
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@sima-prime/agent-sdk
Advanced tools
TypeScript client for SIMA's production agent protection purchase API.
Package: @sima-prime/agent-sdk
OpenAPI: https://sima-prime.com/openapi.json
API base: https://api.sima-prime.com
Core principle:
For bots and AI agents, the API is the product.
npm install @sima-prime/agent-sdk
pnpm add @sima-prime/agent-sdk
yarn add @sima-prime/agent-sdk
Aligned to OpenAPI x-sima-agent-protection-purchase-flow-path:
POST /agent/wallet/nonce
POST /agent/wallet/verify
POST /agent/protection/offer
POST /agent/protection/purchase
GET /agent/protection/certificates/{id}/payment-intent
→ caller sends SOL on-chain (outside SDK)
POST /agent/protection/certificates/{id}/confirm-payment
GET /agent/protection/certificates/{id}
All commercial amounts are asset-denominated (contract asset / SOL). There are no USD commercial fields.
import { SimaAgentClient } from "@sima-prime/agent-sdk";
const client = new SimaAgentClient();
const nonce = await client.requestWalletNonce("YOUR_WALLET_ADDRESS");
// Sign nonce.message with your wallet outside this SDK.
const auth = await client.verifyWalletSignature({
chain: "SOLANA",
walletAddress: "YOUR_WALLET_ADDRESS",
message: nonce.message,
signature: "YOUR_SIGNATURE",
});
client.setAccessToken(auth.accessToken);
const offer = await client.getProtectionOffer({
chain: "SOLANA",
walletAddress: "YOUR_WALLET_ADDRESS",
assetAddress: "YOUR_ASSET_ADDRESS",
assetSymbol: "EXAMPLE",
assetType: "TOKEN",
protectedAmount: "1000",
});
const purchase = await client.purchaseProtection({
...offer,
chain: "SOLANA",
walletAddress: "YOUR_WALLET_ADDRESS",
assetAddress: "YOUR_ASSET_ADDRESS",
assetType: "TOKEN",
protectedAmount: offer.protectedAmount,
offerId: offer.offerId,
protectionDecision: "PURCHASE_PROTECTION",
});
if (purchase.protectionDecision !== "PURCHASE_PROTECTION") {
throw new Error("Protection declined");
}
const intent = await client.getPurchasePaymentIntent(purchase.certificateId);
// Send intent.amountDue SOL to intent.destinationTreasuryWalletAddress
// with your wallet / bot runtime. Keep the on-chain signature.
const active = await client.confirmPurchasePayment(purchase.certificateId, {
paymentReference: intent.paymentReference,
transactionSignature: "YOUR_ON_CHAIN_SIGNATURE",
});
console.log(active.certificateNumber, active.certificateStatus);
| Method | Endpoint |
|---|---|
requestWalletNonce | POST /agent/wallet/nonce |
verifyWalletSignature | POST /agent/wallet/verify |
getProtectionOffer | POST /agent/protection/offer |
purchaseProtection | POST /agent/protection/purchase |
getPurchasePaymentIntent | GET /agent/protection/certificates/{id}/payment-intent |
confirmPurchasePayment | POST /agent/protection/certificates/{id}/confirm-payment |
getProtectionCertificate | GET /agent/protection/certificates/{id} |
Premium = 5% of protected amount
Coverage = 50% of protected amount
Deductible = 10% of protected amount
Maximum Net Payment = 40% of protected amount
| Concept | Duration |
|---|---|
| Quote Validity | 30 seconds |
| Payment Window | 30 seconds after acceptance |
| Protection Window | 5 minutes after premium payment |
| Certificate Lifetime | 24 hours from issuance |
| Claim Window | 24 hours from issuance |
| Historical Record | Permanent |
The SDK does not:
A certificate is purchased coverage and the right to submit a claim for investigation. Claim decisions and treasury payout remain separate steps.
Read-only discovery MCP (does not call the API):
npx @sima-prime/mcp-server
sima_get_quote_flow documents getProtectionOffer with protectedAmount (asset-denominated).
examples/basic-flow.ts
examples/purchase-flow.ts
Placeholders only: YOUR_WALLET_ADDRESS, YOUR_SIGNATURE, YOUR_ON_CHAIN_SIGNATURE, etc.
https://sima-prime.com/developers/public
https://sima-prime.com/openapi.json
https://sima-prime.com/llms.txt
https://sima-prime.com/ai-catalog.json
npm install
npm run build
This repository is the public SDK, examples, and discovery metadata.
Private core systems (treasury ops, claims investigation internals, production deployment) remain in the private SIMA monorepo.
FAQs
TypeScript SDK foundation for SIMA agent and bot integrations.
We found that @sima-prime/agent-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.