
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@jgalego/teamapi-rest-api
Advanced tools
A read-only Fastify REST API over a resolved
Team API as Code org graph — teams, roles, services,
interactions, dependencies, cognitive load, the three org checks (/gaps, /policy,
/topology), DDD context mapping, context bundles, a cross-resource knowledge graph, every
AI-native document domain, and diagrams. Every collection route paginates (limit/offset,
X-Total-Count, RFC 8288 Link) and every GET carries a content-derived ETag.
On top of the JSON routes:
/dashboard — a live browser dashboard: team cards with cognitive-load bars, health
checks, an agent roster with unowned agents marked, the context map with its conflicts, a
walkable knowledge graph, search, diagrams, and (when enabled) an "edit this team → open a
PR" form. One static page, no separate process or build step./docs — interactive Swagger UI./metrics (Prometheus), POST /mcp (MCP over Streamable HTTP),
GET /backstage/catalog, POST /teams/:id/proposals, semantic /search. GET /health
reports which of them this server has, so clients can adapt.
Normally started via the teamapi serve-api CLI command rather than embedded directly, but it's a
plain Fastify plugin if you want to mount it yourself.
Local by default, exposable on purpose. The CLI binds 127.0.0.1 with no auth, which is
right for local use. Binding beyond loopback requires a bearer token (--token /
TEAMAPI_API_TOKEN) or an explicit --allow-anonymous; CORS origins and a per-minute rate
limit are options rather than defaults. The org data this serves — team structure, cognitive
load self-assessments, member names and contacts — is not something to expose unauthenticated
on a shared network, so the server refuses to do it silently.
npm install @jgalego/teamapi-rest-api
import { OrgGraphStore } from "@jgalego/teamapi-core";
import { buildServer } from "@jgalego/teamapi-rest-api";
const store = new OrgGraphStore({ seedUris: [...] });
await store.load();
const app = await buildServer(store, { logger: true });
await app.listen({ port: 3000, host: "127.0.0.1" });
Full docs, endpoint reference, and examples: https://github.com/JGalego/TeamAPI
One org graph, seven doors into it — install only the ones you need:
| Package | What it does |
|---|---|
@jgalego/teamapi | The CLI — validate, diagram, check, import, reconcile, serve and chat with your org |
@jgalego/teamapi-core | The engine: $ref resolution, the org graph, scoring, checks, diagrams, generators |
@jgalego/teamapi-schema | Zod schemas and TypeScript types for the extended spec |
@jgalego/teamapi-rest-api (this package) | REST API, live dashboard, Swagger UI, Prometheus metrics |
@jgalego/teamapi-mcp-server | The org graph as MCP tools for LLM assistants |
@jgalego/teamapi-chat | Chat as a team or member — Anthropic or any OpenAI-compatible endpoint |
@jgalego/teamapi-backstage | Live Backstage catalog entity provider |
Docs, examples and the extended spec: teamapi.dev · github.com/JGalego/TeamAPI
MIT
FAQs
Read-only REST API over a resolved Team API org graph
The npm package @jgalego/teamapi-rest-api receives a total of 34 weekly downloads. As such, @jgalego/teamapi-rest-api popularity was classified as not popular.
We found that @jgalego/teamapi-rest-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.