
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
Multi-agent orchestration platform for AI coding teams — coordinates Claude Code, Gemini CLI, and Codex agents with a real-time web dashboard
Website: crewlyai.com
Crewly is an open-source multi-agent orchestration platform that coordinates AI coding agents (Claude Code, Gemini CLI, Codex) to work together as a team. It provides a web dashboard for real-time monitoring, task management, and team coordination — all running locally on your machine.
# Initialize Crewly in your project (no global install needed)
npx crewly init
# Or install globally first
npm install -g crewly
crewly init
# Start the platform
crewly start
The init command walks you through provider selection, installs agent skills, and scaffolds a .crewly/ directory. Then crewly start launches the backend server and opens the web dashboard. From there:
| Runtime | Install | Verify |
|---|---|---|
| Claude Code (default) | npm install -g @anthropic-ai/claude-code | claude --version |
| Gemini CLI | npm install -g @google/gemini-cli | gemini --version |
| Codex (OpenAI) | npm install -g @openai/codex | codex --version |
API keys: Gemini CLI requires GEMINI_API_KEY. Codex requires an OpenAI API key. Claude Code authenticates through its own login flow.
┌─────────────────────────────────────────────────────┐
│ Web Dashboard │
│ (React + xterm.js + WebSocket) │
└───────────────────────┬─────────────────────────────┘
│
┌───────────────────────▼─────────────────────────────┐
│ Backend Server │
│ (Express + Socket.IO + PTY) │
│ │
│ ┌──────────┐ ┌──────────┐ ┌───────────────────┐ │
│ │ Services │ │ Scheduler│ │ Agent Registration │ │
│ │ (Storage,│ │ (Check- │ │ (Heartbeat, Idle │ │
│ │ Memory) │ │ ins) │ │ Detection, Resume)│ │
│ └──────────┘ └──────────┘ └───────────────────┘ │
└───────────────────────┬─────────────────────────────┘
│
┌───────────────┼───────────────┐
▼ ▼ ▼
┌──────────────┐ ┌─────────────┐ ┌─────────────┐
│ Agent PTY │ │ Agent PTY │ │ Agent PTY │
│ (Claude) │ │ (Gemini) │ │ (Codex) │
│ │ │ │ │ │
│ Skills ◄────┤ │ Skills ◄───┤ │ Skills ◄───┤
│ Memory ◄────┤ │ Memory ◄───┤ │ Memory ◄───┤
└──────────────┘ └─────────────┘ └─────────────┘
Storage: ~/.crewly/ (global) + project/.crewly/ (per-project)
| Runtime | Default Command | Notes |
|---|---|---|
| Claude Code | claude --dangerously-skip-permissions | Default runtime |
| Gemini CLI | gemini --yolo | Requires GEMINI_API_KEY |
| Codex (OpenAI) | codex --full-auto | Requires OpenAI API key |
You can change the default runtime or customize launch commands in Settings.
crewly init # Interactive setup wizard (alias: onboard)
crewly start # Start backend + open dashboard
crewly stop # Stop all services and sessions
crewly status # Show running services
crewly logs # View aggregated logs
crewly upgrade # Upgrade to latest version
crewly install [id] # Install a skill from marketplace
crewly search [q] # Search skill marketplace
Optional environment variables (.env file or shell):
GEMINI_API_KEY=your_key_here # Required for Gemini CLI runtime
SLACK_BOT_TOKEN=xoxb-... # Optional: Slack integration
SLACK_APP_TOKEN=xapp-...
SLACK_SIGNING_SECRET=...
LOG_LEVEL=info # debug, info, warn, error
WEB_PORT=8787 # Dashboard port (default: 8787)
Run Crewly with a single command using Docker:
# 1. Clone the repo
git clone https://github.com/stevehuang0115/crewly.git
cd crewly
# 2. Add your API keys to .env
cp .env.example .env
# Edit .env and add ANTHROPIC_API_KEY, GEMINI_API_KEY, etc.
# 3. Start Crewly
docker compose up
# Dashboard available at http://localhost:8787
To mount a project directory for agents to work on, edit docker-compose.yml and uncomment the volume mount:
volumes:
- crewly_data:/home/node/.crewly
- /path/to/your/project:/home/node/project # <-- uncomment and edit
Build the image manually:
# On Apple Silicon, use --platform linux/amd64
docker build --platform linux/amd64 -t crewly .
docker run -p 8787:8787 --env-file .env crewly
# Clone the repository
git clone https://github.com/stevehuang0115/crewly.git
cd crewly
# Install dependencies
npm install
# Build all components (backend + frontend + CLI)
npm run build
# Start in dev mode (backend + frontend with hot-reload)
npm run dev
# Run tests
npm run test:unit
See CONTRIBUTING.md for detailed development guidelines.
Screenshots and demo video coming soon. Star the repo to get notified!
FAQs
Multi-agent orchestration platform for AI coding teams — coordinates Claude Code, Gemini CLI, and Codex agents with a real-time web dashboard
The npm package crewly receives a total of 621 weekly downloads. As such, crewly popularity was classified as not popular.
We found that crewly demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.