
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@jgalego/teamapi-chat
Advanced tools
Chat as a team or a member of a Team API as Code org — a provider-neutral tool-use loop over the resolved org graph, for Anthropic or any OpenAI-compatible endpoint
Chat as a team or a specific team member from a
Team API as Code org — backed by a live tool-use loop over
the same ~12 org-graph operations @jgalego/teamapi-mcp-server exposes, so the persona can
accurately answer questions about any team, not just its own.
Normally used via teamapi chat --team <id> [--member <id>] [--ask <question>].
Two adapters, which is what the interoperability landscape actually has:
| provider | endpoint | key |
|---|---|---|
anthropic | the Anthropic Messages API | ANTHROPIC_API_KEY, required |
openai | any OpenAI Chat Completions server | OPENAI_API_KEY, optional |
The openai adapter is fetch against a configurable base URL rather than a vendor SDK, because
that wire format is the de facto interoperability layer: Azure OpenAI, Ollama, vLLM, llama.cpp,
Together, Groq, Fireworks, OpenRouter and most self-hosted gateways all speak it. The key is
optional so a model running locally — which has none — is not the one case that fails.
npm install @jgalego/teamapi-chat
import { buildChatPersona, buildChatTools, createChatSession } from "@jgalego/teamapi-chat";
const persona = buildChatPersona(graph, { teamId: "stream-checkout", memberId: "diego-alves" });
const session = createChatSession({
provider: "openai",
baseUrl: "http://localhost:11434/v1", // or omit for api.openai.com
model: "llama3.1",
system: persona.systemPrompt,
tools: buildChatTools(graph),
});
const answer = await session.ask("is payments overloaded right now?");
console.log(answer.text);
if (answer.stoppedBecause) console.warn(`incomplete: ${answer.stoppedBecause}`);
ask never pretends a turn finished when it didn't: stoppedBecause is tool-limit, refusal
or truncated when the model stopped for a reason other than completing its answer.
A tool is a name, a description, a zod schema and a function — ChatTool, in tool.ts, with no
vendor content in it. An adapter converts that list to the provider's shape and drives the
call-observe-call loop, which is about a hundred lines. runToolByName handles the parts every
adapter needs identically: validating arguments against the schema, and turning an unknown tool or
a thrown error into a message the model can read and recover from rather than an exception that
ends the turn.
Full docs and a sample transcript: https://github.com/JGalego/TeamAPI
One org graph, seven doors into it — install only the ones you need:
| Package | What it does |
|---|---|
@jgalego/teamapi | The CLI — validate, diagram, check, import, reconcile, serve and chat with your org |
@jgalego/teamapi-core | The engine: $ref resolution, the org graph, scoring, checks, diagrams, generators |
@jgalego/teamapi-schema | Zod schemas and TypeScript types for the extended spec |
@jgalego/teamapi-rest-api | REST API, live dashboard, Swagger UI, Prometheus metrics |
@jgalego/teamapi-mcp-server | The org graph as MCP tools for LLM assistants |
@jgalego/teamapi-chat (this package) | Chat as a team or member — Anthropic or any OpenAI-compatible endpoint |
@jgalego/teamapi-backstage | Live Backstage catalog entity provider |
Docs, examples and the extended spec: teamapi.dev · github.com/JGalego/TeamAPI
MIT
FAQs
Chat as a team or a member of a Team API as Code org — a provider-neutral tool-use loop over the resolved org graph, for Anthropic or any OpenAI-compatible endpoint
The npm package @jgalego/teamapi-chat receives a total of 55 weekly downloads. As such, @jgalego/teamapi-chat popularity was classified as not popular.
We found that @jgalego/teamapi-chat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.