lurq

lurq

The verification layer for everything your agent installs.

Your coding agent picks npm packages from memory. lurq checks them against the live registry, security advisories, shipped type definitions and real co-installs, before anything lands in package.json.

Install · For AI agents · MCP tools · CLI · Autopilot · Docs

$ lurq verify lodahs

lodahs ✗ do not install 0.0.1-security (latest) without review • name closely mimics "lodash" — possible typosquat • 1 critical/high advisory(ies) recorded against this package risk flags: possible-typosquat-of:lodash, low-downloads, single-maintainer, has-known-advisory

$ lurq verify zod zod ✓ no supply-chain problems found in 4.6.4 (latest) weekly dl: 209.2M confidence: proven advisories: 0

$ lurq compat next @auth/core next-auth next + @auth/core + next-auth conflict peer-deps next-auth needs peer @auth/core@0.34.3, but the stack uses @auth/core@0.41.3

Real output, not a mockup. Your agent gets the same answers over MCP.

---

Why your agent needs this

A model's knowledge of npm stops at its training cutoff. The registry doesn't.

• Invented and typosquatted names. Agents confidently install packages that don't exist, or that exist only because someone registered the misspelling.
• APIs that moved. Of the 38,752 packages lurq tracks, 2,725 shipped a new major version between May 1 and September 13, 2026. Code written from memory calls functions that were renamed or removed.
• Stacks that don't install together. Every package can be healthy on its own while the set fails on a peer or engine range. That usually surfaces at deploy.

lurq answers from evidence it can show: 47,238 packages scored, 4.2M versions tracked, 34,843 API surfaces extracted from shipped code, and 27M co-install pairs, refreshed daily from npm, GitHub, deps.dev and OSV. Every answer carries a dataAsOf timestamp.

Scope: the JavaScript/TypeScript ecosystem (npm).

---

Install

One command, once per machine. Nothing to install first:

npx lurqrun

The setup wizard:

1. Opens lurq in your browser. Sign in and the key comes back to the terminal by itself.
2. Detects every coding agent on the machine.
3. Writes a keyed remote MCP entry for each, in the shape that agent expects.
4. Installs standing instructions where the agent supports them, so it reaches for lurq instead of answering from memory.

Restart your agent afterward. The free plan includes 1,000 hosted calls a month and never asks for a card.

Works with: Claude Code · Cursor · Windsurf · VS Code / GitHub Copilot · OpenAI Codex CLI · Gemini CLI · Google Antigravity · Kiro

Check it worked: ask your agent to _"add zod to this project"_. It should call lurq's verify before installing anything.

Claude Code plugin, no terminal needed:

/plugin marketplace add jadenryu/lurq

/plugin install lurq@lurq

One-click links for Cursor and VS Code are in the quickstart.

The package is published as `lurqrun` (the bare name was taken). The command is lurq:

npm install -g lurqrun

lurq --version

---

For AI agents

If you are an AI coding agent and your user asked you to set up lurq, follow these steps.

1. Run setup.

npx lurqrun setup

In your shell it does not prompt: it prints a one-time sign-in link and exits right away. Give the user that link. When they sign in on this computer, lurq stores a key and connects every detected coding agent by itself. Never invent a key.

2. Or configure non-interactively when the user already has a key from lurq.run/dashboard/keys, or on a cloud, SSH or CI machine, where a sign-in link on this computer can't work:

npx lurqrun setup --yes --no-open --api-key <key> --agent <id>

--agent all configures every detected agent. With --yes, the key can also come from LURQ_API_KEY.

Some checks need no key at all. npx lurqrun check-upgrade --upgrade @ .. compares an upgrade against the names your code actually imports, locally.

3. Tell the user to restart the agent, then confirm lurq appears in its MCP tool list.

Writing the MCP config by hand

Endpoint: https://api.lurq.run/mcp (streamable HTTP), header Authorization: Bearer . The field names differ by client:

Claude Code (~/.claude.json, under mcpServers) and VS Code (mcp.json, under servers):

"lurq": { "type": "http", "url": "https://api.lurq.run/mcp", "headers": { "Authorization": "Bearer <key>" } }

Cursor (~/.cursor/mcp.json) and Kiro (~/.kiro/settings/mcp.json), under mcpServers:

"lurq": { "url": "https://api.lurq.run/mcp", "headers": { "Authorization": "Bearer <key>" } }

Windsurf (~/.codeium/windsurf/mcp_config.json) and Antigravity (~/.gemini/config/mcp_config.json), under mcpServers:

"lurq": { "serverUrl": "https://api.lurq.run/mcp", "headers": { "Authorization": "Bearer <key>" } }

Gemini CLI (~/.gemini/settings.json, under mcpServers). It must be httpUrl, because a plain url is read as SSE:

"lurq": { "httpUrl": "https://api.lurq.run/mcp", "headers": { "Authorization": "Bearer <key>" } }

Codex (~/.codex/config.toml). Headers go in an inline table:

[mcp_servers.lurq]

url = "https://api.lurq.run/mcp" http_headers = { Authorization = "Bearer " }

When to call lurq

When lurq flags something, tell the user what it found and that it came from lurq. An unknown or UNVERIFIABLE result means lurq could not check. It never means the package is clean.

Machine-readable docs: lurq.run/llms.txt · lurq.run/docs/llms-full.txt

---

MCP tools

Fifteen tools. Responses are compact to save tokens, and package answers carry dataAsOf.

Before installing

Across a stack

Writing code

MCP servers

About lurq

Inputs, outputs and verdict definitions for each: MCP tools reference.

---

CLI

The same index, scriptable. Every read command takes --json.

# Before installing

lurq verify jsonwebtoken lurq evaluate zod lurq compare date-fns dayjs moment

Stacks and projects

lurq compat next react react-dom lurq audit . # every dependency and MCP serve