
Security News
High-Severity RCE Vulnerability Disclosed in next-mdx-remote
HashiCorp disclosed a high-severity RCE in next-mdx-remote affecting versions 4.3.0 to 5.x when compiling untrusted MDX on the server.
commandkit
Advanced tools
Stop rebuilding command and event handlers for every new discord.js bot. CommandKit does it for you — and a lot more.
Every new discord.js project starts the same way: write a command handler, write an event handler, set up interaction collectors, register slash commands with the API, figure out a project structure. It's hours of boilerplate before you write any real bot logic.
Most existing discord.js frameworks solve this by giving you a handler class you instantiate and point at a folder — and that's about it. They're loaders, not frameworks. Others like Sapphire go further and have decent features, but require heavy OOP boilerplate where everything is a class extending a base class.
CommandKit takes a different approach entirely. It works like a proper meta-framework — think Next.js for Discord bots. It ships with a smart CLI that handles bundling, TypeScript/JSX compilation, hot-reloading, command registration, and project scaffolding automatically. You run commandkit dev and everything just works — zero configuration.
The design philosophy is convention over configuration: put a file in src/app/commands/ and it's a command. Put a file in src/app/events/ and it's an event listener. Export a chatInput function and it handles slash commands. Export a message function in the same file and it handles prefix commands too. No registration calls, no base classes, no decorators. The framework knows what to do with your code based on where it is and what it exports — so you skip the setup and go straight to building.
Drop your command files in a folder, export a function, and they just work. Slash commands, context menu commands, and prefix commands are all supported under a single unified command structure — no separate handler for each type. Commands are automatically registered and kept in sync with Discord. Events work the same way: create a file, export a listener, and CommandKit handles the rest.
discord.js builder chains (ActionRowBuilder → ButtonBuilder → setCustomId → ...) get messy fast. CommandKit lets you write Discord components in JSX — the same declarative syntax used in React — so your UI code is clean and readable.
Buttons get onClick. Modals get onSubmit. Select menus get onSelect. Define a component and its behavior in one place — no InteractionCollector setup, no timeout management, no cleanup boilerplate.
Run logic before or after any command executes — permission checks, cooldowns, logging, analytics — without touching the command itself. A proper middleware layer, like you'd find in Express.
Message-based (prefix) commands live in the same file as your slash commands and context menus. One command file handles all input types. No separate handler needed.
The @commandkit/cache plugin gives you a customizable caching layer — in-memory by default, Redis-backed when you need persistence. Just add the 'use cache' directive to any function.
Extend CommandKit through plugins that hook into the framework lifecycle. Plugins can emit custom events — for example, listening to an external webhook and firing events your bot can react to. This isn't a wrapper around node:events; it's a structured extension system for building modular, decoupled bot features. Official plugins include @commandkit/i18n for localization and @commandkit/analytics for usage tracking.
The @commandkit/ai plugin lets users interact with your bot through natural language. Instead of memorizing slash command names, users just talk to your bot — and the AI figures out which command to run. Built on the AI SDK with support for Google Gemini, OpenAI, and more. Includes built-in tools, custom tool support, lifecycle hooks, and per-user model selection.
Native TypeScript and JSX support with no configuration. No tsconfig.json fiddling, no separate build step, no bundler setup. The CLI handles compilation, bundling, hot-reloading, and project scaffolding.
CommandKit has been used in production client projects and has saved hours of setup time on each one. It's not overhead — it's the setup work you'd do anyway, already done well.
npm create commandkit
Follow the prompts, then run commandkit dev to start your bot. Check out the documentation for guides and API reference.
Submit any queries or suggestions in our Discord community.
FAQs
Beginner friendly command & event handler for Discord.js
The npm package commandkit receives a total of 2,064 weekly downloads. As such, commandkit popularity was classified as popular.
We found that commandkit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
HashiCorp disclosed a high-severity RCE in next-mdx-remote affecting versions 4.3.0 to 5.x when compiling untrusted MDX on the server.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.