
Research
/Security News
Coruna Respawned: Compromised art-template npm Package Leads to iOS Browser Exploit Kit
Compromised npm package art-template delivered a Coruna-like iOS Safari exploit framework through a watering-hole attack.
@picahq/ai
Advanced tools
⚠️ DEPRECATED: This repository has been replaced by Pica ToolKit
Please use the new package instead:
npm i @picahq/toolkitNew Repository: https://github.com/picahq/toolkit
New Package: https://www.npmjs.com/package/@picahq/toolkitDocumentation: https://docs.picaos.com/toolkit
The Pica AI SDK is a TypeScript library for integrating Pica with Vercel's AI SDK.
For detailed instructions and examples, view the documentation.
npm install @picahq/ai
PICA_SECRET_KEY=<your-api-key>The Pica SDK can be configured with the following options:
| Option | Type | Required | Default | Description |
|---|---|---|---|---|
| serverUrl | String | No | https://api.picaos.com | URL for self-hosted Pica server |
| connectors | String[] | No | - | List of connector keys to filter by. Pass ["*"] to initialize all available connectors, or specific connector keys to filter. If empty, no connections will be initialized |
| actions | String[] | No | All actions | List of action ids to filter by |
| permissions | "read" | "write" | "admin" | No | "admin" | Permissions for the Pica client. "read" will only allow GET requests, "write" will allow POST/PUT/PATCH requests, and "admin" will allow all methods. |
| identity | String | No | None | Filter connections by specific identifier |
| identityType | "user" | "team" | "organization" | "project" | No | None | Filter connections by identity type |
| authkit | Boolean | No | false | If true, the SDK will use Authkit to connect to prompt the user to connect to a platform that they do not currently have access to |
| knowledgeAgent | Boolean | No | false | If true, the SDK will never execute actions, but will use Pica's knowledge to generate code. If true, use pica.intelligenceTool instead of pica.oneTool |
| knowledgeAgentConfig | Object | No | { includeEnvironmentVariables: true } | Configuration for the Knowledge Agent. If includeEnvironmentVariables is true, the SDK will return a reminder to include environment variables in the output |
| headers | Record<string, string> | No | - | Additional headers to send with all requests (e.g., cookies, custom authentication headers) |
The Pica AI SDK is designed to work seamlessly with Vercel AI SDK. Here's an example implementation with Next.js:
import { openai } from "@ai-sdk/openai";
import { convertToCoreMessages, streamText } from "ai";
import { Pica } from "@picahq/ai";
export async function POST(request: Request) {
const { messages } = await request.json();
const pica = new Pica(process.env.PICA_SECRET_KEY!, {
connectors: ["*"],
});
const systemPrompt = await pica.generateSystemPrompt();
const stream = streamText({
model: openai("gpt-4.1"),
system: systemPrompt,
tools: { ...pica.oneTool },
messages: convertToCoreMessages(messages),
maxSteps: 10,
});
return stream.toDataStreamResponse();
}
⭐️ You can see a full Next.js demo of the Pica AI SDK in action here
Examples for streaming and creating an express server can be found in the examples directory.
Once you've installed the SDK and connected your platforms in the Pica dashboard, you can seamlessly build your own AI agents to automate your workflows.
Here are some powerful examples of what you can build:
Got any cool examples? Open a PR and share them!
This project is licensed under the GPL-3.0 license. See the LICENSE file for details.
FAQs
Pica AI SDK for Vercel AI SDK integration
The npm package @picahq/ai receives a total of 113 weekly downloads. As such, @picahq/ai popularity was classified as not popular.
We found that @picahq/ai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised npm package art-template delivered a Coruna-like iOS Safari exploit framework through a watering-hole attack.

Company News
As AI accelerates how code is written and shipped, Socket is scaling to protect the software supply chain from the growing wave of attacks targeting open source dependencies.

Company News
Socket is scaling to defend open source against supply chain attacks as AI accelerates software development.