Self-maintaining dependencies
for AI agents.
When the caller is a model, the docs are the contract. An update rewrites one sentence of it and your agent starts calling the tool wrong. Nothing errors, nothing changes type, no test fails, and the version number still says patch.
Stantal finds it, proves it, and puts it back.
Paste this into Claude Code, Cursor or Codex
Your agent does the rest. About a minute.
Set up stantal in this repo. Run `npx stantal connect`, then do what it prints. It needs no account and no API key. Tell me what it found.
Or run it yourself
Claude Code, Cursor and VS Code. Takes about a second.
Why this is new
Prose was never part of the contract before
For thirty years the docs were the part you could change freely. That assumption is still baked into semver, into code review, and into every dependency tool you run.
Before
- The contract was names, types and shapes.
- A compiler could check all of it.
- Documentation sat beside the contract.
- You could rewrite every word of it in a patch release and break nobody.
Now the caller is a model
- The contract is the text a model reads.
- Nothing checks it. Not types, not tests, not semver.
- The documentation is the dispatch logic.
- Delete one sentence and the call goes wrong, on a green build.
Half of this already has a name: schema drift, meaning a renamed field or a new required parameter. That is the easy half, because something somewhere eventually throws. The half nothing checks is the prose.
How a sentence breaks a product
A real tool, from a widely used server
Three of its inputs are optional, none are explained, and the description mentions none of them:
description: "Get list of commits of a branch in a GitHub repository" owner required repo required sha optional, no explanation ← a commit hash? the branch? page optional, no explanation perPage optional, no explanation
A person reads the code and works it out. The AI only ever sees the text above, so it guesses. It puts a branch name where a commit hash goes, the call fails, and your user sees a feature that doesn't work. Nothing in your pipeline noticed, because nothing was wrong with the code.
We went and counted
Most of it leaves no trace
168
changes across 487 releases of 22 popular packages that would make an AI call them differently.
145
of those broke nothing you could have tested for. No error, no type failure, no breaking version.
Twelve of the twenty-two packages had at least one. Ten had none, including both official reference servers. A tool that found something wrong everywhere would just be broken, so the ten matter as much as the number.
The output
What you get
An answer
Take this update, or don't, and the evidence underneath it.
A test you keep
Records what your dependency does today. Fails the day an update takes it away.
A fix
Puts the deleted sentence back into your installed copy, when no released version is clean.
A link
One page you can send to whoever shipped it.
Cost
There is no API key
Tools like this usually need an AI to work, so they need your key, so they need an account before you see anything. We don't.
| What you do | Needs a key |
|---|---|
| See which dependencies give an AI tools | no |
| Compare two versions | no |
| Write the tests | no |
| Find which release broke it | no |
| Put the deleted sentence back | no |
| Second-guess a borderline call | yours, only if you want it |
An AI does one small optional job here: saying yes or no to whether a sentence explains an input, and quoting the text it used. Rules do everything else. Your key, your bill, never ours.
If you're the one shipping the API
You cannot see this from your side
The calls succeed. The error rate is flat. The dashboards are green. The customer is filling in a field wrong because you deleted the sentence that told them not to, and they will not tell you. They will just stop.
Run it on a release you haven't published yet. Nothing has shipped, so there is nothing to defend and nobody to blame. You fix it in ten minutes instead of finding out in six months.