
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@prismer/agent-core
Advanced tools
Lightweight TypeScript agent runtime. Zero heavy dependencies. OpenAI-compatible.
Lightweight TypeScript agent runtime. Zero heavy dependencies. OpenAI-compatible.
/chat/completions endpoint (OpenAI, Anthropic, Ollama, etc.)before_prompt, before_tool, after_tool, agent_endlumin agent, lumin serve, lumin healthnpm install @prismer/agent-core
import { runAgent } from '@prismer/agent-core';
process.env.OPENAI_API_KEY = 'sk-...';
await runAgent({
type: 'message',
content: 'What is 2 + 2?',
});
# Run agent with a message
lumin agent --message "Hello, world!"
# Start HTTP + WebSocket gateway
lumin serve --port 3001
# Health check
lumin health
const ws = new WebSocket('ws://localhost:3001/v1/stream');
ws.onopen = () => {
ws.send(JSON.stringify({ type: 'chat.send', content: 'Hello!' }));
};
ws.onmessage = (e) => {
const msg = JSON.parse(e.data);
if (msg.type === 'text.delta') process.stdout.write(msg.delta);
if (msg.type === 'chat.final') console.log('\n---\nDone:', msg.toolsUsed);
};
# Chat (synchronous)
curl -X POST http://localhost:3001/v1/chat \
-H 'Content-Type: application/json' \
-d '{"content": "List files in the workspace"}'
# List tools
curl http://localhost:3001/v1/tools
# Health
curl http://localhost:3001/health
All settings via environment variables. Sensible defaults for standalone use.
| Variable | Description | Default |
|---|---|---|
OPENAI_API_KEY | LLM provider API key | (required) |
OPENAI_API_BASE_URL | LLM provider base URL | https://api.openai.com/v1 |
AGENT_DEFAULT_MODEL | Default model ID | gpt-4o |
WORKSPACE_DIR | Working directory | ./workspace |
LUMIN_PORT | HTTP/WS server port | 3001 |
MAX_CONTEXT_CHARS | Compaction threshold (chars) | 600000 |
MODEL_FALLBACK_CHAIN | Fallback models (comma-separated) | β |
PRISMER_PLUGIN_PATH | Path to workspace plugin | β |
TELEGRAM_BOT_TOKEN | Telegram channel (optional) | β |
LOG_LEVEL | debug / info / warn / error | info |
import { createTool } from '@prismer/agent-core';
import { ToolRegistry } from '@prismer/agent-core/tools';
const tools = new ToolRegistry();
tools.register(createTool(
'weather',
'Get current weather for a city',
{
type: 'object',
properties: {
city: { type: 'string', description: 'City name' },
},
required: ['city'],
},
async (args) => {
const res = await fetch(`https://wttr.in/${args.city}?format=j1`);
return JSON.stringify(await res.json());
},
));
@prismer/agent-core
βββ Core
β βββ PrismerAgent β agent loop + tool execution + doom-loop detection
β βββ OpenAICompatibleProvider β LLM client (any /chat/completions endpoint)
β βββ FallbackProvider β automatic model fallback chain
β βββ ToolRegistry β tool registration + JSON Schema specs
β βββ EventBus β SSE / WebSocket event streaming
βββ Memory
β βββ MemoryStore (facade) β store / recall / search / recent
β βββ FileMemoryBackend β keyword-based, zero-dependency
βββ Infrastructure
β βββ HTTP + WebSocket server β zero external deps (pure node:http)
β βββ CLI β agent / serve / health commands
β βββ SessionStore β session management + compaction state
β βββ Config β Zod-validated, env var override
βββ Extensions
βββ HookRegistry β before_prompt, before_tool, after_tool, agent_end
βββ SkillLoader β SKILL.md + YAML frontmatter
βββ AgentRegistry β sub-agent delegation via @mention
βββ ChannelManager β Telegram, Cloud IM adapters
import { PrismerAgent } from '@prismer/agent-core/agent';
import { OpenAICompatibleProvider } from '@prismer/agent-core/provider';
import { ToolRegistry } from '@prismer/agent-core/tools';
import { SessionStore } from '@prismer/agent-core/session';
import { MemoryStore, FileMemoryBackend } from '@prismer/agent-core/memory';
import { HookRegistry } from '@prismer/agent-core/hooks';
import { EventBus } from '@prismer/agent-core/sse';
import { loadConfig } from '@prismer/agent-core/config';
import { createLogger } from '@prismer/agent-core/log';
import { VERSION } from '@prismer/agent-core';
Zero-dependency file-based memory with keyword recall. Tested on the LoCoMo long-term conversation memory benchmark:
| Model | Overall | No Adversarial | vs Letta/MemGPT |
|---|---|---|---|
| Claude Opus 4.6 | 86% | 95% | +12pp |
| Kimi K2.5 | 63% | 56% | -11pp |
| Letta/MemGPT | ~74% | β | baseline |
Zero-dependency keyword search + strong LLM outperforms Letta's embedding+rerank pipeline.
import { MemoryStore } from '@prismer/agent-core/memory';
const memory = new MemoryStore('./workspace');
await memory.store('The calibration coefficient is 0.03847', ['numeric']);
const results = await memory.search('calibration coefficient');
console.log(results); // [{ content: '...', score: 1.0, tags: ['numeric'] }]
Drop markdown files into your workspace to customize agent behavior:
| File | Priority | Purpose |
|---|---|---|
IDENTITY.md / SOUL.md | 10 | Agent identity and persona |
AGENTS.md | 9 | Sub-agent routing and priorities |
TOOLS.md | 8 | Tool reference documentation |
USER.md | 3.5 | User preferences and context |
Install agent skills from git repositories:
# Via agent tool call
clawhub install research-paper
clawhub install https://github.com/user/my-skill.git
clawhub list
clawhub search "data analysis"
Each skill is a directory with a SKILL.md file (YAML frontmatter + markdown body) that gets injected into the system prompt.
See docs/API.md for the complete HTTP, WebSocket, and IPC protocol documentation.
git clone https://github.com/prismer-ai/agent-core.git
cd agent-core
npm install
npm run build # TypeScript compilation
npm test # Run all tests (vitest)
npm run typecheck # Type checking only
MIT Β© 2026 Prismer.AI
FAQs
Lightweight TypeScript agent runtime. Zero heavy dependencies. OpenAI-compatible.
The npm package @prismer/agent-core receives a total of 2 weekly downloads. As such, @prismer/agent-core popularity was classified as not popular.
We found that @prismer/agent-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.