ExactGround

What ExactGround MCP server does

ExactGround MCP server helps prevent AI coding agents from installing packages that are absent, unpublished at a requested version, or likely to be look-alikes for popular packages. It checks packages from the public npm registry and PyPI before relevant commands run. The project is intended to reduce package hallucination and slopsquatting risk during agent-assisted development.

Checks cover npm, pnpm, yarn, bun, npx, pip, uv, poetry, pdm, and pipx commands that the parser can understand. The guard also examines dependencies added to package.json, requirements*.txt, and pyproject.toml. Bare npm, yarn, pnpm, and uv installation or synchronization commands can trigger checks for dependencies not present in the lockfile.

The hosted service also checks whether a function or method exists in the exact package version installed. This is useful when an agent proposes an API that may belong to another release, although the provided material does not document the hosted request format.

How it works

The command-line checker can validate individual package references, scan a shell command, or inspect a manifest. It reports missing names with possible corrections, rejects versions that were never published, and blocks npm's 0.0.1-security placeholder. New or lightly downloaded packages, deprecated packages, and yanked releases produce warnings; look-alikes meeting the documented age or download thresholds are blocked.

Agent hooks inspect tool calls carrying a command as shell activity. They also check file paths against ExactGround policy files and can examine writes or patches affecting supported dependency manifests. Commands wrapped in bash -lc are unwrapped. The hooks use strict behavior: registry failures or checker failures result in denial, while the manual CLI warns unless strict mode is selected.

Setup and configuration

Node.js 20 or newer is required. The CLI can run through npx without a separate installation. For hooks, the project recommends cloning a tagged release locally so the hook uses a pinned checkout without downloading at execution time.

exactground init <agent> prints configuration for a supported agent, and --write merges it into the current project. Supported setup paths include a Claude Code plugin, a Codex plugin or generated hook file, a Gemini CLI extension or settings entry, and a Cursor beforeShellExecution hook.

An optional .exactground.json file can allow specific packages, mark private scopes, and change the new-package age or low-download thresholds. A project configuration is not trusted automatically: an explicit exactground trust command records its SHA-256 in the user configuration, and later edits require approval again.

Tools and capabilities

The ExactGround MCP server supports these documented operations and checks:

• Check package names and exact versions against npm or PyPI.
• Scan install commands, including supported package-manager invocations.
• Inspect package.json, requirements files, and pyproject.toml dependencies.
• Detect dependencies missing from lockfiles during bare install or sync commands.
• Check hosted function or method availability for an exact installed package version.
• Apply package allowlists, private scopes, package-age limits, and download thresholds.

Limitations and notes

ExactGround is a cooperative hook-based guardrail, not a sandbox. An agent that deliberately writes scripts, obfuscates commands, edits unseen files, or uses another execution path may evade it. Inline scripts, command substitution, eval-style execution, encoded commands, runtime-built program names, and package names held in variables are denied rather than evaluated in the documented cases.

The hooks do not observe activity outside the agent, such as CI jobs, cron tasks, or other programs. Private registries are only partially covered: when --index-url or --extra-index-url is present, missing names produce warnings because the package may be private. Use an operating-system or container sandbox for an untrusted or adversarial agent.