
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
ai-native-cli
Advanced tools
TypeScript plugin-first website CLI powered by your real browser session.
Make any website your CLI.
This is the TypeScript version of the project. The repo is opencli, and the user-facing command is:
opencli
opencli connects to your existing Chrome browser through the Playwright MCP Bridge extension, reuses your real login session, and turns site capabilities into stable terminal commands.
Current top-level commands:
opencli list
opencli validate
opencli verify
opencli explore
opencli synthesize
opencli generate
Current built-in sites:
bilibiligithubhackernewstwitterv2exzhihuopencli list may also show user-generated CLIs from ~/.opencli/clis/.
Before using opencli, make sure:
PLAYWRIGHT_MCP_EXTENSION_TOKEN is available in the environment used by opencliInstall the extension:
Export the token:
export PLAYWRIGHT_MCP_EXTENSION_TOKEN=*****
If you are using Claude Code / Codex / another MCP-aware tool, configure Playwright MCP like this:
{
"mcpServers": {
"playwright": {
"command": "npx",
"args": ["@playwright/mcp@latest", "--extension"],
"env": {
"PLAYWRIGHT_MCP_EXTENSION_TOKEN": "*****"
}
}
}
}
For local development:
npm install
npm run build
Run directly from source:
npm run dev -- list
If you want a local opencli binary during development:
npm link
Use existing commands:
opencli list
opencli zhihu hot --limit 5
opencli bilibili me --format json
opencli github trending
Explore a new site:
opencli explore https://www.bilibili.com/v/popular/all --site bilibili
opencli synthesize bilibili
opencli validate
opencli verify bilibili/hot --smoke
One-shot generation:
opencli generate https://www.bilibili.com/v/popular/all --site bilibili --goal hot
There are two plugin paths:
src/clis/<site>/~/.opencli/clis/<site>/Built-ins can be written as:
TypeScript adapters self-register on import. The built-in TS adapters are imported from:
src/clis/index.tsPrefer this flow:
opencli explore <url>.opencli/explore/<site>/opencli validateopencli verify <target> --smokeUse YAML when the flow is simple:
Use TypeScript when you need:
Current built-ins in this repo:
bilibili: hot, me, searchgithub: search, trendinghackernews: toptwitter: trendingv2ex: hot, latestzhihu: hotGenerated candidates and user CLIs can expand this list.
Always prefer:
opencli list
as the source of truth for the current command surface.
Playwright MCP Bridge is effectively a single shared browser extension session.
That means:
opencli commands must run seriallyverify --smoke must run seriallyIf a run leaves the bridge connect.html tab open, finish the current run before retrying.
Browser connect timed outUsually means:
Check:
echo $PLAYWRIGHT_MCP_EXTENSION_TOKEN
opencli list
Then retry one command, serially.
Transport closedThis usually means the Bridge session is dirty or an MCP helper exited unexpectedly.
Try this order:
opencli runsUse:
opencli validate
opencli verify <target>
opencli verify <target> --smoke
src/
├── main.ts # Commander entrypoint
├── browser.ts # Playwright MCP Bridge integration
├── runtime.ts # Browser session guards + timeouts
├── engine.ts # YAML/TS discovery + execution
├── pipeline.ts # YAML pipeline runtime
├── validate.ts # Static validation
├── verify.ts # Validation + optional smoke
├── explore.ts # Discovery artifacts
├── synthesize.ts # Candidate generation
├── generate.ts # One-shot flow
└── clis/
├── index.ts # TS adapter imports
└── <site>/
If an AI agent is authoring CLIs for this repo, start with:
That file describes:
FAQs
TypeScript plugin-first website CLI powered by your real browser session.
We found that ai-native-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.