
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@agentbrain/core
Advanced tools
Shared intelligence layer for AgentBrain - smart context generation for coding agents
Core intelligence layer for AgentBrain - shared library for repository analysis and AI-powered documentation generation.
npm install @agentbrain/core
import { generateContext, loadAIConfig } from '@agentbrain/core'
const aiConfig = await loadAIConfig()
const result = await generateContext({
repoPath: '/path/to/repo',
aiConfig,
maxFiles: 100,
useCache: true,
onProgress: (msg) => console.log(msg),
})
console.log('Generated docs:', result.docs)
console.log('Total tokens:', result.totalTokens)
console.log('Cost:', result.cost)
import { scanRepository } from '@agentbrain/core'
const scanResult = await scanRepository('/path/to/repo', {
maxFiles: 100,
onProgress: (msg) => console.log(msg),
})
console.log('Total files:', scanResult.totalFiles)
console.log('Relevant files:', scanResult.relevantFiles.length)
console.log('Git hash:', scanResult.gitHash)
import { AIClient, loadAIConfig } from '@agentbrain/core'
const config = await loadAIConfig()
const client = new AIClient(config)
const response = await client.generate(
[{ role: 'user', content: 'Explain this code...' }],
'mid', // tier: 'fast' | 'mid' | 'smart'
{ temperature: 0.5, maxTokens: 2000 }
)
console.log(response.content)
console.log('Tokens used:', response.tokenCount)
import { loadCache, saveCache, isCacheValid } from '@agentbrain/core'
// Check if cache is valid
const isValid = await isCacheValid('/path/to/repo', currentGitHash)
// Load cache
const cache = await loadCache('/path/to/repo')
// Save to cache
await saveCachedDoc('/path/to/repo', gitHash, doc)
import {
analyzeDoomLoop,
checkPendingDoomWarning,
getPendingDoomForMCP
} from '@agentbrain/core'
// Analyze git history for doom loops
const result = await analyzeDoomLoop('/path/to/repo', {
commits: 10, // Number of recent commits to analyze (default: 10)
threshold: 4, // Minimum occurrences to flag (default: 4)
})
if (result.detected) {
console.log('Doom loop detected!')
result.files.forEach(f => {
console.log(`${f.path}: ${f.commitCount} times (${f.percentage}%)`)
})
}
// CLI: Check for pending doom warning (stateful - marks as shown)
const warning = await checkPendingDoomWarning('/path/to/repo')
if (warning) {
console.error(warning)
}
// MCP: Get doom warning (stateless - doesn't mark as shown)
const doomWarning = await getPendingDoomForMCP('/path/to/repo')
if (doomWarning?.detected) {
console.log('Files:', doomWarning.files)
console.log('Message:', doomWarning.message)
}
type AIProvider = 'anthropic' | 'openai'
type ModelTier = 'fast' | 'mid' | 'smart'
interface AIConfig {
provider: AIProvider
apiKey: string
models: {
fast: string
mid: string
smart: string
}
}
interface ContextDoc {
type: 'context' | 'dependency-map' | 'patterns' | 'handoff' | 'standards'
content: string
generatedAt: string
gitHash: string
tokenCount: number
}
interface DoomLoopResult {
detected: boolean
files: Array<{
path: string
commitCount: number
percentage: number
}>
}
interface DoomWarningForMCP {
detected: boolean
files: string[] // Formatted strings like "src/auth.ts (8 times · 80%)"
message: string
}
generateContext(options: GenerateContextOptions)Generates complete context documentation for a repository.
generateStandards(options: GenerateStandardsOptions)Generates coding standards files for AI agents (CLAUDE.md, .cursorrules, .windsurfrules).
generateHandoff(options: GenerateHandoffOptions)Generates session handoff document from git diff.
scanRepository(repoPath: string, options?)Scans repository and returns relevant files with scoring.
loadAIConfig(apiKeyOverride?: string)Loads AI configuration from environment or stored config.
saveAPIKey(apiKey: string)Saves API key to secure config file.
analyzeDoomLoop(repoPath: string, options?: { commits?: number, threshold?: number })Analyzes git history to detect doom loops. Returns file paths modified repeatedly above threshold.
checkPendingDoomWarning(repoPath: string)Checks for pending doom warnings in update.log and returns formatted warning message. Stateful - marks warning as shown to prevent repeats. Used by CLI.
getPendingDoomForMCP(repoPath: string)Checks for pending doom warnings and returns structured object. Stateless - does not mark as shown. Used by MCP tools.
installPostCommitHook(repoPath: string)Installs git post-commit hook for automatic context regeneration and doom detection.
uninstallPostCommitHook(repoPath: string)Removes AgentBrain post-commit hook from git repository.
AgentBrain uses a tiered approach to context generation:
This approach:
Cache is keyed by git commit hash:
{repoPath}/.agentbrain/cache.jsonFiles are scored based on:
Files with score < 0 are excluded.
Set via environment variables (highest priority):
export ANTHROPIC_API_KEY="sk-ant-..."
# or
export OPENAI_API_KEY="sk-..."
Or store persistently:
import { saveAPIKey } from '@agentbrain/core'
await saveAPIKey('sk-ant-...')
Stored at ~/.agentbrain/config.json with 0600 permissions.
Default models by provider:
Anthropic:
claude-haiku-4-5-20251001claude-sonnet-4-6claude-opus-4-6OpenAI:
gpt-4o-minigpt-4ogpt-4.1MIT
FAQs
Shared intelligence layer for AgentBrain - smart context generation for coding agents
We found that @agentbrain/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.