
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
Chat SDK — universal TypeScript toolkit for building multi-platform chat bots and AI agents on Slack, Teams, Google Chat, Discord, WhatsApp, and more
npm package:
chat
Universal TypeScript SDK for building multi-platform chat bots and AI agents on Slack, Teams, Google Chat, Discord, WhatsApp, and more. Provides the Chat class, event handlers, JSX cards, emoji helpers, and type-safe message formatting.
Documentation: chat-sdk.dev/docs · Guides: vercel.com/kb/chat-sdk
npm install chat
Scaffold a minimal Next.js bot app with create-chat-sdk:
npx create-chat-sdk@latest my-bot
The CLI generates your Chat configuration, webhook route, .env.example file, dependencies, and optional Web adapter route from the adapter catalog. See the CLI docs for options and non-interactive usage.
import { Chat } from "chat";
import { createSlackAdapter } from "@chat-adapter/slack";
import { createRedisState } from "@chat-adapter/state-redis";
const bot = new Chat({
userName: "mybot",
adapters: {
slack: createSlackAdapter({
botToken: process.env.SLACK_BOT_TOKEN!,
signingSecret: process.env.SLACK_SIGNING_SECRET!,
}),
},
state: createRedisState({ url: process.env.REDIS_URL! }),
dedupeTtlMs: 600_000, // 10 minutes (default: 5 min)
});
bot.onNewMention(async (thread) => {
await thread.subscribe();
await thread.post("Hello! I'm listening to this thread.");
});
bot.onSubscribedMessage(async (thread, message) => {
await thread.post(`You said: ${message.text}`);
});
Tip: PostgreSQL and ioredis adapters are also available for production. See State Adapters for all options.
| Option | Type | Default | Description |
|---|---|---|---|
userName | string | required | Default bot username across all adapters |
adapters | Record<string, Adapter> | required | Map of adapter name to adapter instance |
state | StateAdapter | required | State adapter for subscriptions, locking, and dedup |
logger | Logger | LogLevel | "info" | Logger instance or log level ("silent" to disable) |
streamingUpdateIntervalMs | number | 500 | Update interval for fallback streaming (post + edit) in ms |
dedupeTtlMs | number | 300000 | TTL for message deduplication entries in ms. Increase if webhook cold starts cause platform retries (e.g., Slack's http_timeout retry) that arrive after the default window |
If you use an AI coding agent such as OpenAI Codex, Claude Code, or Cursor, install the Chat SDK skill so it knows the SDK APIs, adapter patterns, and project conventions before writing code.
npx skills add vercel/chat
The skill references bundled documentation in node_modules/chat/docs, plus adapter guides and starter templates in the published package.
You can also install the Vercel Plugin for a broader agent toolkit — it includes the Chat SDK skill alongside specialist agents, agent slash commands, and more:
npx plugins add vercel/vercel-plugin
The plugin is optional; the skill alone is enough to build with Chat SDK.
For agent-readable documentation, see chat-sdk.dev/llms.txt (page index) or chat-sdk.dev/llms-full.txt (full text).
Full documentation is available at chat-sdk.dev/docs.
Chat class referenceMIT
FAQs
Chat SDK — universal TypeScript toolkit for building multi-platform chat bots and AI agents on Slack, Teams, Google Chat, Discord, WhatsApp, and more
The npm package chat receives a total of 1,462,983 weekly downloads. As such, chat popularity was classified as popular.
We found that chat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.