
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@openenthrium/oe-runtime
Advanced tools
OE Runtime - run AI agents against enterprise data sources. One YAML agent, one config file.
@openenthrium/oe-runtimeStandalone AI Agent Executor · Apache-2.0 · Windows · Linux · macOS
Run SKILL.md agents and YAML workflows against any enterprise data source — no cloud, no platform, just a single binary.
A standalone binary that reads a declarative agent file, connects to your enterprise data sources, and runs an AI workflow — locally or as an HTTP API server. No Python. No LangChain. No Docker required.
Supports two agent formats:
npx -y @openenthrium/oe-runtime ./skills/hello-world
-yis required — without it npx blocks waiting for keyboard input and the agent never runs.
OE Runtime automatically finds oe-config.json in the agent's folder or your current directory.
A SKILL.md skill is a Markdown file — frontmatter carries the metadata, ## Step headings define the workflow. Connector wiring stays in agent.yaml + oe-config.json, keeping the skill itself portable.
Folder structure:
my-skill/
├── SKILL.md ← the portable skill (agentskills.io format)
├── agent.yaml ← wires SKILL.md to your connectors
└── oe-config.json ← LLM key + connector credentials
agent.yaml:
name: SQL Database Analyst
description: Query a database and summarise results in plain English
connectors:
- connection_name: My Database
connection_type: postgresql
skills:
- path: ./
trigger_type: auto
SKILL.md:
---
name: sql-database-analyst
description: Query a database and summarise results in plain English.
license: Apache-2.0
metadata:
author: Your Name
version: "1.0"
---
You are a data analyst. Use the available database tools to answer the user's question clearly.
## Step 1: Explore Schema
List the available tables and understand the data structure.
## Step 2: Query
Run the most relevant query for the user's request.
## Step 3: Report
Summarise the findings in plain English with key numbers highlighted.
oe-config.json:
{
"llm": { "provider": "openai", "apiKey": "sk-...", "model": "gpt-4o" },
"connectors": [
{
"connection_name": "My Database",
"connection_type": "postgresql",
"host": "localhost",
"port": 5432,
"database": "mydb",
"user": "postgres",
"password": "YOUR_DB_PASSWORD"
}
]
}
Run it:
npx -y @openenthrium/oe-runtime ./my-skill
Pass the folder — OE Runtime resolves agent.yaml inside it automatically.
Chain multiple SKILL.md skills in one agent.yaml. Skills run in order, passing output as context to the next. Use trigger_type: manual to pause and require approval before a skill executes.
name: My Agent
skills:
- path: ./hello-world
trigger_type: auto # runs immediately
- path: ./email
trigger_type: manual # pauses — requires approval
connectors: ["My Email"] # only this connector visible to the skill
- path: ./team-messaging
trigger_type: manual
connectors: ["My Slack"]
CLI: manual skills prompt [Y/n] — press Enter to approve, n to skip, Ctrl+C to abort.
HTTP Server: see /approve-chain below.
Download oe-runtime-skills.zip — 27 ready-to-run skills covering:
sql-databases · nosql-cache · email · team-messaging · cloud-drives · file-storage · web-search · rest-api · graphql · ssh · image-generation · speech-audio · video-generation · music-generation · ocr-vision · iot-messaging · message-queues · blockchain-web3 · productivity-crm · directory-identity · local-exec · hello-world · and more
Each skill has a SKILL.md + agent.yaml + oe-config.json ready to go.
Enable server mode in oe-config.json:
{
"llm": { "provider": "openai", "apiKey": "sk-...", "model": "gpt-4o" },
"server": { "enabled": true, "port": 3333, "apiKey": "your-secret" },
"connectors": [ ... ]
}
Start:
npx -y @openenthrium/oe-runtime --serve --config oe-config.json
Endpoints:
| Method | Path | Description |
|---|---|---|
GET | /health | Liveness check |
POST | /run | Run an agent from inline YAML |
POST | /run-file | Run an agent from a file path on disk |
POST | /approve-chain | Approve, skip, or abort a paused manual skill |
When a pipeline has manual skills, the server pauses at each one and returns a pending_skill_chain token. The client resumes by calling /approve-chain.
# 1. Start the agent
curl -X POST http://localhost:3333/run-file \
-H "x-api-key: your-secret" -H "Content-Type: application/json" \
-d '{"file": "/path/to/agent.yaml"}'
# → { "pending_skill_chain": { "chain_id": "abc123", "skill_name": "email" } }
# 2. Approve
curl -X POST http://localhost:3333/approve-chain \
-H "x-api-key: your-secret" -H "Content-Type: application/json" \
-d '{"chain_id": "abc123", "approved": true, "abort": false}'
# 3. Skip (continue to next skill without running this one)
curl ... -d '{"chain_id": "abc123", "approved": false, "abort": false}'
# 4. Abort (stop the entire pipeline)
curl ... -d '{"chain_id": "abc123", "approved": false, "abort": true}'
chain_id is one-time use. When another manual skill follows, the response carries a new pending_skill_chain. null means the pipeline is complete.
npm install @openenthrium/oe-runtime-sdk
const { runAgent } = require("@openenthrium/oe-runtime-sdk");
const result = await runAgent("./my-skill/agent.yaml", "./oe-config.json");
console.log(result.output);
openai · anthropic · azure · groq · gemini · ollama · mistral · deepseek · together · fireworks · bedrock · and more
| 🖥️ Platform | open-enthrium-ai-platform — full web app with workspaces, RAG, Agent Builder |
| 🔌 MCP Server | open-enthrium-ai-mcp-server — connect Claude Code, Cursor, Windsurf to enterprise data |
| 📦 Node.js SDK | @openenthrium/oe-runtime-sdk |
| 🌐 Website | openenthrium.com |
Contributions are welcome. Before opening a PR:
mainWhere contributions are most valuable:
Apache-2.0 — free to use, modify, and deploy for any purpose, including commercial use. No usage limits. No telemetry. No call-home.
FAQs
OE Runtime - run AI agents against enterprise data sources. One YAML agent, one config file.
We found that @openenthrium/oe-runtime demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.