
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
extendo-cli
Advanced tools
Human-in-the-loop decisions for AI agents.
Extendo lets your agents ask humans for structured decisions — approvals, choices, reviews, prioritization — delivered as rich UI via mobile push notifications. The human responds on their phone; the agent gets structured JSON back and continues.
# Agent asks for deploy approval → user sees a yes/no card on their phone
npx extendo-cli artifact create ops deploy \
--type yes_no --title "Deploy to prod?" \
--prompt "All 847 tests pass. Ship it?" \
--wait --json
{ "payload": { "decision": true } }
No Slack threads. No email. No "reply YES to confirm." Purpose-built UI for each decision type.
Extendo is an iOS app. Install it on your iPhone or iPad via TestFlight (invite link coming soon).
Visit public.extendo.sh to get an API token. Scan the QR code with the Extendo app on your phone to add the backend.
npx extendo-cli auth add public https://public.extendo.sh <your-token>
Note: The public backend is the fastest way to try Extendo, but for production use you'll get a better experience hosting your own infrastructure — tighter integration with your agents, lower latency, and full control. See extendo-backends for self-hosting on Cloudflare Workers or inside a Tailnet.
If you use Claude Code, install the skill so Claude knows how to use Extendo automatically:
npx skills add github:extendo-cli
This works with any agent framework that can run shell commands — the skill is just documentation, and npx extendo is the CLI.
Send messages to a human and wait for replies:
npx extendo-cli new project "Starting the auth refactor. I'll check in when I hit a decision point."
npx extendo-cli send project my-thread "Found 3 approaches. Creating a decision artifact."
npx extendo-cli wait project my-thread --timeout 300
Create artifacts that render as purpose-built UI on the user's device. The agent blocks (or polls) until the user submits.
| Type | What the user sees | Use case |
|---|---|---|
yes_no | Approve / Reject buttons | Deploy gates, destructive action confirmation |
multiple_choice | Radio buttons or checkboxes | Model selection, strategy choice |
checklist | Per-item approve/reject switches | Expense review, PR file-by-file approval |
ranking | Drag-to-reorder list | Sprint prioritization, migration ordering |
categorize | Kanban board (iPad) / collapsible sections (iPhone) | Bug triage, task bucketing |
document_review | Per-paragraph annotation | RFC review, contract review |
dag | Interactive directed graph | Architecture diagrams, dependency visualization |
progress_grid | Colored status matrix | Sprint trackers, migration dashboards |
Block an agent workflow until a human decides:
# Create a conversation thread for context
THREAD=$(npx extendo-cli new ops "Requesting deploy approval for v2.3.1" --json | jq -r .endpoint.name)
# Create a linked yes/no gate — blocks until the user taps Approve or Reject
RESULT=$(npx extendo-cli artifact create ops deploy-v2 \
--type yes_no \
--title "Deploy v2.3.1 to production?" \
--prompt "CI green. 847 tests pass. No regressions." \
--conversation "ops:$THREAD" \
--wait --json)
if [ "$(echo "$RESULT" | jq -r '.payload.decision')" = "true" ]; then
echo "Deploying..."
else
echo "Aborted."
fi
npx extendo-cli new <category> "message" # Create a new thread
npx extendo-cli send <category> <name> "message" # Send to existing thread
npx extendo-cli read <category> <name> # Read messages
npx extendo-cli wait <category> <name> --timeout 300 # Block until reply
npx extendo-cli threads # List all threads
npx extendo-cli thread update <cat> <name> --title "..." --note "..."
Both send and new accept --context <text> or --context-file <path> to inject system context.
npx extendo-cli artifact create <cat> <name> --type <type> --title <title> [options]
npx extendo-cli artifact get <cat> <name> [--wait] [--timeout <s>] [--json]
npx extendo-cli artifact update <cat> <name> --payload <json> | --payload-file <path>
npx extendo-cli artifact list [--status <status>] [--json]
npx extendo-cli artifact delete <cat> <name>
npx extendo-cli auth add <name> <url> <token> # Add/update a backend
npx extendo-cli auth list # Show configured backends
npx extendo-cli auth default <name> # Set default backend
npx extendo-cli auth remove <name> # Remove a backend
All commands accept: --json, -b <name> / --backend <name>, --url <url>, --token <token>
Extendo is three components:
| Component | What it does | Repo |
|---|---|---|
| extendo-cli | CLI + agent skill. Sends messages and creates artifacts via HTTP API. | You're here |
| extendo-backends | Cloudflare Workers that store threads, artifacts, and send push notifications. | extendo-backends |
| Extendo iOS app | iPhone/iPad app that renders artifacts as native UI and sends responses back. | Private (TestFlight) |
Agent (CLI) ──HTTP──▶ Backend (CF Worker) ──APNs──▶ iOS App
▲ │
└────── HTTP response ────┘
MIT
FAQs
CLI for interacting with Extendo backends
The npm package extendo-cli receives a total of 0 weekly downloads. As such, extendo-cli popularity was classified as not popular.
We found that extendo-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.