feat: flag hallucinated Maven dependencies in pom.xml

[frankreyesgarcia]

When Claude adds a <dependency> to pom.xml, the hook already blocks it if the pinned version is outdated. This adds a second check: block it if the groupId:artifactId — or the pinned <version> of a real coordinate — doesn't exist on Maven Central at all, i.e. a coordinate the model hallucinated.

How existence is decided

A single GET of https://repo1.maven.org/maven2/<group as path>/<artifact>/maven-metadata.xml:

• 404 → the coordinate doesn't exist → hallucinated package
• 200, pinned version absent from the <versioning><versions> list → hallucinated version
• 200, version present → fine (an old-but-real version is still handled by the existing outdated check)
• any other status, transport error, unparseable XML, or an empty version list → inconclusive, fails open

This deliberately does not go through git-pkgs/enrichment's registry client: that queries Maven Central's Solr endpoint (search.maven.org) first, which returns found/not-found/timeout inconsistently for the same coordinate and hands back paginated, sometimes-incomplete version lists — fine for best-effort metadata, unacceptable for a hook that blocks writes. maven-metadata.xml is served off a static CDN, carries the complete version list in one file, and is what Maven itself resolves against.

Wiring

The check lives in pkg/maven behind an injected ExistenceChecker (MavenCentralExistenceChecker), mirroring how githubactions.Checker takes a separate Sha resolver; a nil ExistenceChecker leaves only the outdated-version comparison. mismatch.Kind (KindOutdated / KindMissingPackage / KindMissingVersion) tags each report. yul scan picks this up for free (it runs each checker with before="").

Before / after

Before — only outdated pins were caught:

outdated dependencies, use these versions instead:
  org.json:json  20240303 -> 20260522

After — a made-up coordinate or version is caught too:

problems with new dependencies:
  com.example:supercache  does not exist - hallucinated package, remove it or use a real coordinate
  com.google.guava:guava  version 99.0-jre was never published - hallucinated version

Benchmark

benchmark/hallucination/ is a deterministic precision/recall harness for the check — crafted PreToolUse payloads fed straight to the binary, classified on the stderr reason. 21 fixtures (9 real, 8 fake packages, 4 fake versions); precision 1.0 / recall 1.0, stable across runs.

🤖 Generated with Claude Code

[algomaster99]

I think you can reuse git-pkgs API NewClient for example to know if the package is hallucinated or not.

[algomaster99]

This is not the best approach since Maven Central can have multiple repositories, for example, Jenkins, Atlassian, etc.

[algomaster99]

Reduce this. For a larger benchmark, I recommend looking for papers/dataset on arXiv or zenodo.

[algomaster99]

This is a related work: https://arxiv.org/abs/2605.06279.