What it does
Customs is a checkpoint for coding agents. It checks every package install, git clone and skill fetch an agent runs, before it runs:
- Blocks package names that do not exist on PyPI or npm, and near misses of popular packages. It suggests the real package.
- Asks for approval when a package is new, has known advisories for the version being installed, or its install-time code shows suspicious behaviour.
- Fixes a blocked manifest with
customs fix. It replaces the name, checks the replacement at the pinned version, runs the project's tests, and restores the original file if they fail.
How we built it
Python, standard library only. The checks use the PyPI and npm registries, the OSV vulnerability database and the GitHub API. Install-time code is read, never run. Customs runs as a Claude Code PreToolUse hook, as a Model Context Protocol server, and as a GitHub Action on pull requests.
Results so far
On a labelled set of 22 install commands, the checkpoint caught 12 of 12 fabricated package names and falsely blocked 0 of 10 established packages. The fabricated names do not exist, so this measures that path only. Median check latency is about 0.7 seconds.
Challenges we ran into
Token Factory billing. We have Nebius Token Factory access (welcome email, 19 October 2026), but we could not complete the billing setup. The Billing details form lists 73 to 74 countries, and Liberia, our country of residence, is not one of them. Without billing set up, we have not been able to use the Token Factory API in this project.
As a result, the live Nemotron calls have not run yet. The triage, intent-resolution and injection-scan steps are built and tested with fake transports only, so their results are not reported here. The checkpoint results in this write-up come from the registry, GitHub, advisory and static X-ray checks, which do not depend on Token Factory.
Log in or sign up for Devpost to join the conversation.