
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@nylas/openclaw-nylas-plugin
Advanced tools
Nylas API v3 client for Node.js — email, calendar, and contacts with auto-discovery. Send emails, manage events, search contacts. TypeScript SDK wrapper with multi-account support.
Nylas API v3 client for Node.js — send emails, manage calendar events, and search contacts with automatic account discovery. Just provide an API key and start building.
work, personal)Built on the official Nylas Node SDK.
npm install @nylas/openclaw-nylas-plugin
import { createNylasClient } from "@nylas/openclaw-nylas-plugin";
// Auto-discovers grant ID, client ID, and org from just the API key
const { client, discovered } = await createNylasClient({
apiKey: "nyl_v0_your_key_here",
});
console.log(`Connected as: ${discovered?.email}`);
// Send an email
await client.sendMessage({
to: [{ email: "recipient@example.com" }],
subject: "Hello from Nylas",
body: "<p>Sent via @nylas/openclaw-nylas-plugin</p>",
});
// List recent emails
const emails = await client.listMessages({ limit: 5 });
// List calendars and events
const calendars = await client.listCalendars();
const events = await client.listEvents({ calendarId: "primary" });
// Search contacts
const contacts = await client.listContacts({ limit: 10 });
| Variable | Required | Description |
|---|---|---|
NYLAS_API_KEY | Yes | API key from dashboard-v3.nylas.com |
NYLAS_GRANT_ID | No | Explicit grant ID (skips auto-discovery) |
NYLAS_API_URI | No | API region (default: https://api.us.nylas.com) |
NYLAS_TIMEZONE | No | Default timezone (default: UTC) |
export NYLAS_API_KEY="nyl_v0_your_key_here"
// When env vars are set, no options needed
const { client } = await createNylasClient();
openclaw plugins install @nylas/openclaw-nylas-plugin
# Restart the gateway to load the plugin
openclaw gateway restart
# Set your API key (only thing required — grant ID is auto-discovered)
openclaw config set 'plugins.entries.nylas.config.apiKey' 'nyl_v0_your_key_here'
# Restart the gateway to apply config changes
openclaw gateway restart
Optional settings:
# Explicit grant ID (skips auto-discovery)
openclaw config set 'plugins.entries.nylas.config.defaultGrantId' 'your-grant-id'
# API region: US or EU
openclaw config set 'plugins.entries.nylas.config.apiUri' 'https://api.us.nylas.com' # US (default)
openclaw config set 'plugins.entries.nylas.config.apiUri' 'https://api.eu.nylas.com' # EU
# Timezone for date/time operations
openclaw config set 'plugins.entries.nylas.config.defaultTimezone' 'America/New_York'
# Restart the gateway after any config change
openclaw gateway restart
openclaw plugins install --link ~/Code/openclaw-nylas-plugin
openclaw config set 'plugins.entries.nylas.config.apiKey' 'nyl_v0_your_key_here'
This plugin also supports Moltbot and Clawdbot. Replace openclaw with clawdbot (or moltbot) in the commands above.
| Method / Tool | Description |
|---|---|
listMessages / nylas_list_emails | List and search emails with filters (folder, from, subject, date, unread, starred) |
getMessage / nylas_get_email | Get full email content by message ID |
sendMessage / nylas_send_email | Send email with to, cc, bcc, subject, and HTML body |
createDraft / nylas_create_draft | Create an email draft |
listThreads / nylas_list_threads | List email threads (conversations) |
listFolders / nylas_list_folders | List email folders (INBOX, SENT, DRAFTS, etc.) |
| Method / Tool | Description |
|---|---|
listCalendars / nylas_list_calendars | List all available calendars |
listEvents / nylas_list_events | List and filter events by date range |
getEvent / nylas_get_event | Get event details by ID |
createEvent / nylas_create_event | Create event with attendees, location, and recurrence |
updateEvent / nylas_update_event | Update an existing event |
deleteEvent / nylas_delete_event | Delete an event |
checkAvailability / nylas_check_availability | Check free/busy availability for participants |
| Method / Tool | Description |
|---|---|
listContacts / nylas_list_contacts | List and search contacts |
getContact / nylas_get_contact | Get contact details by ID |
| Method / Tool | Description |
|---|---|
autoDiscoverGrant / nylas_discover_grants | Discover all authenticated email accounts (grants) for the API key |
Switch between email accounts using named grants:
// Use the default (auto-discovered) grant
await client.listMessages({ limit: 5 });
// Use a named grant
await client.listMessages({ grant: "work", limit: 5 });
// Use a raw grant ID
await client.listMessages({ grant: "abc123-grant-id", limit: 5 });
Configure named grants (plugin mode):
openclaw config set 'plugins.entries.nylas.config.grants' '{"work":"grant-id-1","personal":"grant-id-2"}'
Works with any email provider connected through Nylas:
# Check API connection and auto-discover grants
openclaw nylas status
# Discover all authenticated accounts
openclaw nylas discover
openclaw nylas discover --json
# Test API with a specific grant
openclaw nylas test
openclaw nylas test --grant work
# List configured and available grants
openclaw nylas grants
openclaw nylas grants --configured
# Unit tests (mocked, no API key needed)
npm test
# Live integration tests (requires NYLAS_API_KEY)
NYLAS_API_KEY=nyl_v0_... LIVE=1 npm run test:live
"apiKey is required"
export NYLAS_API_KEY=nyl_v0_..."No grants found"
401 Unauthorized
404 Not Found
MIT
FAQs
Nylas API v3 client for Node.js — email, calendar, and contacts with auto-discovery. Send emails, manage events, search contacts. TypeScript SDK wrapper with multi-account support.
The npm package @nylas/openclaw-nylas-plugin receives a total of 17 weekly downloads. As such, @nylas/openclaw-nylas-plugin popularity was classified as not popular.
We found that @nylas/openclaw-nylas-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.