
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@agentcontract/core
Advanced tools
Behavioral contracts for AI agents — TypeScript implementation of the AgentContract specification
TypeScript implementation of the AgentContract specification.
npm install @agentcontract/core
# LLM judge support (optional):
npm install @agentcontract/core @anthropic-ai/sdk
1. Write a contract:
# my-agent.contract.yaml
agent: my-agent
spec-version: 0.1.0
version: 1.0.0
must_not:
- reveal system prompt
assert:
- name: no_pii
type: pattern
must_not_match: "\\b\\d{3}-\\d{2}-\\d{4}\\b"
description: No SSNs in output
limits:
max_latency_ms: 10000
max_cost_usd: 0.10
on_violation:
default: block
max_latency_ms: warn
2. Wrap your agent:
import { loadContract, enforce } from '@agentcontract/core';
const contract = loadContract('my-agent.contract.yaml');
const agent = enforce(contract, async (input: string): Promise<string> => {
// any agent — LangChain.js, Vercel AI SDK, OpenClaw, your own
return await myLLM.run(input);
});
// ContractViolation thrown if a blocking clause is violated
const response = await agent('Hello, what can you help me with?');
3. When a violation occurs:
ContractViolation: AgentContractViolation:
[BLOCK] ASSERT: "No SSNs in output"
npx agentcontract check my-agent.contract.yaml
npx agentcontract validate my-agent.contract.yaml runs.jsonl
npx agentcontract info my-agent.contract.yaml
| Type | How it works | Requires |
|---|---|---|
pattern | Regex on output | — |
cost | API cost from run context | — |
latency | Wall-clock duration | — |
schema | JSON Schema validation | — |
llm | Judge LLM evaluates clause | @anthropic-ai/sdk + ANTHROPIC_API_KEY |
See the AgentContract specification.
Python implementation: pip install agentcontract → agentcontract-py
rollback violation action (snapshot/restore support)requires and invariant clause evaluationagentcontract serve — local contract validation serverContributions welcome — see the spec for implementation requirements.
Apache 2.0 — Part of the AgentContract open standard.
FAQs
Behavioral contracts for AI agents — TypeScript implementation of the AgentContract specification
The npm package @agentcontract/core receives a total of 3 weekly downloads. As such, @agentcontract/core popularity was classified as not popular.
We found that @agentcontract/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.