
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
Vaaya CLI — LLMs and paid agent superpowers from one wallet, no API keys. Type `vaaya` for a terminal chat with any of 300+ models (Kimi, GPT, Gemini, Claude) that can search, scrape, generate media and enrich leads mid-answer; `vaaya install` sets up the
Give your agent paid superpowers — from your terminal. (The npm package is
vaaya-cli; the installed command is vaaya.)
npx @vaaya/mcp install
(npx vaaya-cli install runs the same installer — this CLI wraps the published
@vaaya/mcp package.)
One command sets up the Vaaya MCP server for every agent it detects on your machine (Claude Code, Claude Desktop, Cursor, Codex). Restart your agent, and its first Vaaya call opens a short browser approval — sign-up happens right there if you're new. Pay-per-call, no API keys, failed calls are never charged.
The agent asks Vaaya's conversational consult tool for anything it can't do,
gets back the exact call to run, and executes it with use — billed on success.
The agent never sees upstream URLs or API keys.
vaayavaaya
That opens a chat with any of 300+ models (Kimi, GPT, Gemini, Claude, DeepSeek),
paid per token from the same wallet, no API keys. The model gets your full live
Vaaya toolset in the conversation, the same tools your agents see, so it can
search the web, read pages, generate images, enrich leads or run code while it
answers. /tools lists them, /model switches model, /exit quits.
vaaya "what shipped in the last react release" # ask once and exit
git diff | vaaya "write a commit message" # pipes work
vaaya llm # plain chat, no tools, cheapest
| Command | What it does |
|---|---|
vaaya | Chat with any model, with your full Vaaya toolset available to it |
vaaya "question" | Ask once and exit (reads piped stdin too) |
vaaya llm | Plain chat, no tools. vaaya llm serve runs an OpenAI-compatible proxy for coding agents |
vaaya install | Configure the MCP server for every detected agent (idempotent — re-run to update) |
vaaya status | Connection state + live tool count |
vaaya consult "…" | Ask Vaaya how it would do something — returns the plan without running it |
vaaya reauthorize | Re-run the browser authorization flow |
vaaya logout | Disconnect and delete local credentials |
vaaya serve | Run the stdio MCP server (what agents invoke) |
Try it from the terminal:
npx vaaya-cli consult "turn this screen recording into a narrated product demo"
npx vaaya-cli status
Clients that speak HTTP MCP natively can skip the CLI entirely and add the
remote server: https://vaaya.ai/mcp (Streamable HTTP, OAuth 2.1). The stdio
form is npx -y @vaaya/mcp.
MIT © Vaaya
FAQs
Vaaya CLI — LLMs and paid agent superpowers from one wallet, no API keys. Type `vaaya` for a terminal chat with any of 300+ models (Kimi, GPT, Gemini, Claude) that can search, scrape, generate media and enrich leads mid-answer; `vaaya install` sets up the
We found that vaaya-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.