@silverprotocol/typescript-sdkCAUTION
TypeScript SDK for AgJSON — the normalized wire format for agent framework I/O
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@silverprotocol/core) [](https://www.npmjs.com/package/@silverprotocol/claude-agent-sdk) [](https://www.npmjs.com/package/@silverprotocol/openai-agents) [](https://www.npmjs.com/package/@silverprotocol/google-adk) [](https://www.npmjs.com/package/@silverprotocol/vercel-ai) [](https://www.npmjs.com/package/@silverprotocol/richtext) [](./LICENSE)
The TypeScript SDK for AgJSON — the open, typed transport for normalized agent-framework I/O, unopinionated about storage and rendering. Open source (MIT).
Install
npm install @silverprotocol/core @silverprotocol/claude-agent-sdk # or openai-agents / google-adk for other frameworks
Requires Node.js 22.12 or later. The packages are ES modules: import them, or require() them from CommonJS, which Node supports for ES modules from 22.12 on.
Packages
- `@silverprotocol/core` — the AgJSON types (
AgInput,AgEvent,
AgMessage, AgReduceResult), the stateful-per-invoke Normalizer interface (push(native): AgEvent[] / flush(): AgEvent[]), and the normative Reducer and reduce() (stream → object graph).
- `@silverprotocol/` — per-framework normalizers
(claude-agent-sdk, openai-agents, google-adk, ...) that translate each framework's native e
e001ebdf3776OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add vercel-ai --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GOOGLE_API_KEY=${GOOGLE_API_KEY} -- npx -y @silverprotocol/[email protected]{
"mcpServers": {
"vercel-ai": {
"command": "npx",
"args": [
"-y",
"@silverprotocol/[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"GOOGLE_API_KEY": "${GOOGLE_API_KEY}"
}
}
}
}Exposed tools (12)
10 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
a.md | read | The doc. |
calc | read | adds |
conformance-probe-resource-link.md | read | A document the find_doc tool links to instead of inlining. |
delete_file | destructive | Delete a file. |
doc | read | a doc |
echo | read | Echo a message. |
lookup | read | Look up the weather for a city. |
read_mail | read | Read mail. |
report | read | the report |
report.pdf | read | Rendered from the spreadsheet |
save | write | Save a note. |
search | read | web search |
Trust audit
CAUTIONgrade C · trust 71/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (21)
const BAD: Toy = { t: "boom-after-open", id: "M2", turn: "T", secret: "SECRET_native_marker" };profile: { name: "ok", vault: [{ note: "x" }, { authType: "apiKey", apiKey: "SECRET_nested_api_key" }] },{ auth_type: "apiKey", api_key: "SECRET_fake_api_key_snake" },exchangedAuthCredential: { authType: "apiKey", apiKey: "SECRET_exchanged_reply" },const untypedReply: { [k: string]: JsonValue } = { token: "SECRET_untyped_reply" };delete_file
const corpusDir = fileURLToPath(new URL("../../e2e/corpus/", import.meta.url));readFileSync(fileURLToPath(new URL("../../e2e/corpus/multi-result-sonnet5/claude.native.json", import.meta.url)), "utf8"),"reduce.test.ts": "../../core/src/reduce.test.ts",
"agjson.test.ts": "../../core/src/agjson.test.ts",
"claude-agent-sdk/src/index.test.ts": "../../claude-agent-sdk/src/index.test.ts",
const url = `http://127.0.0.1:${port}/mcp`;"thoughtSignature": "EsgNCsUNAWkUfRMT+BEkTifybvB/LLARWd800SNRr4VE1m919LxT/CmtaABRG1CicZeAB+kAclMuwlR7RmrmV5E2FhZ1cPthbxxzgYHmMxDXt0p/525pONWduaf41CxHYD4pu6wjtAePaSlvvuPDkYK/0bt8hNGBBMg3Esevnc64H/scTa4
"thoughtSignature": "EsgNCsUNAWkUfRMT+BEkTifybvB/LLARWd800SNRr4VE1m919LxT/CmtaABRG1CicZeAB+kAclMuwlR7RmrmV5E2FhZ1cPthbxxzgYHmMxDXt0p/525pONWduaf41CxHYD4pu6wjtAePaSlvvuPDkYK/0bt8hNGBBMg3Esevnc64H/scTa4
"thoughtSignature": "EsgNCsUNAWkUfRMT+BEkTifybvB/LLARWd800SNRr4VE1m919LxT/CmtaABRG1CicZeAB+kAclMuwlR7RmrmV5E2FhZ1cPthbxxzgYHmMxDXt0p/525pONWduaf41CxHYD4pu6wjtAePaSlvvuPDkYK/0bt8hNGBBMg3Esevnc64H/scTa4
@types/node, typescript, vitest
@anthropic-ai/claude-agent-sdk, @anthropic-ai/sdk
zod
@modelcontextprotocol/sdk, @types/node, typescript, vitest, zod
`AgRunConfig.pushNotification {url, token?, auth?}` instructs an agent host to POST to a client-supplied URL bearing client-supplied credentials — the classic SSRF + credential-exfiltration shape (inh(a) Authentication requests. A normalizer MUST NOT emit credential material at any depth in any event it emits for an ADK authentication request — the `hitl.ask` and its `metadata`, the arguments and
Gates applied: no_behavioural_pass.
e001ebdf3776full audit observations/trust-audit/mcp-server/silverprotocol__typescript-sdk.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | e001ebdf3776 | CAUTION | C | 71 | first audit |
Questions
What is the @silverprotocol/core MCP server?
TypeScript SDK for AgJSON — the normalized wire format for agent framework I/O
What tools does @silverprotocol/core expose?
12 in total: 10 read-only, 1 that write, and 1 that can delete or overwrite (delete_file). Every one is listed on this page with its risk.
Is @silverprotocol/core safe to connect to an agent?
With care. The audit graded it C (71/100) and found 21 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @silverprotocol/core need?
It reads ANTHROPIC_API_KEY and GOOGLE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @silverprotocol/core run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @silverprotocol/vercel-ai at 0.12.0.
How current is this page?
The grade is for one exact copy of the source (e001ebdf3776), read on 2026-10-12. The repository is watched and re-audited when it changes.