Free to use, free to read.

SlopScan

Package-hallucination detection for npm & PyPI

LLMs sometimes recommend packages that don't exist, or exist under a different name than a real, popular one — an opening for slopsquatting attacks that register the hallucinated name with malicious code. SlopScan checks a package against real registry data, GitHub repo signal, and known-good author history before you install it. It's a free-standing API and CLI, and it's the same check Sentinel runs for Pro+ tenants on agentic tool calls.

claude-hookscanner

Integrity checking for Claude Code hooks

Claude Code hooks run arbitrary shell commands on your machine in response to tool events — a real target if one ever gets silently modified or added. claude-hookscanner HMAC-signs your known-good hooks and flags anything that doesn't match on scan, so a tampered or unexpected hook gets caught instead of quietly executing.