sdkck
Health Uyari
- License — License: Apache-2.0
- Description — Repository has a description
- Active repo — Last push 0 days ago
- Low visibility — Only 5 GitHub stars
Code Uyari
- process.env — Environment variable access in bin/dev.js
Permissions Gecti
- Permissions — No dangerous permissions requested
This is an agentic CLI framework built in TypeScript that provides an MCP interface for AI agents to dynamically generate and execute commands from OpenAPI specs, and interact with external services via official plugins (like Jira, Bitbucket, databases, and Sentry).
Security Assessment
Overall Risk: Medium. The tool inherently acts as a bridge to execute network requests and interact with external infrastructure. The codebase uses `process.env` to read credentials (expected for storing API keys), and does not contain hardcoded secrets. However, it does require configuring sensitive authentication tokens (e.g., bearer tokens, database credentials) to function. The plugin ecosystem introduces additional supply chain vectors, as users can install third-party oclif packages.
Quality Assessment
The project is licensed under the permissive and standard Apache-2.0. It appears to be actively maintained, with repository activity happening as recently as today. However, it suffers from extremely low visibility. With only 5 GitHub stars and a generic description, the tool lacks community vetting. Developers should be aware that low adoption means bugs or security vulnerabilities might go unnoticed by the broader community.
Verdict
Use with caution: The tool is actively maintained and avoids hardcoded secrets, but its low community adoption and privileged access to external databases and APIs warrant a thorough security review before integrating it into your environment.
Agentic CLI that provides multiple tools via plugins
____ _ _ _ _ _
/ ___|(_) __| | ___| | _(_) ___| | __
\___ \| |/ _` |/ _ \ |/ / |/ __| |/ /
___) | | (_| | __/ <| | (__| <
|____/|_|\__,_|\___|_|\_\_|\___|_|\_\
Sidekick (sdkck)
The Best Companion Tool for AI Agents
One CLI to search, connect, and command every tool in your stack. Zero context window bloat. Maximum productivity.
Key Features
Instant Commands from OpenAPI/Postman
Point Sidekick at any OpenAPI/Swagger spec or Postman collection — local file or URL — and every endpoint becomes a CLI command instantly.
# Import an OpenAPI spec from a URL or local file sdkck openapi import https://petstore3.swagger.io/api/v3/openapi.json --name petstore # Import a Postman collection the same way sdkck openapi import ./postman_collection.json --name myapi # Every operation is now a real command sdkck petstore listPets sdkck petstore getPetById --param petId=42 sdkck petstore createPet --body name=Fido --body tag=dog # Searchable like any built-in command sdkck search "list pets"Auth is built in — configure bearer tokens, API keys, or basic auth once and every generated command uses it automatically:
sdkck openapi auth petstore --type bearer --token sk-... sdkck openapi auth myapi --type apikey --api-key mykey --api-key-header X-API-Key
Semantic Search
- Find the right command instantly with fuzzy algorithem or AI-powered. Your agent runs
sdkck search "create a jira ticket"and gets exactly what it needs. No browsing tool catalogs.
Plugins
Official plugins install automatically on first use. No upfront configuration, no bloated installs.
Plugin What It Does @hesed/jiraCreate, search, and manage Jira issues @hesed/bbBitbucket pull requests, repos, and pipelines @hesed/sentryError tracking and issue management @hesed/mysqlQuery and manage MySQL databases @hesed/psqlQuery and manage PostgreSQL databases @hesed/supabaseSupabase project and database operations @hesed/conniConfluence page management Build your own plugin. Sidekick is built on oclif, so any oclif plugin works as a Sidekick plugin. Create a package that exports oclif commands and install it with:
# Install any oclif-compatible plugin directly sdkck plugins install my-custom-plugin # Or from a GitHub repo sdkck plugins install myorg/my-custom-plugin
Permission System
- Fine-grained control over which commands plugins can execute. Allow, disallow, import, and export permission rules. Perfect for enterprise environments and shared agent setups.
Why Sidekick?
AI agents waste most of their context window loading tool schemas they'll never use.
Sidekick flips this. Zero tools loaded upfront. Your agent searches for what it needs
on demand, gets back only the relevant commands, and executes them. The context window
stays clean for actual reasoning.
Quick Start
# Install globally
npm install -g sdkck
# Turn any OpenAPI spec into CLI commands instantly
sdkck openapi import https://petstore3.swagger.io/api/v3/openapi.json --name petstore
sdkck petstore listPets
# Search for commands
sdkck search "create issue"
# Use any integration — it auto-installs on first run
sdkck jira issue create --project MYPROJ --summary "Fix login bug"
# AI-powered search (set your API key for semantic matching)
export OPENAI_API_KEY=sk-...
sdkck search "find recent errors in production"
How AI Agents Use Sidekick
- Install as Claude Code plugin:
claude plugin marketplace add hesedcasa/sdkck
claude plugin install sidekick@sidekick
- Or simply add this instruction to your AGENT.md or CLAUDE.md file
Before any tool call run `sdkck commands | grep <keywords>` to find the available tools in sdkck, e.g.: `sdkck commands | grep -i "\|atlassian\|issue"`
- Sidekick is purpose-built for AI agent workflows. Here's what it looks like when Claude Code uses Sidekick:
Agent: I need to check recent Sentry errors and create a Jira ticket.
