
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A lightweight Node.js command-line client for the kapa.ai HTTP API.
echo foo | kapa --stdin)~/.config/kapa-cli/config.json~/.local/share/kapa-cli/history.jsonlconfig, history, and cache clear# Protect secrets at rest before storing them locally
export KAPA_VAULT_KEY="your-long-random-passphrase"
export KAPA_HISTORY_KEY="$KAPA_VAULT_KEY" # optional but recommended
# Link the CLI locally
npm link
# Configure credentials (or set env vars: KAPA_API_KEY, KAPA_PROJECT_ID, KAPA_INTEGRATION_ID)
kapa config set apiKey sk-...
kapa config set projectId proj_123
kapa config set integrationId integ_456
# Ask something
kapa "How do I refresh sources?"
| Flag | Description |
|---|---|
--project <id> | Override project id for this call |
--integration <id> | Override integration id |
--thread <id> / --resume last | Continue an existing conversation |
--metadata key=value | Attach metadata (repeat multiple times) |
--stream / --no-stream | Force-enable or disable streaming |
--json | Print raw JSON from the API |
--save <path> | Save the answer text to a file |
--copy | Copy the answer text to the clipboard |
kapa config list # show stored profiles
kapa config profile create prod # add a profile
kapa config profile use prod # switch default profile
kapa --profile prod "Status?"
kapa history # show the last 10 prompts
kapa history 25 --json # show 25 entries as JSON
kapa history clear # wipe local history
History is stored locally only; delete ~/.local/share/kapa-cli/history.jsonl if you prefer not to track it. Use --no-history on individual calls to skip logging.
KAPA_VAULT_KEY (or KAPA_CONFIG_SECRET) is required to encrypt kapa config secrets before they land on disk. Without it, the CLI refuses to persist API keys unless you opt in to plaintext with KAPA_ALLOW_PLAINTEXT_CONFIG=1.KAPA_HISTORY_KEY (or reuse KAPA_VAULT_KEY) to encrypt prompt/response history. To deliberately write plaintext history, set KAPA_ALLOW_PLAINTEXT_HISTORY=1; otherwise history logging is skipped.KAPA_API_KEY, KAPA_PROJECT_ID, etc.) remain the safest option for automation pipelines when writing to disk is undesirable.npm install
npm run test # runs node --test with the ts-node loader
npm run build # compiles dist/*.js
This project is released under the MIT License (see LICENSE). Third-party runtime dependencies (chalk, clipboardy, commander, ora, and undici) are also MIT-licensed.
FAQs
Terminal CLI wrapper for the Kapa AI API.
We found that kapa-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.