
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@beyondnet/evolith-sdk
Advanced tools
Typed client library for the Evolith Core REST API and MCP tools
Typed TypeScript client library for the Evolith Core REST API and MCP tools. It is a thin, transport-injectable wrapper: no global state, no implicit network configuration, and every method is fully typed against the server contracts.
Status: experimental. The package is published from this monorepo but is not yet wired into a first-party application; it exists so external consumers (satellite repos, automation scripts, the Tracker BFF) can talk to Evolith Core without re-deriving DTOs by hand.
Evolith Core exposes two surfaces:
apps/core-api (URI versioning under the
api/v prefix, so live routes are /api/v1/<resource>);packages/mcp-server over JSON-RPC tools/call.This SDK provides one client class per surface and is the single typed integration point so consumers do not duplicate request shapes.
Since 2.0.0 the response payload types are not hand-authored here: both surfaces
call the same use cases and return the domain objects verbatim, so the SDK re-exports
the canonical contracts from @beyondnet/evolith-core-domain (GateEvidence,
GateViolation, GatePhase, GateVerdict, ViolationSeverity, EvaluatorKind,
ValidationResult, ValidationIssue). What the SDK still owns is genuinely
transport-layer: the response envelope (ApiEnvelope / SuccessEnvelope, mirroring
envelope.interceptor.ts), the request DTOs, and the MCP tool input schemas
(packages/mcp-server/src/tools/*.tools.ts).
workspaceRef and brokers calls to
Core on behalf of end users.All request bodies take an opaque workspaceRef (issued by the Tracker BFF) rather
than raw credentials, keeping the SDK transport-only.
EvolithRestClient is a typed fetch wrapper. Each method returns the full
SuccessEnvelope<T> ({ success, data, meta }); non-2xx responses throw
EvolithApiError.
| Method | Verb / Route |
|---|---|
evaluateGate(gateId, body) | POST /api/v1/gates/:gateId/evaluate |
evaluatePhaseGate(phase, body) | resolves phase → gate id, then evaluateGate |
transitionPhase(body) | POST /api/v1/phases/transition |
listTopologies() | GET /api/v1/architecture/topologies |
getTopology(id) | GET /api/v1/architecture/topologies/:id |
validateSatellite(body) | POST /api/v1/architecture/validate-satellite |
detectDrift(body) | POST /api/v1/architecture/detect-drift |
invalidateTopologyCache() | POST /api/v1/architecture/cache/invalidate |
initProject(body) | POST /api/v1/projects/initialize |
proposeAdvance(body) | POST /api/v1/projects/propose-advance |
Constructor options: baseUrl (required), apiKey (optional Bearer token),
fetch (optional custom implementation), timeoutMs (default 30_000, enforced
via AbortController), and apiPrefix (default /api).
import { EvolithRestClient } from '@beyondnet/evolith-sdk';
const client = new EvolithRestClient({ baseUrl: 'http://localhost:3000', apiKey: 'token' });
const result = await client.evaluatePhaseGate('discovery', { workspaceRef: 'op_abc123' });
// `verdict` is 'passed' | 'failed' | 'skipped' — there is no boolean `passed` on the wire.
console.log(result.data.verdict, result.data.gateId, result.data.rulesetVersion);
for (const v of result.data.violations) {
console.log(`${v.severity} ${v.ruleId} at ${v.location}: ${v.message}`);
}
EvolithMcpClient is transport-agnostic: supply any function that sends a
tools/call request and returns the raw content array. Each method casts the parsed
response to the correct typed output and reports isError.
| Method | MCP tool |
|---|---|
evaluateGate(input) | evolith-gate-evaluate |
validate(input) | evolith-validate |
advancePhase(input) | evolith-phase-advance |
listTopologies(input?) | evolith-topology-list |
getTopology(input) | evolith-topology-get |
call(toolName, input) | generic typed dispatch |
The createJsonRpcTransport(sendRequest) factory adapts any JSON-RPC sender into the
required transport shape.
import { EvolithMcpClient, createJsonRpcTransport } from '@beyondnet/evolith-sdk';
const mcp = new EvolithMcpClient({ transport: createJsonRpcTransport(myRpcFn) });
const gate = await mcp.evaluateGate({ phase: 'discovery', projectPath: '/repos/my-service' });
Unit tests live in src/__tests__/sdk.spec.ts and never touch the network — the
REST client is driven by a mock fetch and the MCP client by a mock transport.
npm test # run the Jest suite
npm run test:cov # run with coverage (≥85% function coverage on the clients)
FAQs
Typed client library for the Evolith Core REST API and MCP tools
We found that @beyondnet/evolith-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.