
Research
/Security News
Laravel Lang Compromised with RCE Backdoor Across 700+ Versions
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.
@syncagent/js
Advanced tools
Core JavaScript/TypeScript SDK for SyncAgent — add an AI database agent to any app.
Works with MongoDB, PostgreSQL, MySQL, SQLite, SQL Server, and Supabase.
sa_)Every new project gets a 14-day trial with 500 free requests — no credit card required. After the trial, you get 100 free requests/month on the Free plan.
npm install @syncagent/js
import { SyncAgentClient } from "@syncagent/js";
const agent = new SyncAgentClient({
apiKey: "sa_your_api_key",
connectionString: process.env.DATABASE_URL,
});
// Non-streaming
const result = await agent.chat([
{ role: "user", content: "How many users signed up this month?" }
]);
console.log(result.text);
// Streaming
await agent.chat(
[{ role: "user", content: "Show me the top 10 customers by revenue" }],
{
onToken: (token) => process.stdout.write(token),
onComplete: (text) => console.log("\nDone"),
onError: (err) => console.error(err),
}
);
| Database | Connection String Format |
|---|---|
| MongoDB | mongodb+srv://user:pass@cluster.mongodb.net/mydb |
| PostgreSQL | postgresql://user:pass@host:5432/mydb |
| MySQL | mysql://user:pass@host:3306/mydb |
| SQLite | /absolute/path/to/database.sqlite |
| SQL Server | Server=host,1433;Database=mydb;User Id=user;Password=pass;Encrypt=true; |
| Supabase | https://xxx.supabase.co|your-anon-key |
new SyncAgentClient(config: SyncAgentConfig)
| Option | Type | Required | Description |
|---|---|---|---|
apiKey | string | ✅ | Your SyncAgent API key (sa_...) |
connectionString | string | ✅* | Your database URL — sent at runtime, never stored. *Optional when toolsOnly: true. |
tools | Record<string, ToolDefinition> | — | Custom tools the agent can call client-side |
baseUrl | string | — | Override API URL (dev only) |
filter | Record<string, any> | — | Mandatory query filter for multi-tenancy |
operations | ("read"|"create"|"update"|"delete")[] | — | Restrict operations for this session |
toolsOnly | boolean | — | Disables all DB tools — agent only uses your custom tools |
autoDetectPage | boolean | true | Auto-detect current page from window.location |
systemInstruction | string | — | Custom agent instructions — personality, tone, rules |
confirmWrites | boolean | false | Ask for confirmation before create/update/delete |
language | string | — | Language the agent responds in (e.g. "French") |
maxResults | number | 50 | Default max records per query |
sensitiveFields | string[] | ["password","token","secret"] | Fields masked in responses |
onBeforeToolCall | (name, args) => boolean | — | Called before each client tool. Return false to block. |
onAfterToolCall | (name, args, result) => void | — | Called after each client tool executes |
client.chat(messages, options?)const result = await agent.chat(messages, options);
messages — Message[]
{ role: "user" | "assistant"; content: string }
options — ChatOptions
| Option | Type | Description |
|---|---|---|
onToken | (token: string) => void | Called for each streamed text chunk |
onComplete | (text: string) => void | Called with the full response text |
onError | (error: Error) => void | Called on error |
onStatus | (step: string, label: string) => void | Live status updates |
onData | (data: ToolData) => void | Called when a DB tool returns structured data |
onToolCall | (name: string, args: any, result: any) => void | Called when a custom tool executes |
signal | AbortSignal | Cancel the request |
context | Record<string, any> | Extra context injected into every message |
Returns Promise<ChatResult> → { text: string }
onStatus fires with these step values:
"connecting" — connecting to the database"schema" — discovering schema"thinking" — AI is reasoning"querying" — executing a DB tool"done" — completeclient.getSchema()const schema = await agent.getSchema();
// CollectionSchema[]
const history: Message[] = [];
history.push({ role: "user", content: "Show top 5 customers" });
const r1 = await agent.chat(history);
history.push({ role: "assistant", content: r1.text });
history.push({ role: "user", content: "Now show their total orders" });
const r2 = await agent.chat(history);
The SDK automatically detects the current page from window.location on every message — zero config needed.
