
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
TrigGuard public SDK — authorize, verify, receipts, agents, CLI. One install.
trigguard — canonical product SDKExecution authorization for AI agents and automated systems.
npm install trigguard
import {
authorize,
verify,
receipt,
explain,
createAgent,
createClient,
} from "trigguard";
CLI is the same install:
npx trigguard authorize
npx trigguard verify
npx trigguard policy
npx trigguard demo
| Install | Role |
|---|---|
npm install trigguard | SDK + CLI |
pip install trigguard | Python SDK |
pip install authgraph | Execution intelligence |
npx @trigguard/mcp | MCP |
pip install trigguard-litellm | LiteLLM callback |
Internals (@trigguard/execution-sdk, agent-sdk, intent-sdk, …) stay in the monorepo. Prefer this package. Subpaths exist for gradual migration: trigguard/execution, trigguard/agent, trigguard/express, trigguard/proxy.
Offline demo: examples/quickstart-node/.
| Method | Purpose |
|---|---|
authorize | POST /v1/authorize — returns CustomerDecisionResult |
verify | Offline receipt signature verification |
explain | Human-readable decision summary |
attest | Record an attestation via authorize |
audit | Query workspace audit entries |
coach | Advisory outcome preview (non-binding) |
Integration helpers:
@trigguard/execution-sdk — shared HTTP client (prefer trigguard for apps)@trigguard/agent-sdk — npm install @trigguard/agent-sdk for agents@trigguard/proxy / @trigguard/express-middleware — Express; not included in the flagship installArchitecture freeze: docs/PACKAGE_ARCHITECTURE.md.
Policy simulation (advisory, separate install):
npm install @trigguard/simulator
| Legacy | Status | Use instead |
|---|---|---|
@trigguard/execution-sdk | Supported, deprecated | npm install trigguard |
sdk/node (@trigguard/decision) | Supported, deprecated (Rail B) | createTrigGuard().authorize() |
trigguard-js | Legacy | createTrigGuard() |
Guide: docs/adoption/MIGRATE_TO_TRIGGUARD_SDK.md.
HOLD until verb parity with Node — see output/PYTHON_PUBLISH_HOLD.md.
Development: pip install -e sdk/python · examples/quickstart-python/
npm run build -w trigguard
npm run test -w trigguard
See docs/adoption/FIRST_10_MINUTES.md for onboarding.
FAQs
TrigGuard public SDK — authorize, verify, receipts, agents, CLI. One install.
The npm package trigguard receives a total of 165 weekly downloads. As such, trigguard popularity was classified as not popular.
We found that trigguard demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.