
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
open-multi-agent-kit
Advanced tools
OMK (Open Multi-Agent Kit) coding agent CLI with read, bash, edit, write tools and session management
Provider-neutral terminal coding agent with multi-agent orchestration, scoped tools, replayable sessions, and evidence-backed verification.
OMK supports interactive terminal use, non-interactive output, RPC integration, and an embeddable TypeScript SDK. It works with API-key and subscription providers without making one provider the control plane.
Requires Node.js 22.19 or newer.
npm install -g open-multi-agent-kit --ignore-scripts
omk --version
omk
Run without a global install:
npx --ignore-scripts open-multi-agent-kit
The published package name remains open-multi-agent-kit; the command is omk.
Start OMK in a project directory:
cd your-project
omk
Then:
/login to configure an OAuth subscription or API key./model to choose an available model.OMK stores user configuration under ~/.omk/agent/ and project configuration under .omk/.
OMK includes provider adapters for Anthropic, OpenAI Codex, Google, OpenCode, Kimi, Qwen, ZAI/GLM, Grok, and other compatible services. Availability depends on the credentials and endpoints configured on the current machine.
/login adds or selects credentials./logout removes credentials for a selected provider./model lists models available to the current credential set.OAuth credentials are stored locally in ~/.omk/agent/auth.json. Multi-account providers keep accounts separate and send requests only through the explicitly selected account.
See Provider setup for provider-specific authentication, quota behavior, and environment variables.
Configure Kimi through /login or the documented Kimi API-key environment variable. Requests use the fixed provider endpoint selected by the provider adapter.
Set the documented Hugging Face token and select a compatible model. See the provider guide for current model and endpoint requirements.
Type / in the editor to open command completion.
| Command | Description |
|---|---|
/login, /logout | Manage OAuth or API-key credentials |
/model | Select a model |
/think | Select a thinking level |
/settings | Change interactive settings |
/resume | Open a previous session |
/new | Start a new session |
/session | Show session path, messages, tokens, and cost |
/tree | Navigate the current session tree |
/compact [prompt] | Compact context, optionally with custom instructions |
/copy | Copy the last assistant message |
/export [file] | Export the session |
/reload | Reload project and user resources |
/hotkeys | Show keyboard shortcuts |
/star | Open the OMK GitHub repository |
/quit | Exit OMK |
See Usage and Keybindings for the complete interactive reference.
Sessions are append-only JSONL transcripts stored under ~/.omk/agent/sessions/. OMK can resume, branch, export, and repair sessions without sending the transcript to a separate orchestration service.
Do not publish session files until you have reviewed them for source code, credentials, personal information, and private tool output.
Automatic and manual compaction reduce older context while retaining recent conversation state. Cancellation restores queued user input without committing a partial summary.
See Compaction.
OMK discovers project instructions such as AGENTS.md from the current directory and parent directories. Use --no-context-files when a clean session must not load project context.
Provider prompt caching follows provider capabilities and configured retention. Cache metadata is local and bounded; provider-side retention remains subject to the provider's policy.
Credential, network, model, and runtime variables are documented in Environment variables. Prefer the documented fixed provider endpoints for authenticated requests.
omk [options] [prompt]
omk --help
Common modes:
omk # interactive TUI
omk -p "summarize changes" # print mode
omk --mode json "task" # structured event stream
omk --rpc # JSONL RPC mode
Use omk --help for the authoritative option list for the installed version. Avoid copying options from an unreleased branch into automation.
RPC mode reads JSON commands from standard input and emits JSON events to standard output. Use it when another process owns the UI or lifecycle.
See RPC.
The TypeScript SDK exposes session creation, provider configuration, tools, and event streams. Extensions can add commands, tools, UI components, themes, and resource loaders without patching OMK core.
LIVE_E2E=1.Report vulnerabilities privately through the repository's GitHub security contact rather than a public issue.
git clone https://github.com/dmae97/omk.git
cd omk
npm ci --ignore-scripts
npm run build
npm run check
npm test
See Development and CONTRIBUTING.md.
Release notes: v0.95.2.
MIT. See LICENSE.
FAQs
OMK (Open Multi-Agent Kit) coding agent CLI with read, bash, edit, write tools and session management
We found that open-multi-agent-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.