URL: /dashboard/orders/ord_123?tab=details
Auto-detected context:
currentPage: "orders"
currentPath: "/dashboard/orders/ord_123"
currentRecordId: "ord_123"
param_tab: "details"
Pass additional context:
await agent.chat(messages, {
context: { userId: "user_123", userRole: "admin", orgName: "Acme Corp" }
});
onData — React to Query Resultsawait agent.chat(messages, {
onData: (data) => {
console.log(data.collection); // "orders"
console.log(data.data); // array of result rows
console.log(data.count); // number of results
}
});
Give the agent capabilities beyond your database. Tools run entirely in your app — SyncAgent only sees the schema and result.
const agent = new SyncAgentClient({
apiKey: "sa_your_key",
connectionString: process.env.DATABASE_URL,
tools: {
sendEmail: {
description: "Send an email to a user",
inputSchema: {
to: { type: "string", description: "Recipient email" },
subject: { type: "string", description: "Subject line" },
body: { type: "string", description: "Email body" },
},
execute: async ({ to, subject, body }) => {
await mailer.send({ to, subject, text: body });
return { sent: true };
},
},
},
});
Pass filter to scope every agent operation to the current user's organization. Enforced server-side.
const agent = new SyncAgentClient({
apiKey: "sa_your_key",
connectionString: process.env.DATABASE_URL,
filter: { organizationId: currentUser.orgId },
operations: currentUser.isAdmin
? ["read", "create", "update", "delete"]
: ["read"],
});
Build an AI assistant powered by your own APIs — no database access needed.
const agent = new SyncAgentClient({
apiKey: "sa_your_key",
toolsOnly: true,
tools: {
searchProducts: {
description: "Search products by name or category",
inputSchema: { query: { type: "string", description: "Search query" } },
execute: async ({ query }) => {
const res = await fetch(`/api/products?q=${query}`);
return res.json();
},
},
},
});
const controller = new AbortController();
agent.chat(messages, { signal: controller.signal });
controller.abort();
import express from "express";
import { SyncAgentClient } from "@syncagent/js";
const app = express();
app.use(express.json());
const agent = new SyncAgentClient({
apiKey: process.env.SYNCAGENT_KEY,
connectionString: process.env.DATABASE_URL,
});
app.post("/chat", async (req, res) => {
res.setHeader("Content-Type", "text/plain");
res.setHeader("Transfer-Encoding", "chunked");
await agent.chat(req.body.messages, {
onToken: (token) => res.write(token),
onComplete: () => res.end(),
onError: (err) => { res.status(500).end(err.message); },
});
});
app.listen(3000);
import type {
SyncAgentConfig, Message, ChatOptions, ChatResult,
CollectionSchema, SchemaField, ToolDefinition, ToolParameter, ToolData,
} from "@syncagent/js";
| Plan | Requests/mo | Collections | Price |
|---|---|---|---|
| Free (+ 14-day trial) | 100 (500 during trial) | 5 | GH₵0 |
| Starter | 5,000 | 20 | GH₵150/mo |
| Pro | 50,000 | Unlimited | GH₵500/mo |
| Enterprise | Unlimited | Unlimited | Custom |
MIT
FAQs
SyncAgent JavaScript SDK — AI database agent for any app
The npm package @syncagent/js receives a total of 527 weekly downloads. As such, @syncagent/js popularity was classified as not popular.
We found that @syncagent/js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.

Security News
Socket found a malicious postinstall hook across 700+ GitHub repos, including PHP packages on Packagist and Node.js project repositories.

Security News
Vibe coding at scale is reshaping how packages are created, contributed, and selected across the software supply chain