
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
aai-gateway
Advanced tools
AAI stands for Agent App Interface.
1. Context Token Waste: Every MCP server injects its schema, descriptions, and tool lists into the prompt. As you add more servers, the model spends more tokens understanding tools than executing tasks.
2. Config Cannot Be Shared Across Agents: MCP/Skill configured in Claude Code cannot be directly used in OpenCode or Codex. You have to configure it separately for each agent tool.
3. Requires Agent Restart After Installation: Traditionally, adding a new MCP or Skill requires restarting the agent tool to take effect.
AAI Gateway unifies MCP servers, Skills, ACP agents, and CLI tools under one roof, making it simple and efficient for agents to discover and use software.
You do not need to preinstall aai-gateway. Simply register it as a user-level MCP server and launch it via npx.
claude mcp add --scope user --transport stdio aai-gateway -- npx -y aai-gateway
codex mcp add aai-gateway -- npx -y aai-gateway
Add to ~/.config/opencode/opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"aai-gateway": {
"type": "local",
"command": ["npx", "-y", "aai-gateway"],
"enabled": true
}
}
}
If you don't know which MCP or skill to install, just ask your AI tool to search for what you need using AAI Gateway (e.g., "please search for a filesystem MCP" or "find me a git commit skill").
The search will:
Recommended Search Source Order:
modelcontextprotocol/registry, modelcontextprotocol/servers, openai/skillspunkpeye/awesome-mcp-servers, ComposioHQ/awesome-claude-skillsNote: The recommended list is a starting point, not a hard allowlist. Do not casually suggest tools from unknown websites. For marketplace platforms, also verify the maintainer's identity, repository activity, README quality, and license visibility.
Main workflow: Copy a mainstream MCP config snippet into your AI tool and ask it to import that server through AAI Gateway.
The AI tool will:
mcp:importAAI Gateway keeps import parameters consistent with standard MCP config shapes:
command, args, env, cwdurl, optional transport, optional headersstdio MCP Example:
{
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
}
Remote Streamable HTTP MCP Example:
{
"url": "https://example.com/mcp"
}
Remote SSE MCP Example:
{
"url": "https://example.com/sse",
"transport": "sse"
}
After import, AAI Gateway returns:
summaryapp:<id>AAI Gateway sends
tools/listChangedafter import. Clients that implement this notification can pick up new tools without restart.
Skills are imported through the AI tool as well. Tell the AI tool to import a skill using AAI Gateway, then provide:
If the skill is remote, download and extract the whole skill directory first. AAI Gateway only imports from a local directory and copies the full directory into managed storage.
Local Skill Example:
{
"path": "/absolute/path/to/skill"
}
AAI Gateway derives the imported skill summary from the skill's own SKILL.md description. It can also generate a lightweight proxy SKILL.md for the current agent so the agent can discover the skill automatically.
AAI Gateway can also control app-like agents through ACP.
Currently supported ACP agent types:
┌─────────────────────────────────────────────────────────────┐
│ AI Agent │
│ (Claude Code / Codex / OpenCode) │
└────────────────────────┬────────────────────────────────────┘
│ One MCP Connection
▼
┌─────────────────────────────────────────────────────────────┐
│ AAI Gateway │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ Progressive Disclosure Layer ││
│ │ - App-level exposure (not tool-level) ││
│ │ - Summary-only disclosure ││
│ │ - Lazy tool loading on demand ││
│ └─────────────────────────────────────────────────────────┘│
│ ┌─────────────────────────────────────────────────────────┐│
│ │ App Registry ││
│ │ - MCP Servers - Skills ││
│ │ - ACP Agents - CLI Tools ││
│ └─────────────────────────────────────────────────────────┘│
│ ┌─────────────────────────────────────────────────────────┐│
│ │ Discovery Layer ││
│ │ - Desktop Descriptors - Managed Imports ││
│ │ - Built-in Descriptors ││
│ └─────────────────────────────────────────────────────────┘│
└────────────────────────┬────────────────────────────────────┘
│ Native Protocol
▼
┌─────────────────────────────────────────────────────────────┐
│ External Apps │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ MCP │ │ Skill │ │ ACP │ │ CLI │ │
│ │ Servers │ │ │ │ Agents │ │ Tools │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
└─────────────────────────────────────────────────────────────┘
AAI Gateway unifies MCPs, Skills, ACP Agents, and CLI tools into Agent Apps.
To integrate an app with AAI Gateway, simply provide an app descriptor file (aai.json). The descriptor tells AAI Gateway:
{
"schemaVersion": "2.0",
"version": "1.0.0",
"app": {
"name": {
"default": "Filesystem Server"
}
},
"access": {
"protocol": "mcp",
"config": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
}
},
"exposure": {
"summary": "Use this app when the user wants to read from or write to the local filesystem."
}
}
{
"schemaVersion": "2.0",
"version": "1.0.0",
"app": {
"name": {
"default": "Git Commit Skill"
}
},
"access": {
"protocol": "skill",
"config": {
"path": "/absolute/path/to/git-commit-skill"
}
},
"exposure": {
"summary": "Use this app when the user wants to create git commits with auto-generated messages."
}
}
{
"schemaVersion": "2.0",
"version": "1.0.0",
"app": {
"name": {
"default": "Claude Code"
}
},
"access": {
"protocol": "acp-agent",
"config": {
"agentType": "claude-code"
}
},
"exposure": {
"summary": "Use this app when the user wants Claude Code to perform coding tasks."
}
}
{
"schemaVersion": "2.0",
"version": "1.0.0",
"app": {
"name": {
"default": "Example CLI"
}
},
"access": {
"protocol": "cli",
"config": {
"command": "example-app"
}
},
"exposure": {
"summary": "Use this app when the user wants to work with Example App."
}
}
If you want AAI Gateway to ship with a descriptor for an app by default, open a PR.
A PR should include:
Built-in ACP agent descriptors live in:
src/discovery/descriptors/They are registered in:
src/discovery/agent-registry.tsStandard PR workflow:
If you're unsure whether an integration should be bundled, open an issue first to discuss.
AAI Gateway discovers apps from the following locations:
Recommended locations:
<YourApp>.app/Contents/Resources/aai.json~/Library/Containers/<container>/Data/Library/Application Support/aai.json~/Library/Containers/<container>/Data/Library/Application Support/aai-gateway/aai.jsonScanned locations:
/usr/share/usr/local/share~/.local/shareScanned locations:
C:\Program FilesC:\Program Files (x86)%LOCALAPPDATA%app.name.default clearsummary explain when the app should be usedAAI Gateway is still under active development.
You should expect rough edges, missing pieces, and bugs.
Contributions are welcome.
FAQs
AAI stands for **Agent App Interface**.
We found that aai-gateway demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.