
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@scavio/ai-sdk
Advanced tools
Scavio search and URL-extraction tools for the Vercel AI SDK (extract any URL, plus Google, YouTube, Reddit, Amazon, Walmart, TikTok, Instagram).
Scavio search and page-extraction tools for the Vercel AI SDK. Give any AI
SDK agent real-time search across Google, YouTube, Reddit, Amazon, Walmart, TikTok, and Instagram --
plus scavio_extract, which reads any URL -- via the Scavio API.
This package exposes a curated subset of the Scavio API, chosen for agent
use: 13 tools -- 12 over 7 platforms, plus the core extract endpoint, which
belongs to no platform. The full surface is 195 endpoints across 31 platforms,
adding X, LinkedIn, TikTok Shop, eBay, Target, Home Depot, Zillow, Redfin,
Booking, Airbnb, Tripadvisor, Yelp, Indeed, Glassdoor, the App Store, Google
Play, SEC, Companies House, G2, Capterra, Google Ads, Meta Ad Library, Threads,
Kuaishou and the Google verticals (Maps, Shopping, News, Flights, Hotels,
Trends, AI Mode). To reach all of them, point your agent at the
Scavio MCP server at mcp.scavio.dev --
191 tools over every endpoint, nothing to vendor.
Credits are not uniform: most calls cost 1, YouTube search costs 2 and
transcript costs 8, Instagram costs 2 to 10 depending on the endpoint, and
scavio_extract is priced by the mode you ask for (1 / 1 / 2), not per call.
Amazon changed (breaking). The upstream provider moved in 2026-07:
domainis replaced bycountry, a two-letter marketplace code (us,gb-- the UK isgb, notuk--de,jp, ...), andsort_by,pages,category_id,merchant_id,language,currency,device,zip_codeandautoselect_variantare gone. The marketplace ignores all of them (sort_byreturns the identical unordered set for every value), so they are removed rather than kept as silent no-ops. Rank and filter results yourself.
npm install @scavio/ai-sdk ai zod
export SCAVIO_API_KEY=sk_live_your_key
ai and zod are peer dependencies; scavio (the JS SDK) is bundled.
import { generateText, stepCountIs } from "ai";
import { openai } from "@ai-sdk/openai";
import { scavioSearch, scavioTools } from "@scavio/ai-sdk";
// A single tool:
const res = await generateText({
model: openai("gpt-5.5"),
tools: { scavio_search: scavioSearch({ maxResults: 5 }) },
stopWhen: stepCountIs(3),
prompt: "Find the official GitHub repo of the Agno framework",
});
// Or all tools at once:
const res2 = await generateText({
model: openai("gpt-5.5"),
tools: scavioTools(),
stopWhen: stepCountIs(3),
prompt: "Compare prices for a mechanical keyboard on Amazon and Walmart",
});
| Factory | Tool name | Provider |
|---|---|---|
scavioExtract | scavio_extract | Read any URL as Markdown / text / HTML, /api/v1/extract (1 credit on normal and advanced, 2 on ultra) |
scavioSearch | scavio_search | Google web search, /api/v2/google (1 credit) |
scavioYoutubeSearch | scavio_youtube_search | YouTube video search (2 credits) |
scavioYoutubeVideo | scavio_youtube_video | YouTube video details (1 credit) |
scavioYoutubeTranscript | scavio_youtube_transcript | YouTube transcript / subtitles (8 credits) |
scavioYoutubeComments | scavio_youtube_comments | YouTube video comments (1 credit) |
scavioYoutubeChannel | scavio_youtube_channel | YouTube channel details (1 credit) |
scavioRedditSearch | scavio_reddit_search | Reddit posts (1 credit) |
scavioAmazonSearch | scavio_amazon_search | Amazon products (1 credit) |
scavioAmazonOffers | scavio_amazon_offers | Amazon seller offers for one ASIN (1 credit) |
scavioWalmartSearch | scavio_walmart_search | Walmart products (1 credit) |
scavioTiktokSearch | scavio_tiktok_search | TikTok videos (1 credit) |
scavioInstagramSearch | scavio_instagram_search | Instagram users (10 credits) |
scavioTools | all of the above | bundle for tools: |
Each factory accepts { apiKey?, maxResults?, ...ScavioConfig }. The key falls back to SCAVIO_API_KEY.
Get a key at dashboard.scavio.dev - new accounts get 50 free credits, no
credit card.
maxResults trims the result list in place. Google returns a flat body, so it trims
organic_results; every other endpoint nests its payload under data, so those trim inside data
(data.results, data.products, data.aweme_list, data.users, ...) and the
{ data, response_time, credits_used, credits_remaining } envelope is preserved. scavioExtract
ignores maxResults: it returns page content, not a list, so the page comes back whole.
const page = await generateText({
model: openai("gpt-5.5"),
tools: { scavio_extract: scavioExtract() },
stopWhen: stepCountIs(3),
prompt: "Summarise the pricing page at https://scavio.dev/pricing",
});
scavio_extract takes url plus an optional format (markdown default, text, html) and
mode. mode is the price-bearing param: normal is a plain fetch (1 credit), advanced renders
the page in a browser for JS-built sites (1 credit), and ultra routes through residential proxies
for the hardest bot walls (2 credits). Only a successful read is billed - a dead link, a bot wall or
a timeout costs nothing. See the extract docs.
These tools cover the most common surfaces. The full Scavio API - 195 endpoints across 31 platforms
(Google, YouTube, Amazon, Walmart, Reddit, TikTok, TikTok Shop, Instagram, X, LinkedIn, eBay, Target,
Home Depot, Zillow, Redfin, Booking, Airbnb, Tripadvisor, Yelp, Indeed, Glassdoor, the App Store,
Google Play, SEC, Companies House, G2, Capterra, Google Ads, Meta Ad Library, Threads and Kuaishou),
plus extract - is available directly through the
scavio SDK or the MCP server.
MIT
FAQs
Scavio search and URL-extraction tools for the Vercel AI SDK (extract any URL, plus Google, YouTube, Reddit, Amazon, Walmart, TikTok, Instagram).
The npm package @scavio/ai-sdk receives a total of 11 weekly downloads. As such, @scavio/ai-sdk popularity was classified as not popular.
We found that @scavio/ai-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.