by Kong
🌋 Build AI agents that seamlessly combine LLM reasoning with real-world actions via MCP tools — in just a few lines of TypeScript.
# Add to your Claude Code skills
git clone https://github.com/Kong/volcano-agent-sdkGuides for using ai agents skills like volcano-agent-sdk.
Last scanned: 5/23/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@aws-sdk/client-bedrock-runtime: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/client-cognito-identity: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/client-sso: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/core: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/credential-provider-cognito-identity: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/credential-provider-env: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/credential-provider-http: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/credential-provider-ini: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/credential-provider-node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/credential-provider-process: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/credential-provider-sso: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/credential-provider-web-identity: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/credential-providers: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/middleware-user-agent: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/nested-clients: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/token-providers: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/util-user-agent-node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/xml-builder: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@azure/identity: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@azure/msal-node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@isaacs/brace-expansion: @isaacs/brace-expansion has Uncontrolled Resource Consumption",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/sdk-node: Prometheus exporter process crash via malformed HTTP request",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities Bug",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
"severity": "high"
},
{
"type": "npm-audit",
"message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "jws: auth0/node-jws Improperly Verifies HMAC Signature",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
}
],
"status": "FAILED",
"scannedAt": "2026-05-23T06:35:08.777Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
The TypeScript SDK for Multi-Provider AI Agents
Build agents that chain LLM reasoning with MCP tools. Mix OpenAI, Claude, Mistral in one workflow. Parallel execution, branching, loops. Native retries, streaming, and typed errors.
📚 Read the full documentation at volcano.dev →
LLM automatically picks which MCP tools to call based on your prompt. No manual routing needed.
Define specialized agents and let the coordinator autonomously delegate tasks. Like automatic tool selection, but for agents.
Ask questions about what your agent did. Use .summary() or .ask() instead of parsing JSON.
OpenAI, Anthropic, Mistral, Bedrock, Vertex, Azure. Switch providers per-step or globally.
Parallel execution, branching, loops, sub-agent composition. Enterprise-grade workflow control.
Stream tokens in real-time as LLMs generate them. Perfect for chat UIs and SSE endpoints.
Full type safety with IntelliSense. Catch errors before runtime.
OpenTelemetry traces and metrics. Export to Jaeger, Prometheus, DataDog, or any OTLP backend.
Built-in retries, timeouts, error handling, and connection pooling. Battle-tested at scale.
npm install @volcano.dev/agent
That's it! Includes MCP support and all common LLM providers (OpenAI, Anthropic, Mistral, Llama, Vertex).
import { agent, llmOpenAI, mcp } from "@volcano.dev/agent";
const llm = llmOpenAI({
apiKey: process.env.OPENAI_API_KEY!,
model: "gpt-4o-mini"
});
const weather = mcp("http://localhost:8001/mcp");
const tasks = mcp("http://localhost:8002/mcp");
// Agent automatically picks the right tools
const results = await agent({ llm })
.then({
prompt: "What's the weather in Seattle? If it will rain, create a task to bring an umbrella",
mcps: [weather, tasks] // LLM chooses which tools to call
})
.run();
// Ask questions about what happened
const summary = await results.summary(llm);
console.log(summary);
import { agent, llmOpenAI } from "@volcano.dev/agent";
const llm = llmOpenAI({ apiKey: process.env.OPENAI_API_KEY! });
// Define specialized agents
const researcher = agent({ llm, name: 'researcher', description: 'Finds facts and data' })
.then({ prompt: "Research the topic." })
.then({ prompt: "Summarize the research." });
const writer = agent({ llm, name: 'writer', description: 'Creates content' })
.then({ prompt: "Write content." });
// Coordinator autonomously delegates to specialists
const results = await agent({ llm })
.then({
prompt: "Write a blog post about quantum computing",
agents: [researcher, writer] // Coordinator decides when done
})
.run();
// Ask what happened
const post = await results.ask(llm, "Show me the final blog post");
console.log(post);
We welcome contributions! Please see our Contributing Guide for details.
Apache 2.0 - see LICENSE file for details.