this goes
Packages are the beachhead: the largest registry, the fastest churn, the most agent traffic. The same approach extends to everything else an agent depends on and can be wrong about — MCP servers, HTTP APIs, CLI tools — anywhere a claim can be settled by running something rather than by asking around.
Principles
Evidence over popularity
Stars and download counts measure attention, not health. lurq ranks real signals: maintenance cadence, advisories, deprecations, bundle cost.
Proof over opinion
Where a claim can be settled by running something, we run it. Install it in a sandbox, import it, co-install the set, and keep the evidence.
Fresh, not frozen
Models recommend from training data that ages out. lurq re-syncs daily, so your agent sees the ecosystem as it is today.