
Product
Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.
@kubb/cli
Advanced tools
Official CLI for Kubb. Run kubb generate, kubb init, kubb validate, and kubb mcp to manage the full code generation lifecycle.
Official CLI for Kubb. Run kubb generate to produce TypeScript types, API clients, hooks, validators, and mocks. Includes interactive project setup (kubb init), spec validation, watch mode, and an MCP server.
bun add -D @kubb/cli
# or
pnpm add -D @kubb/cli
# or
npm install -D @kubb/cli
kubb init — scaffold a new projectkubb generate — run code generationkubb validate — validate an OpenAPI speckubb mcp — start the MCP server for AI assistantskubb initScaffold a kubb.config.ts and install plugins for code generation from an OpenAPI spec. Run without flags for an interactive setup wizard, or pass flags to skip the prompts.
npx kubb init
| Flag | Short | Type | Default | Description |
|---|---|---|---|---|
--yes | -y | boolean | false | Skip all prompts and use defaults |
--input <path> | -i | string | ./openapi.yaml | Path to the OpenAPI specification |
--output <path> | -o | string | ./src/gen | Output directory for generated files |
--plugins <list> | string | Comma-separated list of plugins to install |
Available plugin values for --plugins: plugin-ts, plugin-client, plugin-react-query, plugin-vue-query, plugin-zod, plugin-faker, plugin-msw, plugin-cypress, plugin-mcp, plugin-redoc.
# Interactive wizard
npx kubb init
# Accept all defaults
npx kubb init --yes
# Fully non-interactive
npx kubb init --input ./openapi.yaml --output ./src/gen --plugins plugin-ts,plugin-zod
# Select specific plugins only
npx kubb init --plugins plugin-ts,plugin-client,plugin-react-query
The wizard will:
package.json if one does not exist./openapi.yaml)./src/gen)kubb.config.ts with your chosen configurationkubb generateGenerate TypeScript types, API clients, React Query hooks, Zod schemas, and more from an OpenAPI specification. Reads kubb.config.ts by default. Pass an OpenAPI file path as the first argument to override the input without editing the config.
npx kubb generate
| Flag | Short | Type | Default | Description |
|---|---|---|---|---|
[input] | string | OpenAPI file path — overrides input.path in the config | ||
--config <path> | -c | string | Path to the Kubb config file | |
--logLevel <level> | -l | string | info | Log level: silent, info, or verbose |
--watch | -w | boolean | false | Re-generate whenever the input file changes |
--verbose | -v | boolean | false | Override log level to verbose |
--silent | -s | boolean | false | Override log level to silent |
--reporter <names> | string | cli | Reporters that render the run, comma-separated: cli, json, file. Overrides config.reporters |
# Use kubb.config.ts in the current directory
npx kubb generate
# Override the input spec without editing the config
npx kubb generate ./openapi.yaml
# Point to a custom config file
npx kubb generate --config ./configs/kubb.config.ts
# Watch for changes and regenerate automatically
npx kubb generate --watch
# Verbose output
npx kubb generate --verbose
# Write a JSON run report alongside the CLI output
npx kubb generate --reporter cli,json
kubb validateParse and validate an OpenAPI/Swagger file for structural correctness. Reports schema errors, missing required fields, and malformed references. Use this before running generate to catch spec issues early.
npx kubb validate --input <path-or-url>
| Flag | Short | Type | Required | Description |
|---|---|---|---|---|
--input <path> | -i | string | ✅ | Path or URL to the OpenAPI/Swagger file to validate |
# Validate a local file
npx kubb validate --input ./openapi.yaml
# Validate a remote spec
npx kubb validate --input https://petstore3.swagger.io/api/v3/openapi.json
kubb mcpStart a Model Context Protocol (MCP) server that exposes Kubb code generation as a tool for AI assistants. Once running, configure your AI client (Claude, Cursor, Windsurf, etc.) to connect — the assistant can then call kubb generate directly without leaving the chat.
Runs over stdio by default (compatible with all MCP clients). Pass --port to expose an HTTP server instead.
npx kubb mcp
| Flag | Short | Type | Default | Description |
|---|---|---|---|---|
--port <number> | -p | string | Port for HTTP MCP server (omit for stdio) | |
--host <hostname> | string | localhost | Hostname to bind to (HTTP mode only) |
# stdio mode (recommended for Claude Desktop, Cursor, etc.)
npx kubb mcp
# HTTP mode
npx kubb mcp --port 3001
Add the following to your MCP client config (e.g. Claude Desktop's claude_desktop_config.json):
{
"mcpServers": {
"kubb": {
"command": "npx",
"args": ["kubb", "mcp"]
}
}
}
Kubb is an open source project, and its development is funded entirely by sponsors. If you would like to become a sponsor, please consider:
FAQs
Command-line interface for Kubb, enabling easy generation of TypeScript, React-Query, Zod, and other code from OpenAPI specifications.
The npm package @kubb/cli receives a total of 99,315 weekly downloads. As such, @kubb/cli popularity was classified as popular.
We found that @kubb/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.

Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.