
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
The RunAgent TypeScript SDK delivers the same `RunAgentClient` interface found in the Python SDK, tailored for both Node.js services and browser-based applications. Use it to invoke agents you deploy with the RunAgent CLI, whether they run locally on the
The RunAgent TypeScript SDK delivers the same RunAgentClient interface found in the Python SDK, tailored for both Node.js services and browser-based applications. Use it to invoke agents you deploy with the RunAgent CLI, whether they run locally on the same machine or remotely on backend.run-agent.ai.
npm install runagent
Optional peer dependencies:
ws – required for WebSocket streaming in Node.js environments.better-sqlite3 – only needed when you want Node.js clients to auto-discover local agents via the RunAgent registry. Browser builds should not install it.# For Node.js apps that rely on registry discovery:
npm install ws better-sqlite3
interface RunAgentConfig {
agentId: string;
entrypointTag: string;
local?: boolean; // default: false in browser, true in Node if not specified
host?: string; // required in browser when local = true (no registry access)
port?: number; // required in browser when local = true (no registry access)
apiKey?: string; // defaults to RUNAGENT_API_KEY env variable
baseUrl?: string; // defaults to RUNAGENT_BASE_URL env variable or https://backend.run-agent.ai
baseSocketUrl?: string; // optional override for WebSocket origin
apiPrefix?: string; // defaults to /api/v1
timeoutSeconds?: number; // defaults to 300
extraParams?: Record<string, unknown>; // reserved for metadata forwarding
enableRegistry?: boolean; // defaults to true in Node, false in browsers
}
Environment variables
RUNAGENT_API_KEY – API key for remote agents (Bearer token).RUNAGENT_BASE_URL – override the default remote base URL (useful for staging/self-hosted deployments).For browser builds, you can expose these via bundler secrets or a custom globalThis.RUNAGENT_ENV object before initialising the client.
import { RunAgentClient, RunAgentExecutionError } from 'runagent';
const client = new RunAgentClient({
agentId: 'agent-id-from-dashboard',
entrypointTag: 'support_flow',
apiKey: process.env.RUNAGENT_API_KEY,
// Optional: baseUrl defaults to https://backend.run-agent.ai
});
await client.initialize();
const result = await client.run({
customer_email: 'alex@example.com',
issue_summary: 'Billing question',
});
console.log(result);
import { RunAgentClient, RunAgentExecutionError } from 'runagent';
const client = new RunAgentClient({
agentId: 'agent-id-from-dashboard',
entrypointTag: 'support_flow_stream',
apiKey: process.env.RUNAGENT_API_KEY,
});
await client.initialize();
for await (const chunk of client.runStream({ transcript: [] })) {
console.log('>>>', chunk);
}
import { RunAgentClient } from 'runagent';
const client = new RunAgentClient({
agentId: 'local-agent-id',
entrypointTag: 'minimal',
local: true,
// enableRegistry defaults to true in Node; make sure better-sqlite3 is installed
});
await client.initialize(); // looks up ~/.runagent/runagent_local.db
const result = await client.run({ message: 'Hello there' });
console.log(result);
If you prefer to bypass the registry (or if better-sqlite3 isn’t installed), pass the host and port explicitly:
const client = new RunAgentClient({
agentId: 'local-agent-id',
entrypointTag: 'minimal',
local: true,
enableRegistry: false,
host: '127.0.0.1',
port: 8450,
});
Browser builds cannot access the local registry or the filesystem. Provide connection details explicitly and set enableRegistry: false.
import { RunAgentClient } from 'runagent';
const client = new RunAgentClient({
agentId: 'agent-id-from-dashboard',
entrypointTag: 'support_flow',
local: false,
apiKey: window.RUNAGENT_API_KEY, // inject securely via bundler/runtime
enableRegistry: false,
});
await client.initialize();
const result = await client.run({ message: 'Hello!' });
For browser streaming:
const client = new RunAgentClient({
agentId: 'agent-id',
entrypointTag: 'support_flow_stream',
apiKey: window.RUNAGENT_API_KEY,
enableRegistry: false,
});
await client.initialize();
for await (const chunk of client.runStream({ message: 'Need help' })) {
renderChunk(chunk);
}
Tip: To keep bundles light, Webpack/Vite can tree-shake the optional registry path when
enableRegistryisfalse. This avoids shipping Node-only dependencies to the browser.
RunAgentClient methodsinitialize(): Promise<RunAgentClient>
Resolves connection details (registry lookup for local Node use, base URLs for remote) and validates that the requested entrypoint exists.
run(inputKwargs?: Record<string, unknown>): Promise<unknown>
Executes a non-streaming entrypoint via HTTPS and returns deserialized output (matching the Python SDK semantics).
runStream(inputKwargs?: Record<string, unknown>): AsyncGenerator<unknown>
Streams chunks via WebSocket for entrypoints whose tags end with _stream. Throws if you call it on a non-stream entrypoint.
getExtraParams(): Record<string, unknown> | undefined
Returns any metadata passed in extraParams. Reserved for forward compatibility.
Errors
Both run() and runStream() throw RunAgentExecutionError when the agent reports a failure (or when the transport breaks). Inspect error.code, error.message, and error.suggestion to deliver actionable feedback:
try {
const result = await client.run({ prompt: '...' });
} catch (error) {
if (error instanceof RunAgentExecutionError) {
console.error(error.code, error.message, error.suggestion);
} else {
throw error;
}
}
RUNAGENT_API_KEY, RUNAGENT_BASE_URL)..env files owned by your deployment platform.Entrypoint ... is streaming. Use runStream()
Call runStream() for tags ending in _stream.
Unable to determine host/port (local mode)
Install better-sqlite3 and ensure the agent was started through the CLI (runagent serve ...). Otherwise provide host and port manually.
Authentication failures (401/403)
Make sure RUNAGENT_API_KEY (or apiKey in the constructor) corresponds to an account with access to the agent.
WebSocket connection fails in browser
Confirm your environment allows WSS connections to backend.run-agent.ai and set enableRegistry: false.
// vite.config.ts
export default defineConfig({
define: {
'process.env.RUNAGENT_API_KEY': JSON.stringify(process.env.RUNAGENT_API_KEY),
'process.env.RUNAGENT_BASE_URL': JSON.stringify(process.env.RUNAGENT_BASE_URL),
},
});
Edge runtimes are closer to browsers: disable the registry and pass host/base URLs explicitly.
const client = new RunAgentClient({
agentId: env.AGENT_ID,
entrypointTag: 'edge_entry',
apiKey: env.RUNAGENT_API_KEY,
enableRegistry: false,
});
0.1.26 aligns with the CLI v1+ REST/WebSocket APIs (/agents/{id}/run & /run-stream routes).docs/sdk/javascript/.FAQs
The RunAgent TypeScript SDK delivers the same `RunAgentClient` interface found in the Python SDK, tailored for both Node.js services and browser-based applications. Use it to invoke agents you deploy with the RunAgent CLI, whether they run locally on the
We found that runagent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.