> sdkck search "sentry errors" # Discovers the right command
> sdkck sentry issues list --recent # Gets the data
> sdkck jira issue create ... # Acts on it
- Add Sidekick as MCP server:
{
"mcpServers": {
"sidekick": {
"command": "sdkck",
"args": ["mcp", "start"]
}
}
}
Permissions for Safe Agent Usage
Lock down what your agent can and can't do:
# Allow only Jira read commands sdkck permission allow "jira issue list" sdkck permission allow "jira issue view" sdkck permission disallow "jira *" # Export your permission config for team sharing sdkck permission export permissions.json # View current rules sdkck permission list
Roadmap
- Subjected to changes overtime
Agent Workflow Recipes
- Pre-built command chains for common agent workflows (triage Sentry errors to Jira, sync Confluence docs with code changes, automated PR reviews with database checks).
Output Piping & Chaining
- Pipe the output of one command directly into another. Run
sdkck sentry issues list | sdkck jira issue createand let Sidekick wire up the data transformation automatically, so agents can build multi-step workflows from single-purpose commands.
Command History & Replay
- Record every command an agent runs, with inputs, outputs, and timing. Replay any past command or sequence, diff outputs between runs, and audit exactly what your agent did and when.
Rate Limiting & Quota Guards
- Declare per-command or per-API rate limits and let Sidekick enforce them before a request is sent. Prevents agents from accidentally hammering external APIs or blowing through paid-tier quotas.
Response Caching
- Cache the results of read-only commands for a configurable TTL. Agents that search the same Jira project or call the same OpenAPI endpoint repeatedly get instant responses without hitting the network.
Usage
$ npm install -g sdkck
$ sdkck COMMAND
running command...
$ sdkck (--version)
sdkck/0.17.0 linux-x64 node-v20.20.2
$ sdkck --help [COMMAND]
USAGE
$ sdkck COMMAND
...
Commands
sdkck api auth NAMEsdkck api call NAME OPERATIONIDsdkck api config NAMEsdkck api import SOURCEsdkck api list [NAME]sdkck api remove NAMEsdkck commandssdkck help [COMMAND]sdkck mcp startsdkck permission allow PATTERNsdkck permission disallow PATTERNsdkck permission export FILEsdkck permission import FILEsdkck permission listsdkck permission resetsdkck pluginssdkck plugins add PLUGINsdkck plugins:inspect PLUGIN...sdkck plugins install PLUGINsdkck plugins link PATHsdkck plugins remove [PLUGIN]sdkck plugins resetsdkck plugins uninstall [PLUGIN]sdkck plugins unlink [PLUGIN]sdkck plugins updatesdkck search QUERYsdkck update [CHANNEL]sdkck version
sdkck api auth NAME
Update the authentication settings for an imported API spec
USAGE
$ sdkck api auth NAME [--api-key <value>] [--api-key-header <value>] [--header <value>...] [--password
<value>] [--show] [--token <value>] [--type none|bearer|apikey|basic|custom] [--username <value>]
ARGUMENTS
NAME API name to update authentication for
FLAGS
--api-key=<value> API key value (used with --type apikey)
--api-key-header=<value> [default: X-API-Key] Header name for the API key
--header=<value>... Custom header in Key=Value format (used with --type custom, repeatable)
--password=<value> Password for basic auth
--show Show the current authentication settings (tokens are redacted)
--token=<value> Bearer token
--type=<option> Authentication type to configure
<options: none|bearer|apikey|basic|custom>
--username=<value> Username for basic auth
DESCRIPTION
Update the authentication settings for an imported API spec
EXAMPLES
$ sdkck api auth petstore --type bearer --token sk-...
