
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
@useatlas/react
Advanced tools
Embeddable Atlas chat UI for React applications.
bun add @useatlas/react
import { AtlasChat } from "@useatlas/react";
import "@useatlas/react/styles.css";
function App() {
return <AtlasChat apiUrl="https://api.example.com" apiKey="your-key" />;
}
Override how SQL results, charts, explore output, and Python results render inside the widget using the toolRenderers prop. This example assumes you have already imported the styles as shown above.
import { AtlasChat, type ToolRendererProps, type SQLToolResult } from "@useatlas/react";
function MySQLRenderer({ result, isLoading }: ToolRendererProps<SQLToolResult | null>) {
if (isLoading || !result) return <div>Running query...</div>;
if (!result.success) return <div>Query failed: {result.error}</div>;
return (
<div>
<h3>Results ({result.rows.length} rows)</h3>
<table>
<thead>
<tr>{result.columns.map((col) => <th key={col}>{col}</th>)}</tr>
</thead>
<tbody>
{result.rows.map((row, i) => (
<tr key={i}>
{result.columns.map((col) => <td key={col}>{String(row[col] ?? "")}</td>)}
</tr>
))}
</tbody>
</table>
</div>
);
}
function App() {
return (
<AtlasChat
apiUrl="https://api.example.com"
apiKey="your-key"
toolRenderers={{
executeSQL: MySQLRenderer,
}}
/>
);
}
| Tool Name | Result Type | Description |
|---|---|---|
executeSQL | SQLToolResult | SQL query results with columns and rows |
explore | ExploreToolResult | Semantic layer exploration output (string) |
executePython | PythonToolResult | Python execution results with optional charts and tables |
Custom renderers for any tool name are supported — just add the tool name as a key in the toolRenderers map. Tools without a custom renderer use the built-in defaults.
Every renderer receives ToolRendererProps<T>:
| Prop | Type | Description |
|---|---|---|
toolName | string | Name of the tool being rendered |
args | Record<string, unknown> | Input arguments passed to the tool |
result | T | Tool output. Built-in tool types include | null for the loading state |
isLoading | boolean | Whether the tool invocation is in progress |
The widget handles errors at three levels — render errors (error boundary), API/network errors (error banner), and widget-level errors (postMessage). Each is automatic; you only need to listen if you want to react in your host application.
| Error | What the user sees | Auto-recovery |
|---|---|---|
| API unreachable | "Unable to connect to Atlas." with a retry button | No — user must retry |
| Auth failure | Auth-mode-specific message (e.g. "Your session has expired.") | No — requires re-auth |
| Offline | "You appear to be offline." | Yes — auto-retries when navigator.onLine restores |
| Rate limited | "Too many requests." with countdown timer | Yes — auto-retries after countdown |
| Server error (5xx) | "Something went wrong on our end." with retry button | No — user must retry |
| Render crash | "Something went wrong." with a try-again button (error boundary) | No — user must click retry |
When embedded as an iframe, the widget emits atlas:error messages to the parent window on every error:
window.addEventListener("message", (event) => {
if (event.origin !== "https://your-atlas-api.example.com") return;
if (event.data?.type === "atlas:error") {
const { code, message, detail, retryable } = event.data.error;
// code: "api_unreachable" | "auth_failure" | "rate_limited_http" | "offline" | "server_error" | ChatErrorCode
// retryable: true for transient errors, false for permanent ones
console.error(`[Atlas] ${code}: ${message}`);
}
});
When using the script tag loader, use Atlas.on("error", ...):
Atlas.on("error", (detail) => {
// detail: { code?: string, message?: string }
console.error("Widget error:", detail.code, detail.message);
});
When a managed auth session expires mid-conversation, the widget shows "Your session has expired. Please sign in again." For iframe embeds using external tokens (BYOT mode), refresh the token via postMessage:
// When your app refreshes a token, push it to the widget
function onTokenRefresh(newToken) {
const iframe = document.querySelector("iframe");
iframe.contentWindow.postMessage(
{ type: "auth", token: newToken },
"https://your-atlas-api.example.com",
);
}
For the script tag loader:
Atlas.setAuthToken(newToken);
If your site uses a Content Security Policy, add the Atlas API domain to these directives:
Content-Security-Policy:
script-src 'self' https://your-atlas-api.example.com;
frame-src 'self' https://your-atlas-api.example.com;
connect-src 'self' https://your-atlas-api.example.com;
See the Embedding Widget guide for full CSP details.
For fully custom UIs, use the hooks entry point. Tool renderer types are also available here:
import { AtlasProvider, useAtlasChat } from "@useatlas/react/hooks";
import type { ToolRendererProps, SQLToolResult } from "@useatlas/react/hooks";
See the hooks documentation for details.
FAQs
Embeddable Atlas chat UI for React applications
The npm package @useatlas/react receives a total of 517 weekly downloads. As such, @useatlas/react popularity was classified as not popular.
We found that @useatlas/react demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.