Developers · npm SDK + CLI

One-line AgentSmack from Node, Bun, or your CI pipeline.

npm install @agentsmack/sdk ships the typed client + npx agentsmack CLI in one package. Submit an agent, poll for completion, fail the build on triggered probes, and verify signed governance packs offline — without ever leaving your terminal.

Install

# npm

npm install @agentsmack/sdk

# pnpm

pnpm add @agentsmack/sdk

# yarn

yarn add @agentsmack/sdk

Node 18+. Works in Bun, Deno (with a fetch shim), and edge runtimes that expose a global fetch.

What it gives you

  • AgentSmack class

    Wraps POST /api/submissions + GET /api/submissions/[slug] with typed errors, header injection, and polling.

  • Three submission modes

    Structured paste, raw text (any of JSON/YAML/Markdown), or a public URL — pick the one that matches your pipeline.

  • Offline pack verification

    Zero-network Ed25519 + content-address re-derivation. Verify a signed governance pack without ever calling AgentSmack.

  • CI/CD friendly

    `npx agentsmack analyze --wait --fail-on critical` returns non-zero so your pipeline fails the build on triggered probes.

  • Deterministic

    Polling accepts an injectable sleep. Same input + same fetch mock → same call sequence. Pin the SDK in your replay tests.

  • Stand-alone CLI

    `npx agentsmack` works without a global install. Reads from a file, stdin (`-`), or any pipeline.

SDK quickstart

import { AgentSmack } from "@agentsmack/sdk";

const agentsmack = new AgentSmack({
  apiKey: process.env.AGENTSMACK_API_KEY, // optional for anonymous
});

const result = await agentsmack.analyze({
  systemPrompt: "You are a helpful assistant.",
  toolList: [{ name: "search_web", description: "Search the web" }],
  model: "gpt-4o",
});

console.log(result.publicReportUrl);

// Block until honeypot + underground probes finish:
const final = await agentsmack.waitForCompletion({
  slug: result.publicSlug,
});

console.log(final.probes);
// { honeypot: { total: 15, triggered: 1, blocked: 14 }, underground: {...} }

Offline pack verification

Every paid-tier submission produces a signed governance pack (content-addressed packId + Ed25519 signature). The SDK verifies it offline — no network call, no AgentSmack dependency at runtime.

import { AgentSmack } from "@agentsmack/sdk";
import fs from "node:fs";

const verdict = AgentSmack.verifyPack({
  packJson: fs.readFileSync("./pack.json", "utf8"),
  signatureHex: fs.readFileSync("./pack.sig", "utf8").trim(),
  publicKeyHex: fs.readFileSync("./workspace.pub", "utf8").trim(),
});

if (!verdict.valid) {
  throw new Error(`AgentSmack pack invalid: ${verdict.reason}`);
}

console.log(verdict.packId, verdict.bundleDigest);

CLI

Same package, same auth flow. npx agentsmack works without a global install — perfect for shell scripts, Makefiles, and CI/CD steps.

Login

npx agentsmack login --api-key "$AGENTSMACK_API_KEY"

Analyze a local file

npx agentsmack analyze ./agent.json

CI/CD — fail the build

npx agentsmack analyze ./agent.json \
  --wait --fail-on critical

Read from stdin

cat .cursorrules | npx agentsmack analyze -

Verify a downloaded governance pack

npx agentsmack verify ./pack.json \
  --signature-file ./pack.sig \
  --public-key-file ./workspace.pub

Next

  • /developers/mcp — register AgentSmack as an MCP server in Claude Desktop / Cursor.
  • /pricing — Pro-tier features include signed governance packs and the full honeypot battery.
  • /samples — see what AgentSmack returns for common agent templates.