
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@contextgraph/agent
Advanced tools
Autonomous agent for contextgraph action execution.
No installation required! Use npx to run commands directly:
npx @contextgraph/agent <command>
Or install globally for convenience:
npm install -g @contextgraph/agent
npx @contextgraph/agent auth
npx @contextgraph/agent run
For automated environments, use an API token:
export CONTEXTGRAPH_API_TOKEN="your-api-token"
npx @contextgraph/agent run
Get your API token from https://contextgraph.dev/settings/tokens
authAuthenticate with contextgraph.dev using OAuth:
npx @contextgraph/agent auth
Opens your browser to complete authentication. Credentials are securely stored in ~/.contextgraph/.
whoamiCheck your current authentication status:
npx @contextgraph/agent whoami
Shows your user ID and token expiration.
run <action-id>Run the autonomous agent loop:
npx @contextgraph/agent run <action-id>
The agent will:
prepare <action-id>Prepare a single action:
npx @contextgraph/agent prepare <action-id>
Spawns Claude to assess whether the action should be broken down into child actions or is ready to execute.
execute <action-id>Execute a single prepared action:
npx @contextgraph/agent execute <action-id>
Spawns Claude to implement the action and mark it complete.
The agent implements a prepare/execute workflow:
Prepare Phase:
Execute Phase:
Autonomous Loop:
run command traverses the action tree depth-firstThe agent integrates with contextgraph.dev's MCP server to:
If authentication fails or tokens expire:
npx @contextgraph/agent auth
This will open a new browser session to re-authenticate.
Tokens expire after a period of time. Re-authenticate with:
npx @contextgraph/agent whoami # Check expiration
npx @contextgraph/agent auth # Re-authenticate if expired
Ensure you have internet connectivity and can reach:
The agent supports two authentication methods:
1. Interactive OAuth (Default)
Credentials are stored in ~/.contextgraph/credentials.json after running contextgraph-agent auth.
2. API Token (Environment Variable)
Set the CONTEXTGRAPH_API_TOKEN environment variable for automated deployments:
export CONTEXTGRAPH_API_TOKEN="your-api-token"
This is ideal for:
API tokens take precedence over file-based credentials when both are present.
The worker uses exponential backoff when no work is available to prevent server overload. Configure polling behavior with environment variables:
WORKER_INITIAL_POLL_INTERVAL - Initial polling interval in milliseconds (default: 2000 / 2 seconds)WORKER_MAX_POLL_INTERVAL - Maximum polling interval in milliseconds (default: 30000 / 30 seconds)When no work is available, the worker waits before polling again. The wait time increases exponentially (1.5x multiplier) up to the maximum interval. On successful claim, the interval resets to the initial value.
Example:
# Poll more frequently (every 1 second initially, up to 15 seconds max)
WORKER_INITIAL_POLL_INTERVAL=1000 WORKER_MAX_POLL_INTERVAL=15000 npx @contextgraph/agent run <action-id>
The agent uses the Claude Agent SDK for reliable, high-performance execution of actions. The SDK provides:
The Claude Agent SDK requires Anthropic API credentials. Set the ANTHROPIC_API_KEY environment variable:
export ANTHROPIC_API_KEY="your-anthropic-api-key"
This is required for:
Generating Long-Lived Anthropic Tokens:
For CI/CD pipelines, cloud deployments, and unattended worker execution, you'll need a long-lived Anthropic API key:
Security Best Practices:
For local development, you can set the key in your shell profile (~/.bashrc, ~/.zshrc) or use a .env file (with proper .gitignore configuration).
# Install dependencies
pnpm install
# Build
pnpm build
# Development mode
pnpm dev
MIT
FAQs
Autonomous agent for contextgraph action execution
The npm package @contextgraph/agent receives a total of 1,071 weekly downloads. As such, @contextgraph/agent popularity was classified as popular.
We found that @contextgraph/agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.