Know before your agent acts.

Coding agents rarely call optional check tools unless someone tells them to. Worse, a prompt trick inside a skill or README can tell the agent to skip the check. A local PreToolUse hook or package wrapper runs outside the prompt, so the check runs every single time before code can run.

Calling an unreviewed item "safe" gives false comfort. An item with no bad reports is either "no known bad" (if we have checked that exact build) or "unknown" (if no one has checked it yet). Your local policy picks whether unknown items log a quiet note or pause for your sign-off.

No. Your hook checks a small, signed SQLite file stored right on your disk. Lookups finish in under 0.4 milliseconds (measured p99 = 0.37 ms across 500 runs) with no network call. Your private package names, repo paths and prompts never leave your machine.

Every entry is confirmed before it joins the signed list: by a trusted upstream reviewer (OpenSSF malicious-packages, CISA KEV), by an AI review whose claims are re-checked in code, or by a person. Every record links to its source proof. Teams can override any rule locally in policy.yml, and authors can dispute any entry with a 48-hour SLA via our intake endpoint or [email protected].

threat.cafe is independent and not owned by any scanner, registry or agent vendor. The public list stays free under CC-BY 4.0. Money is planned to come from team and MSP policy and logs, and from a commercial feed for agent gateways.