Introduction

lurq is the verification layer for everything your coding agent installs. Before an agent adds a package, pins a version, writes an import, or wires in an MCP server, lurq checks it against live evidence: does it exist, is it safe, does it install alongside the rest of the stack, and does the version actually export what the agent is about to call. It reaches your agent as an MCP server, a CLI, and an installable agent skill.

Think of lurq as a companion to your coding agent: your agent writes the code; lurq checks what it is about to depend on. It's tuned for token cost, speed, and retrieval quality.

Why it exists

Coding agents are good at writing code but bad at judging dependencies. They:

• reach for packages frozen at their training cutoff, missing anything newer;
• hallucinate package names that were never published, which typosquatters then register;
• lean on whatever was popular when the model was trained, not what's healthy now.

…and they write code against APIs that moved. A package name can be right, healthy, and current, and the call your agent just wrote still wrong, because the symbol it used was removed three majors ago.

lurq fixes this with a live index built from public signals (npm, GitHub, deps.dev, OSV, bundlephobia), plus two things metadata can't tell you: what a version actually exports, extracted from its shipped code, and whether a set of packages actually installs together, established by running it. Scores are computed, never hand-written, and every response carries a dataAsOf timestamp.

What you get

Once connected, your agent can call fifteen MCP tools:

Before installing

• verify: is a package real, healthy, and safe?
• evaluate: full evidence read for one package
• compare: rank 2–5 packages by health
• policy: the rules your account holds agents to

Whole stacks and projects

• compat: will these packages actually install together?
• audit: a whole project's dependencies and MCP servers in one call
• diagram: a reference-architecture diagram for a stack

Writing the code

• usage: a version's real API, and what changed since the one you know
• resolve_surface: exactly what a version exports at runtime
• diff_surface: what a version bump adds, removes, or re-shapes

MCP servers

• mcp_surface: a server's real tool contract
• mcp_drift: what a server changed between two versions
• mcp_stack: do these servers collide in one agent?

Housekeeping

• capabilities: which lurq tool answers this situation
• report_outcome: tell lurq how a pick worked out

The same engine is available from your terminal — see the CLI reference — including lurq check-upgrade, which tells you whether an upgrade removes a symbol your code references, with no test suite required, and lurq mcp-scan, which reads what every MCP server you have configured really exposes.

Scope

Ready to connect your agent? Head to the Quick start.