Coding agents should pick packages that are fast, reliable, secure, and up-to-date – not just whatever they remember from training data. They need real-time signals: Is this package maintained? Any vulnerabilities? Is there a better alternative?