
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@wingman-ai/cli
Advanced tools
[Wingman-AI VSCode Extension](https://marketplace.visualstudio.com/items?itemName=WingMan.wing-man) is an open source vscode extension that empowers users with an agentic code assistant. The **CLI** now brings the same power right to your terminal!
Wingman-AI VSCode Extension is an open source vscode extension that empowers users with an agentic code assistant. The CLI now brings the same power right to your terminal!
Wingman CLI is an open source, terminal-based AI coding partner that supports the most popular frontier AI models; such as Anthropic, OpenAI, or Google.
Wingman CLI stores all files within a .wingman folder of the current working directory.
/file, /dir, and /clear to manage context./resume and /compact the conversation./tasks.To install the Wingman CLI, clone the repository and install the dependencies:
git clone https://github.com/wingman-ai/cli.git
cd cli
npm install
To start using the Wingman CLI, run the following command:
npx wingman
This will launch the CLI, allowing you to interact with your AI coding partner directly from the terminal. You can use commands like /file to add files to the context or /clear to reset the context.
By default, Wingman CLI runs silently with no logging output. You can enable logging using command-line arguments or environment variables.
Enable logging with these flags:
# Enable info-level logging
npx wingman --verbose
npx wingman -v
npx wingman --log
# Enable debug-level logging (most detailed)
npx wingman --debug
npx wingman -d
You can also control logging via the WINGMAN_LOG_LEVEL environment variable:
# Set log level via environment variable
export WINGMAN_LOG_LEVEL=debug
npx wingman
# Or inline
WINGMAN_LOG_LEVEL=info npx wingman
silent (default) - No logging outputerror - Only error messageswarn - Warnings and errorsinfo - General information, warnings, and errorsdebug - Detailed debugging informationtrace - Most verbose loggingWhen logging is enabled, log files are automatically created in .wingman/debug-YYYY-MM-DD.log with:
To configure the Wingman CLI, you should place your configuration file in a .wingman subdirectory within your project. The configuration file should be named wingman.config.json. Here is an example of what the configuration might look like:
{
"provider": "anthropic",
"model": "claude-sonnet-4-0"
}
The Wingman CLI uses a comprehensive configuration schema that supports various AI providers and capabilities. Here's the complete configuration structure:
{
"provider": "anthropic",
"model": "claude-sonnet-4-0",
"capabilities": {
"language": "typescript"
},
"apiKey": "explicit or use env var",
"baseUrl": "openrouter and LMStudio"
}
{
"provider": "anthropic",
"model": "claude-sonnet-4-0",
"capabilities": {
"language": "typescript"
},
"backgroundAgentConfig": {
"enabled": true,
"maxConcurrentTasks": 3
},
"toolAbilities": {
"blockedCommands": ["sudo", "rm", "mv"],
"allowScriptExecution": true
}
}
provider (required): AI provider - "anthropic", "openai", "google", "openrouter", "xai" or "lmstudio"model (required): Model name specific to the providercapabilities.language (optional): Primary language - "typescript", "javascript", "python", "csharp", or "rust"backgroundAgentConfig.enabled (optional): Enable background task processingbackgroundAgentConfig.maxConcurrentTasks (optional): Maximum concurrent background taskstoolAbilities.blockedCommands (optional): Array of commands to block from executiontoolAbilities.allowScriptExecution (optional): Allow or deny script execution (default: true)You can provide custom instructions by creating an instructions.md file in your .wingman directory:
# Create custom instructions
echo "You are a senior TypeScript developer focused on clean, maintainable code." > .wingman/instructions.md
Wingman CLI supports advanced capabilities for enhanced security and control:
Block specific commands from being executed:
{
"toolAbilities": {
"blockedCommands": ["sudo", "rm", "mv", "chmod"]
}
}
Control whether scripts can be executed:
{
"toolAbilities": {
"allowScriptExecution": false
}
}
LangChain supports multiple AI providers. To configure these, set the following environment variables:
export OPENAI_API_KEY="your-openai-api-key"
export ANTHROPIC_API_KEY="your-anthropic-api-key"
export GOOGLE_API_KEY="your-google-api-key"
export XAI_API_KEY="your-api-key"
Ensure these keys are kept secure and not exposed in your source code.
The configuration loader automatically detects and validates your configuration:
.wingman/wingman.config.json in the current directoryWe welcome contributions from the community! To contribute, please fork the repository and create a pull request with your changes. Ensure that your code adheres to our coding standards and includes tests where applicable.
This project is licensed under the ISC License.
For questions or feedback, please reach out to us at support@wingman-ai.com or visit our GitHub repository to open an issue.
FAQs
[Wingman-AI VSCode Extension](https://marketplace.visualstudio.com/items?itemName=WingMan.wing-man) is an open source vscode extension that empowers users with an agentic code assistant. The **CLI** now brings the same power right to your terminal!
We found that @wingman-ai/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.