
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@contextgraph/agent
Advanced tools
Autonomous agent for contextgraph action execution.
No installation required! Use npx to run commands directly:
npx @contextgraph/agent <command>
Or install globally for convenience:
npm install -g @contextgraph/agent
npx @contextgraph/agent auth
npx @contextgraph/agent run
For automated environments, use an API token:
export CONTEXTGRAPH_API_TOKEN="your-api-token"
npx @contextgraph/agent run
Get your API token from https://contextgraph.dev/settings/tokens
authAuthenticate with contextgraph.dev using OAuth:
npx @contextgraph/agent auth
Opens your browser to complete authentication. Credentials are securely stored in ~/.contextgraph/.
whoamiCheck your current authentication status:
npx @contextgraph/agent whoami
Shows your user ID and token expiration.
run <action-id>Run the autonomous agent loop:
npx @contextgraph/agent run <action-id>
The agent will:
prepare <action-id>Prepare a single action:
npx @contextgraph/agent prepare <action-id>
Spawns Claude to assess whether the action should be broken down into child actions or is ready to execute.
execute <action-id>Execute a single prepared action:
npx @contextgraph/agent execute <action-id>
Spawns Claude to implement the action and mark it complete.
The agent implements a prepare/execute workflow:
Prepare Phase:
Execute Phase:
Autonomous Loop:
run command traverses the action tree depth-firstThe agent integrates with contextgraph.dev's MCP server to:
If authentication fails or tokens expire:
npx @contextgraph/agent auth
This will open a new browser session to re-authenticate.
Tokens expire after a period of time. Re-authenticate with:
npx @contextgraph/agent whoami # Check expiration
npx @contextgraph/agent auth # Re-authenticate if expired
Ensure you have internet connectivity and can reach:
The agent supports two authentication methods:
1. Interactive OAuth (Default)
Credentials are stored in ~/.contextgraph/credentials.json after running contextgraph-agent auth.
2. API Token (Environment Variable)
Set the CONTEXTGRAPH_API_TOKEN environment variable for automated deployments:
export CONTEXTGRAPH_API_TOKEN="your-api-token"
This is ideal for:
API tokens take precedence over file-based credentials when both are present.
The worker uses exponential backoff when no work is available to prevent server overload. Configure polling behavior with environment variables:
WORKER_INITIAL_POLL_INTERVAL - Initial polling interval in milliseconds (default: 2000 / 2 seconds)WORKER_MAX_POLL_INTERVAL - Maximum polling interval in milliseconds (default: 30000 / 30 seconds)When no work is available, the worker waits before polling again. The wait time increases exponentially (1.5x multiplier) up to the maximum interval. On successful claim, the interval resets to the initial value.
Example:
# Poll more frequently (every 1 second initially, up to 15 seconds max)
WORKER_INITIAL_POLL_INTERVAL=1000 WORKER_MAX_POLL_INTERVAL=15000 npx @contextgraph/agent run <action-id>
The agent uses the Claude Agent SDK for reliable, high-performance execution of actions. The SDK provides:
The Claude Agent SDK requires Anthropic API credentials. Set the ANTHROPIC_API_KEY environment variable:
export ANTHROPIC_API_KEY="your-anthropic-api-key"
This is required for:
Generating Long-Lived Anthropic Tokens:
For CI/CD pipelines, cloud deployments, and unattended worker execution, you'll need a long-lived Anthropic API key:
Security Best Practices:
For local development, you can set the key in your shell profile (~/.bashrc, ~/.zshrc) or use a .env file (with proper .gitignore configuration).
cg - ContextGraph Action CLIThe cg CLI provides command-line access to the ContextGraph action graph with full parity to the MCP server tools. It's designed for agent execution workflows, outputting JSON that can be piped through jq or grep for filtering.
