Pinned Dependencies (Claude Managed Agent)

Overview

The Pinned Dependencies (Claude Managed Agent) evaluation checks whether all packages installed in the Claude managed agent environment are pinned to an exact version. It inspects entries across all supported package managers - pip, npm, apt, cargo, gem, and go - and fails if any package is specified without a fixed version or with a version range.

Metrics

Pinned Dependencies

A binary check: either all packages in the environment are pinned or they are not.

Motivation

Unpinned dependencies are a silent supply chain risk. When a package is specified without an exact version, the environment may install a different version on each build - including one that has been tampered with, typo-squatted, or otherwise compromised. Agentic environments are particularly sensitive to this because the packages they install directly affect the tools and capabilities available to the agent at runtime.

Pinning every dependency to an exact version is a low-effort control that eliminates an entire class of supply chain attacks without requiring runtime monitoring or additional tooling.

Methodology

1. Environment retrieval: The evaluation retrieves the package configuration of the Claude managed agent environment via the Anthropic API using the provided environment ID.
2. Per-package check: Each package entry is checked for an exact version pin according to the conventions of its package manager (e.g. == for pip, @x.y.z for npm and cargo, =version for apt, :x.y.z for gem, @vx.y.z for go). Version ranges, tags such as latest, and entries with no version are all considered unpinned.
3. Scoring: The environment receives a score of 1 if all packages are pinned, 0 if any are not. Self-hosted environments cannot be checked and raise an error.

Scoring

Pinned Dependencies

Examples