231 Labs · Preview

Block hallucinated dependencies before they install.

PhantomDep Gate is a CI Action that fails the job when a dependency name is missing from the npm registry or outside your allowlist — and leaves an engineering punch list (name, evidence, block).

Stop phantom packages at PR time — names that don’t resolve on the registry never quietly merge.
Enforce an allowlist you control — private or vetted packages pass only when listed.
Get a punch list, not a PDF — each finding: package · evidence · block · next step.
Ship in minutes — one GitHub Action on pull_request; week-1 = block only (no warn noise).

Demo (Preview): add the PhantomDep Gate workflow, a pull request adds @corp/phantom-widget, the gate reports an npm registry miss and blocks, then a punch-list finding. — **Demo (Preview)**

How it works

Add the Action to your repo’s pull_request workflow.
Open a PR that adds or changes npm dependencies.
Gate runs — registry resolve + optional .phantomdep-allowlist.
Miss → block — CI fails; PR comment lists findings. Pass → green.

What it is not

PhantomDep Gate is not an SCA platform, not a malware or vulnerability scanner, and not a promise that allowlisted packages are safe. It checks registry existence and your allowlist — then blocks.

Private-repo seats — $29 / seat / month (Stripe TEST)

Checkout opens Stripe test mode for private seats. Live keys and Production announce held until Al unlocks.

Test mode · no live billing · Preview

Install snippet

# .github/workflows/phantomdep.yml
name: PhantomDep Gate
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: 231Labs/phantomdep@main

Optional allowlist

# .phantomdep-allowlist
@myorg/private-pkg