The cg binary is included when you install @contextgraph/agent:
npm install -g @contextgraph/agent
Or use with npx:
npx @contextgraph/agent cg <command>
The cg CLI uses the same authentication as contextgraph-agent. Run contextgraph-agent auth first:
npx @contextgraph/agent auth
--org <org-id> - Organization ID (use "personal" for Personal Account)cg fetch <action-id> - Fetch action details
cg fetch 203cf7c9-d21d-4a4a-9dfc-7e82540c351a --detail-level medium
cg fetch 203cf7c9-d21d-4a4a-9dfc-7e82540c351a --org personal
Options:
--detail-level <level> - Detail level: small, focus (default), medium, largecg search <query> - Search for actions
cg search "authentication bug" --mode keyword --limit 5
cg search "login flow" --include-completed --parent-id parent-action-id
Options:
--mode <mode> - Search mode: vector, keyword, hybrid (default)--limit <n> - Maximum results (default: 10)--include-completed - Include completed actions--parent-id <id> - Search within a specific subtree--threshold <n> - Similarity threshold 0-1 (default: 0.3)cg tree [root-id] - Fetch hierarchical tree view
cg tree --depth 5
cg tree root-action-id --include-completed
Options:
--depth <n> - Maximum depth (default: 3)--include-completed - Include completed actionscg list-notes <action-id> - Retrieve all notes for an action
cg list-notes 203cf7c9-d21d-4a4a-9dfc-7e82540c351a
cg create - Create a new action
cg create --title "Fix auth bug" --vision "Auth works correctly" --parent-id parent-id
cg create --stdin < action-data.json
Options:
--title <text> - Action title (required)--vision <text> - Action vision (required)--parent-id <id> - Parent action ID (required)--depends-on <ids> - Comma-separated dependency IDs--branch <branch> - Git branch--repo <url> - Repository URL--freeform <text> - Freeform input text--stdin - Read full JSON payload from stdincg update <action-id> - Update an existing action
cg update action-id --title "New title" --prepared
cg update action-id --stdin < updates.json
Options:
--title <text> - Action title--vision <text> - Action vision--prepared - Mark as prepared--agent-ready - Mark as ready for agent execution--branch <branch> - Git branch--depends-on <ids> - Comma-separated dependency IDs--brief <text> - Brief/institutional memory--stdin - Read full JSON payload from stdincg complete <action-id> - Mark an action as completed
cg complete action-id --visibility public
cg complete action-id --stdin < completion-context.json
Options:
--visibility <level> - Changelog visibility: private, team, public (required)--stdin - Read full completion context from stdin (recommended)cg append-note <action-id> - Append a note to an action
cg append-note action-id --content "Implementation note"
cg append-note action-id --content "User note" --author-type user --author-name "John"
echo '{"content": "Note from stdin"}' | cg append-note action-id
Options:
--content <text> - Note content (required if not using stdin)--author-type <type> - Author type: user, agent (default), system--author-name <name> - Author namecg uncomplete <action-id> - Mark a completed action as incomplete
cg uncomplete action-id
cg move <action-id> - Move an action to a different parent
cg move action-id --new-parent-id new-parent-id
cg move action-id # Makes action independent (no parent)
Options:
--new-parent-id <id> - New parent action ID (omit to make independent)cg delete <action-id> - Delete an action
cg delete action-id --child-handling reparent --new-parent-id parent-id
cg delete action-id --child-handling delete_recursive
Options:
--child-handling <mode> - How to handle children: reparent (default), delete_recursive--new-parent-id <id> - New parent for children when reparenting (required for reparent mode)cg report-completed-work - Report work that was already completed
cg report-completed-work --title "Fixed bug" --parent-id parent-id --visibility team
cg report-completed-work --stdin < completed-work.json
Options:
--title <text> - Action title (required)--parent-id <id> - Parent action ID (required)--visibility <level> - Changelog visibility (required)--stdin - Read full payload from stdin (recommended)All commands output JSON to stdout. Errors are output as JSON to stderr.
Using stdin for complex data:
Many commands support --stdin to read JSON from stdin. This is especially useful for complex payloads like completion context:
# Create with full payload
echo '{
"title": "New Action",
"vision": "Action completed",
"parent_id": "parent-id",
"depends_on_ids": ["dep-1", "dep-2"]
}' | cg create --stdin
# Complete with full context
cat completion.json | cg complete action-id --stdin
CLI options override stdin: When both stdin and CLI options are provided, CLI options take precedence:
# Title from CLI overrides stdin
echo '{"title": "From stdin"}' | cg create --stdin --title "Overridden" --vision "Vision" --parent-id "parent"
Filtering output with jq:
# Get just action titles
cg search "bug" | jq -r '.results[].title'
# Get action IDs
cg tree | jq -r '.. | .id? // empty'
# Pretty print
cg fetch action-id | jq .
# Install dependencies
pnpm install
# Build
pnpm build
# Development mode
pnpm dev
MIT
FAQs
Autonomous agent for contextgraph action execution
The npm package @contextgraph/agent receives a total of 771 weekly downloads. As such, @contextgraph/agent popularity was classified as not popular.
We found that @contextgraph/agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.