
Security News
Deno 2.6 + Socket: Supply Chain Defense In Your CLI
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.
coding-agent-sdk
Advanced tools
Build agentic workflows that delegate to your users' existing coding agents (Claude Code, Codex, Gemini). Stop building agents. Start building workflows.
Stop building agents. Start building workflows.
Ship agentic workflows that run on your users' existing coding agents—Claude Code, Codex, or Gemini. No agent embedding required.
import { query } from 'coding-agent-sdk';
// One API. Works with whatever agent your user has.
await query("Refactor the auth module");
You want to build an agentic workflow. Maybe it's a code reviewer, a migration tool, or a testing assistant.
So you build it. You embed an agent. You ship it.
But here's the thing: Your users already paid for Claude Code. Or Codex. Or Gemini.
Why would they pay for yours?
Distribution is the real problem. Not the technology.
Don't compete with their agents. Use them.
Break down your workflow into steps. Delegate execution to whatever agent your user already has installed.
// Your workflow
async function migrateToTypeScript() {
await query("Find all .js files in src/");
await query("Convert them to TypeScript");
await query("Fix any type errors");
await query("Run the test suite");
}
The SDK handles the rest:
Result: You ship open-source workflows. Users bring their own agent. Everyone wins.
For workflow builders:
For users:
This is how you build open-source agentic workflows that actually ship.
Install the SDK:
npm install coding-agent-sdk
Build your workflow:
import { query } from 'coding-agent-sdk';
// Your workflow delegates to the user's agent
const result = await query("Deploy the application");
// Stream events as they happen
for await (const event of result.events) {
if (event.type === 'message') {
console.log(event.content);
}
}
Your user runs it with their existing agent:
# They already have Claude Code, Codex, or Gemini installed
# They already have an API key
# Your workflow just works
The SDK:
One function. That's it.
query(prompt: string, options?: QueryOptions): Promise<QueryResult>
Parameters:
prompt - What you want the agent to dooptions - Optional backend, session resume, working directoryReturns:
sessionId - Resume the conversation laterevents - Async generator of unified eventsbackend - Which agent was usedExample:
import { query } from 'coding-agent-sdk';
const result = await query("Add error handling to the API routes");
for await (const event of result.events) {
switch (event.type) {
case 'message': // AI responses
case 'action': // File changes, tool calls
case 'progress': // Todo lists, status updates
case 'turn': // Conversation boundaries
case 'session': // Session lifecycle
case 'error': // Warnings and errors
case 'metrics': // Usage statistics
}
}
Here's a code review workflow that works with any agent:
import { query } from 'coding-agent-sdk';
async function reviewPullRequest(prNumber: number) {
// Step 1: Get the diff
const diffResult = await query(`Get the git diff for PR #${prNumber}`);
// Step 2: Review the changes
const reviewResult = await query(
`Review this code for:
- Security vulnerabilities
- Performance issues
- Best practices
- Test coverage`
);
// Step 3: Suggest improvements
await query("Suggest specific improvements with code examples");
}
Your users run this with Claude, Codex, or Gemini. Same workflow. Zero changes.
This SDK is designed for one thing: building reusable workflows that delegate to existing agents.
What you should build:
What you shouldn't build:
The insight: Workflows are composable and distributable. Agents are not.
The future of agentic software is not a thousand competing agents.
It's workflows that compose existing agents.
This SDK is the thin layer between them. One unified interface. Three agents. Infinite workflows.
| Agent | CLI | API Key |
|---|---|---|
| Claude Code | claude | ANTHROPIC_API_KEY |
| OpenAI Codex | codex | OPENAI_API_KEY |
| Google Gemini | gemini | GEMINI_API_KEY |
The SDK auto-detects which one is available. Your workflow just works.
npm install coding-agent-sdk
Your users need:
That's it. No SDK API keys. No additional setup.
const result1 = await query("Start the refactor");
const sessionId = result1.sessionId;
// Later...
const result2 = await query("Continue", { resume: sessionId });
await query("Deploy", {
backend: 'claude',
workingDir: '/path/to/project'
});
const result = await query("Migrate to TypeScript");
for await (const event of result.events) {
if (event.type === 'progress' && event.todo_items) {
console.log(`Progress: ${event.todo_items.filter(t => t.status === 'completed').length}/${event.todo_items.length} tasks done`);
}
}
const result = await query("Deploy to production");
for await (const event of result.events) {
if (event.type === 'action' && event.subtype === 'tool') {
console.log(`Action: ${event.tool_name} - ${event.status}`);
}
}
Want to see the magic? Run this:
npx coding-agent-sdk -p "List all TypeScript files"
The SDK will:
No configuration. No setup. It just works.
The real value is the query() API for building workflows, but this shows you how it automatically detects and delegates to whatever agent your users have.
We're building the interface layer between workflows and agents. PRs welcome.
npm test # Run tests
npm run build # Build
MIT
Stop rebuilding the wheel. Start building workflows.
FAQs
Build agentic workflows that delegate to your users' existing coding agents (Claude Code, Codex, Gemini).
The npm package coding-agent-sdk receives a total of 8 weekly downloads. As such, coding-agent-sdk popularity was classified as not popular.
We found that coding-agent-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.

Security News
New DoS and source code exposure bugs in React Server Components and Next.js: what’s affected and how to update safely.

Security News
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.