
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@mecha.im/cli
Advanced tools
An army of agents. Run autonomous Claude bots in Docker containers with scheduling, webhooks, and bot-to-bot communication over Tailscale.
# Install
npm install -g @mecha.im/cli
# Or run without installing: npx @mecha.im/cli
# Initialize (builds Docker image)
mecha init
# Set your API key
export ANTHROPIC_API_KEY=sk-ant-...
# Or use a profile:
mecha auth add anthropic-main sk-ant-...
# Spawn a bot inline
mecha spawn --name greeter --system "You greet people warmly."
# Chat with it
mecha query greeter "Hello!"
# List bots
mecha ls
# Stop / restart / remove
mecha stop greeter
mecha start greeter
mecha rm greeter
name: reviewer
system: |
You are a code reviewer. You review PRs for bugs,
security issues, and style violations.
model: sonnet
auth: anthropic-main
max_turns: 25
max_budget_usd: 1.00
schedule:
- cron: "*/30 * * * *"
prompt: "Check for new unreviewed PRs."
webhooks:
accept:
- "pull_request.opened"
- "pull_request.synchronize"
workspace: ./myproject
expose: 8080
mecha spawn reviewer.yaml
| Command | Description |
|---|---|
mecha init [--headscale] | Initialize mecha, build Docker image |
mecha spawn <config> [--dir] [--expose] | Spawn bot from config file |
mecha spawn --name X --system "..." [--model M] | Spawn bot inline |
mecha start <name> | Start a stopped bot |
mecha stop <name> | Stop a running bot |
mecha rm <name> | Remove a bot |
mecha ls | List all bots |
mecha query <name> "prompt" | Send a one-shot prompt to a bot |
mecha restart <name> | Restart a running bot |
mecha exec <name> [cmd...] | Run a command inside a bot's container |
mecha logs <name> [-f] | Show bot logs |
mecha auth add <profile> <key> | Add auth profile |
mecha auth list | List auth profiles |
mecha auth swap <bot> <profile> | Swap auth for a bot |
mecha token | Generate a bot token |
mecha dashboard [--port N] | Start fleet dashboard |
Host (CLI) Container (Agent)
───────────────────────── ──────────────────────────
src/cli.ts agent/entry.ts
src/docker.ts (dockerode) agent/server.ts (Hono)
src/store.ts (~/.mecha/) agent/session.ts
src/config.ts agent/scheduler.ts (croner)
src/auth.ts agent/webhook.ts
src/dashboard-server.ts agent/costs.ts
agent/activity.ts
agent/tools/mecha-server.ts
agent/tools/mecha-call.ts
agent/tools/mecha-list.ts
Bots discover each other via Tailscale/Headscale and communicate using built-in MCP tools:
mecha_call — send a prompt to another botmecha_list — discover available bots on the networkmecha_new_session — start a fresh conversationBots run prompts on cron schedules with safety rails:
mecha dashboard
# Opens http://localhost:7700
Fleet dashboard shows all bots with status, costs, and a communication map. Click a bot to access its individual dashboard with chat, tasks, schedule, logs, and config views.
The dashboard now uses a local browser session on localhost so the SPA and proxied bot dashboards work without manually copying bearer tokens into browser requests.
Auth works via environment variable or named profiles:
# Environment variable (simplest)
export ANTHROPIC_API_KEY=sk-ant-...
# Named profile
mecha auth add anthropic-main sk-ant-...
mecha auth add tailscale-main tskey-auth-...
Profiles are stored at ~/.mecha/auth/<name>.json.
.claude/settings.json, CLAUDE.md, skills) from the mounted workspace.MECHA_COPY_HOST_CODEX_AUTH=1 if you explicitly want that behavior.# Fast local tests
npm test
# Docker-dependent suites
npm run test:docker
# Live SDK/API suite (costs money)
npm run test:live
The pixel office engine uses artwork and inspiration from:
FAQs
An army of agents — run autonomous Claude bots in Docker containers
We found that @mecha.im/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.