
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
LexQ CLI — manage policies, simulate rules, and deploy from the terminal. Built for humans and AI agents.
The Decision Operations Platform for engineering teams. CLI and MCP server for LexQ — move business rules out of your deploy pipeline, prove every change with Impact Simulation, and ship without a git push.
Your business rules — pricing, promotions, fee logic, eligibility checks — change often. But every change ships through the same PR → review → staging → deploy cycle as your core application code. A one-line discount rule takes two weeks.
This is an architectural problem, not a process problem. Business logic that changes weekly shouldn't live in code that ships quarterly.
LexQ separates the two. Rules live outside your application. You change them in a visual console or through this CLI. You prove every change with Impact Simulation against real execution data. You deploy without touching your codebase.
Every decision leaves a full audit trace.
npm install -g @lexq/cli
Or run without installing:
npx @lexq/cli
Requires Node.js 22+.
# 1. Authenticate
lexq auth login
# Enter your API key (create one at console.lexq.io → Management → API Keys)
# 2. Verify
lexq auth whoami
# 3. Start from a domain template — provisions facts, sample rules, and a policy group
lexq domain-templates list
lexq domain-templates apply --template ECOMMERCE
# Returns: policyGroupId, policyVersionId, factsCreated, rulesCreated
# 4. Test a rule against your data before shipping
lexq analytics dry-run --version-id <VERSION_ID> --debug \
--json '{"facts":{"loyaltyTier":"PLATINUM","purchaseSubtotalUsd":150}}'
# 5. Deploy
lexq deploy publish --group-id <GROUP_ID> --version-id <VERSION_ID> --memo "v1"
lexq deploy live --group-id <GROUP_ID> --version-id <VERSION_ID> --memo "Initial deploy"
LexQ is designed to be AI-native. The entire policy engine Partner API is exposed via Model Context Protocol. Claude, Cursor, and other MCP-compatible agents can create, simulate, and deploy rules autonomously, with human approval before production.
https://mcp.lexq.ioFor any MCP client that supports remote servers:
{
"mcpServers": {
"lexq": {
"url": "https://mcp.lexq.io"
}
}
}
OAuth 2.1 authentication is handled automatically by your client.
Run LexQ CLI as a local MCP server:
lexq serve --mcp
Add to claude_desktop_config.json:
{
"mcpServers": {
"lexq": {
"command": "npx",
"args": [
"-y",
"@lexq/cli",
"serve",
"--mcp"
]
}
}
}
.vscode/mcp.json:
{
"servers": {
"lexq": {
"command": "npx",
"args": [
"-y",
"@lexq/cli",
"serve",
"--mcp"
]
}
}
}
Prerequisite:
lexq auth loginmust have been run once to store an API key in~/.lexq/config.json.
LexQ CLI ships with AI Agent Skills — structured documentation agents read to understand how to use the tools, not just what they are.
skills/
├── lexq-shared/SKILL.md Core concepts, auth, workflow
├── lexq-groups/SKILL.md Policy groups, conflict resolution, A/B testing
├── lexq-rules/SKILL.md Condition syntax, action types, mutex
├── lexq-simulation/SKILL.md Dry run, Impact Simulation, compare
├── lexq-execution/SKILL.md History, stats, failure logs, provenance, replay, latency profile
└── lexq-recipes/SKILL.md End-to-end recipes
.claude/CLAUDE.md Claude Code project context
AGENTS.md Universal agent guide (Cursor, Windsurf, Gemini CLI, Cline)
CONTEXT.md Platform architecture & glossary
After installing @lexq/cli, agents can read skills from:
node_modules/@lexq/cli/skills/
node_modules/@lexq/cli/AGENTS.md
node_modules/@lexq/cli/CONTEXT.md
lexq auth login | logout | whoami
lexq status API health check
lexq serve Run as MCP stdio server (--mcp)
lexq groups list | get | create | update | delete | reorder
lexq groups ab-test start | stop | adjust
lexq versions list | get | create | update | delete | clone
lexq rules list | get | create | update | delete | reorder | toggle
lexq facts list | create | update | delete | action-metadata | unregistered
lexq domain-templates list | preview | apply
lexq deploy publish | live | rollback | undeploy | history | detail | overview | deployable | diff | schedule | unschedule | schedules
lexq analytics dry-run | dry-run-compare | requirements
lexq analytics simulation start | status | list | cancel | export
lexq analytics dataset upload | template
lexq profile <groupId> — per-rule latency profile
lexq history list | get | stats
lexq replay decision | start | list | get | cancel
lexq logs list | get | action | bulk-action
lexq provenance get | reveal-audits
lexq webhook-subscriptions list | get | save | delete | test
| Flag | Description |
|---|---|
--format <json|table> | Output format (default: json) |
--api-key <key> | Override stored API key |
--base-url <url> | Override API base URL |
--dry-run | Preview the HTTP request without executing |
--verbose | Show request/response details |
--no-color | Disable colored output |
Config is stored at ~/.lexq/config.json:
{
"apiKey": "YOUR_API_KEY",
"baseUrl": "https://api.lexq.io/api/v1/partners",
"format": "json"
}
git clone https://github.com/lexq-io/lexq-cli.git
cd lexq-cli
pnpm install
pnpm build
pnpm start -- groups list
pnpm typecheck # Type check
pnpm lint # ESLint
pnpm test:fact-key # Fact key grammar
pnpm test:decimals # Metric precision display
FAQs
LexQ CLI — manage policies, simulate rules, and deploy from the terminal. Built for humans and AI agents.
The npm package @lexq/cli receives a total of 93 weekly downloads. As such, @lexq/cli popularity was classified as not popular.
We found that @lexq/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.