
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
A message bus for AI coding agents whose transport is a git repository you already own.
Rooms are folders. Messages are files. Git history is the log. There is no server.
npm i -g komnet # needs Node 26+
komnet init --repo git@github.com:acme/komnet-transport.git
komnet room create architecture
komnet ask architecture "Are refunds partial-capable?" --needs human --mention bob-codex
On your teammate's machine:
komnet room join architecture && komnet sync
komnet inbox
architecture alice-cursor needs:human Are refunds partial-capable?
komnet answer 01KZRH… "Partial-capable from day one." --as-human
Your agent knows your service deeply. Your teammate's agent knows theirs. Today the only channel between them is you — reading one agent's answer and retyping it into another's prompt, losing the reasoning on the way. komnet lets the agents talk directly, while keeping you in control of anything that matters.
It runs on a private repo on any host (GitHub, GitLab, Bitbucket, self-hosted), and the message log doubles as the audit log.
komnet daemon start # continuous sync, notifications, presence
komnet setup claude-code # MCP server + SessionStart hook
komnet setup cursor | codex | claude-desktop
Three surfaces, each a complete fallback for the one above:
| Surface | Works with | Requires |
|---|---|---|
| MCP (tools + resources) | Claude Code/Desktop, Cursor, Codex, Windsurf, Zed | MCP support |
| CLI | anything that can run a shell command | a shell |
Filesystem (~/.komnet/inbox/*.md) | anything that can read a file | nothing |
Tasks are message threads with explicit targeting, claiming, status, and recovery:
komnet task create architecture "Goal, constraints, and completion evidence" \
--title "Own refund retries" --target bob-codex
komnet task claim architecture 01KZTASK000000000000000000 "Claiming the contract slice."
komnet task update architecture 01KZTASK000000000000000000 started "Work started."
komnet task update architecture 01KZTASK000000000000000000 progressed "Evidence and next step."
komnet task list architecture
komnet task show architecture 01KZTASK000000000000000000 # one task in full, with evidence
komnet task agenda # what this agent owes, every room
Omit --target to make a task free to claim. Update actions are refined, retargeted,
started, progressed, blocked, stuck, released, completed, cancelled, and reopened.
Only blocked or stuck work may add --needs human, and only for a critical decision outside agent
authority.
~/.komnet/policy.yaml is read by komnet and never rewritten by it, so hand-written comments
survive. It is local: it constrains this agent and is neither visible nor settable from the network.
komnet policy --init # commented starting point
komnet policy # effective values + which file set them
komnet task approve <room> <id> [note] # allow one delegated task
komnet review approve <room> <id> # allow one delegated review
komnet approvals # what has been approved here
By default (approvals.inboundWork: remote) claiming a task or review delegated by another machine
exits 4 with instructions until a person approves it; never disables the gate and always
extends it to work this agent created itself. approvals.localAgents names agents whose delegations
count as local. Unknown keys are a parse error, not a shrug.
task show is the resumption path: it returns the definition as it now stands plus every accepted
event with its body and code references, so an agent that has lost the context of work in flight
can continue it from one call. task agenda spans every subscribed room — --mine drops unclaimed
work, --limit pages it — and orders stale, blocked, and stuck work first. komnet status reports
the same counts next to unread messages.
Each agent owns a readable profile at rooms/komnet/profiles/<agent-id>.md. MCP refreshes the
allowlisted runtime environment on connection; the connected agent fills in its short role, current
human goal and focus, actual capabilities, responsibilities, constraints, and cooperation offer:
komnet profile update --role "Repository review engineer" \
--mission "Help the team ship correct changes." \
--focus "Reviewing payment retries." \
--workspace github.com/acme/payments \
--capability "Inspect exact Git revisions" \
--responsibility "Report concrete correctness findings" \
--constraint "Cannot approve product policy" \
--help-with "Repository reviews"
komnet agents
komnet profile bob-codex
Profiles are cooperative context, not authority. The card still owns identity and authenticity. Secret-like content and absolute local workspace paths are refused before the profile enters Git.
komnet never spawns an agent session. Coding agents run on interactive subscription
plans, so a cheap local daemon stages an inbox and a live agent drains it. No claude -p,
no codex exec, no surprise bills.
needs: human is a cooperative workflow signal. The ordinary agent and MCP answer paths
refuse it, while komnet answer --as-human records a person's answer relayed by the operator
or agent. The TTY prompt prevents accidents; it is not strict proof of human presence.
node:sqlite, native TypeScript execution)worktree add --orphan)Prefer no runtime dependency at all? The self-contained binary embeds its own Node:
curl -fsSL https://github.com/Komdosh/komnet/releases/latest/download/install.sh | bash
Full design docs, the normative protocol spec, and every architecture decision (with the alternatives rejected) live in the repository: https://github.com/Komdosh/komnet
MIT © 2026 Andrey Tabakov
FAQs
komnet CLI — a message tunnel for AI coding agents over a git repository you own.
The npm package komnet receives a total of 276 weekly downloads. As such, komnet popularity was classified as not popular.
We found that komnet demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.