
Security News
Security Community Slams MIT-linked Report Claiming AI Powers 80% of Ransomware
Experts push back on new claims about AI-driven ransomware, warning that hype and sponsored research are distorting how the threat is understood.
@posthog/code-agent
Advanced tools
Unified TypeScript SDK for coding agents (Claude Code + Codex) with MCP Bridge
A unified TypeScript SDK for orchestrating coding agent tasks using Claude Code (Anthropic) or OpenAI models with MCP (Model Context Protocol) bridge support.
npm install @code-agent/sdk
import { createAgent, ClaudeCodeAgent, CodexAgent } from '@code-agent/sdk';
// Using Claude Code
const claudeAgent = createAgent(new ClaudeCodeAgent({ 
  model: 'claude-3-5-sonnet-20241022' 
}));
// Using OpenAI Codex
const openAIAgent = createAgent(new CodexAgent({ 
  profile: 'balanced' 
}));
// Run a task
const { taskId, stream } = await claudeAgent.run({
  prompt: 'Add a health check endpoint to the Express server',
  repoPath: process.cwd(),
  onEvent: (event) => {
    console.log(event.type, event);
  }
});
// Stream events
for await (const event of stream) {
  if (event.type === 'token') {
    process.stdout.write(event.content);
  }
}
// Wait for completion
const result = await claudeAgent.waitForCompletion(taskId);
await agent.run({
  prompt: 'Create a pull request for the new feature',
  mcp: {
    servers: [
      { 
        id: 'github', 
        transport: 'sse', 
        url: 'https://mcp.github.example/sse' 
      }
    ],
    allowTools: ['github.create_pr', 'github.list_branches']
  }
});
The SDK provides unified permission modes that work consistently across providers:
strict: Restrictive mode, limits tool usage (maps to read-only for Codex, default for Claude)auto: Balanced mode, auto-approves safe operations (maps to auto for both)permissive: Allows all operations (maps to full-access for Codex, bypassPermissions for Claude)// Works with both Claude and OpenAI
await agent.run({
  prompt: 'Create a new feature',
  permissionMode: 'auto', // Unified mode
  tools: {
    allow: ['Read', 'Write', 'Edit'],     // Only allow these tools
    deny: ['Bash', 'WebSearch'],          // Block these tools
    autoApprove: ['Read', 'Glob']         // Auto-approve these without prompts
  }
});
For fine-grained control, use vendor-specific configurations:
// Claude Code specific
const claudeAgent = createAgent(new ClaudeCodeAgent({
  vendor: {
    anthropic: {
      permissionMode: 'bypassPermissions',  // Claude-specific mode
      canUseTool: async (toolName, input, options) => {
        // Custom approval logic
        if (toolName === 'Write' && input.file_path?.includes('.env')) {
          return { behavior: 'deny', message: 'Cannot write to .env files' };
        }
        return { behavior: 'allow', updatedInput: input };
      },
      hooks: {
        PreToolUse: [{
          hooks: [async (input) => {
            console.log(`Tool called: ${input.tool_name}`);
            return { continue: true };
          }]
        }]
      }
    }
  }
}));
// OpenAI Codex specific
const codexAgent = createAgent(new CodexAgent({
  vendor: {
    openai: {
      approvalMode: 'full-access',  // Codex-specific mode
      profile: 'high',
      verbose: true
    }
  }
}));
Combine unified settings with vendor overrides:
await agent.run({
  prompt: 'Add tests for the new feature',
  
  // Unified settings
  permissionMode: 'auto',
  tools: { allow: ['Read', 'Write', 'Edit'] },
  
  // Vendor overrides (these take precedence)
  vendor: {
    anthropic: {
      permissionMode: 'acceptEdits',  // Override unified mode
      model: 'claude-3-opus-20240229'
    }
  }
});
The SDK discovers credentials from environment:
ANTHROPIC_API_KEY for Claude CodeOPENAI_API_KEY for OpenAI/CodexOverride per-run:
await agent.run({
  prompt: 'Refactor the utils module',
  auth: { 
    anthropicApiKey: 'sk-ant-...' 
  }
});
The Claude Code SDK includes built-in tool execution for file operations, bash commands, and more. The SDK executes these tools directly rather than just suggesting changes:
// The agent will actually create/edit files and run commands
await agent.run({
  prompt: 'Create a new Express server with error handling',
  permissionMode: 'auto',  // Will prompt for dangerous operations
  tools: {
    allow: ['Read', 'Write', 'Edit', 'Bash'],
    autoApprove: ['Read']  // Never prompt for read operations
  }
});
Read, Write, Edit, MultiEditGrep, Glob, LSBash (with timeout and background support)WebSearch, WebFetchNotebookRead, NotebookEditTodoWritestatus: Task lifecycle phasestoken: Streaming text outputtool_call/tool_result: Tool execution eventsdiff: Code changes in unified diff formatfile_write: File modificationsmetric: Performance metricserror: Error eventsFAQs
Unified TypeScript SDK for coding agents (Claude Code + Codex) with MCP Bridge
The npm package @posthog/code-agent receives a total of 2 weekly downloads. As such, @posthog/code-agent popularity was classified as not popular.
We found that @posthog/code-agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Experts push back on new claims about AI-driven ransomware, warning that hype and sponsored research are distorting how the threat is understood.

Security News
Ruby's creator Matz assumes control of RubyGems and Bundler repositories while former maintainers agree to step back and transfer all rights to end the dispute.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.