$ sdkck api auth petstore --type apikey --api-key mykey
$ sdkck api auth petstore --type apikey --api-key mykey --api-key-header Authorization
$ sdkck api auth petstore --type basic --username user --password secret
$ sdkck api auth petstore --type custom --header X-Tenant-ID=acme --header X-App-Key=secret
$ sdkck api auth petstore --type none
$ sdkck api auth petstore --show
See code: src/commands/api/auth.ts
sdkck api call NAME OPERATIONID
Call an imported API operation
USAGE
$ sdkck api call NAME OPERATIONID [--base-url <value>] [--body <value>...] [--header <value>...] [--param
<value>...] [--raw]
ARGUMENTS
NAME API name (as shown in `api list`)
OPERATIONID Operation ID to call (as shown in `api list <name>`)
FLAGS
--base-url=<value> Override the base URL for this request
--body=<value>... Request body field as key=value (repeatable)
--header=<value>... Extra request header as Key=Value (repeatable)
--param=<value>... Path or query parameter as key=value (repeatable)
--raw Print the raw response body without JSON formatting
DESCRIPTION
Call an imported API operation
EXAMPLES
$ sdkck api call petstore listPets
$ sdkck api call petstore getPetById --param petId=42
$ sdkck api call petstore createPet --body name=Fido --body tag=dog
$ sdkck api call petstore listPets --query limit=10 --header X-Trace=abc
See code: src/commands/api/call.ts
sdkck api config NAME
Update configuration for an imported API spec
USAGE
$ sdkck api config NAME [--base-url <value>] [--description <value>] [--insecure] [--rename <value>] [--title
<value>]
ARGUMENTS
NAME API name (as shown in `api list`)
FLAGS
--base-url=<value> New base URL for API calls
--description=<value> New description for the spec
--[no-]insecure Skip TLS certificate verification (--no-insecure to disable)
--rename=<value> New short identifier for this API
--title=<value> New display title for the spec
DESCRIPTION
Update configuration for an imported API spec
EXAMPLES
$ sdkck api config petstore --base-url https://api.example.com
$ sdkck api config petstore --rename mystore
$ sdkck api config petstore --title "My Petstore" --description "A pet store API"
See code: src/commands/api/config.ts
sdkck api import SOURCE
Import an OpenAPI spec, Postman collection, or GraphQL schema (SDL/introspection/endpoint) and register its operations as commands
USAGE
$ sdkck api import SOURCE [--api-key <value>] [--api-key-header <value>] [--auth-type
none|bearer|apikey|basic] [--base-url <value>] [--graphql] [--insecure] [--name <value>] [--password <value>]
[--selection-depth <value>] [--token <value>] [--username <value>]
ARGUMENTS
SOURCE Path to a local OpenAPI/Postman/GraphQL spec or URL (REST or GraphQL endpoint)
FLAGS
--api-key=<value> API key value (used with --auth-type apikey)
--api-key-header=<value> [default: X-API-Key] Header name for the API key
--auth-type=<option> Authentication type
<options: none|bearer|apikey|basic>
--base-url=<value> Override the base URL for API calls (GraphQL endpoint URL for GraphQL imports)
--graphql Treat the source as a GraphQL schema (SDL, introspection JSON, or live endpoint)
--insecure Skip TLS certificate verification (useful for self-signed certs)
--name=<value> Short identifier for this API (defaults to the spec title slug)
--password=<value> Password for basic auth
--selection-depth=<value> [default: 3] Max depth of auto-generated GraphQL selection sets (GraphQL imports only)
--token=<value> Bearer token (used with --auth-type bearer)
--username=<value> Username for basic auth
DESCRIPTION
Import an OpenAPI spec, Postman collection, or GraphQL schema (SDL/introspection/endpoint) and register its operations
as commands
EXAMPLES
$ sdkck api import ./petstore.json --name petstore
$ sdkck api import ./postman_collection.json --name myapi
$ sdkck api import https://petstore3.swagger.io/api/v3/openapi.json
$ sdkck api import ./schema.graphql --base-url https://api.example.com/graphql
$ sdkck api import https://api.example.com/graphql --name github
$ sdkck api import ./api.yaml --auth-type bearer --token sk-...
$ sdkck api import ./api.yaml --auth-type apikey --api-key mykey --api-key-header X-API-Key
$ sdkck api import ./api.yaml --auth-type basic --username user --password pass
See code: src/commands/api/import.ts
sdkck api list [NAME]
List imported API specs and their available operations
USAGE
$ sdkck api list [NAME]
ARGUMENTS
[NAME] API name to list operations for (omit to list all imported APIs)
DESCRIPTION
List imported API specs and their available operations
EXAMPLES
$ sdkck api list
$ sdkck api list petstore
See code: src/commands/api/list.ts
sdkck api remove NAME
Remove an imported API spec
USAGE
$ sdkck api remove NAME
ARGUMENTS
NAME API name to remove
DESCRIPTION
Remove an imported API spec
EXAMPLES
$ sdkck api remove petstore
See code: src/commands/api/remove.ts
sdkck commands
List all sdkck commands.
USAGE
$ sdkck commands [--json] [-c id|plugin|summary|type... | --tree] [--deprecated] [-x | ] [--hidden]
[--no-truncate | ] [--sort id|plugin|summary|type | ]
FLAGS
-c, --columns=<option>... Only show provided columns (comma-separated).
<options: id|plugin|summary|type>
-x, --extended Show extra columns.
--deprecated Show deprecated commands.
--hidden Show hidden commands.
--no-truncate Do not truncate output.
--sort=<option> [default: id] Property to sort by.
<options: id|plugin|summary|type>
--tree Show tree of commands.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
List all sdkck commands.
See code: @oclif/plugin-commands
sdkck help [COMMAND]
Display help for sdkck.
USAGE
$ sdkck help [COMMAND...] [-n]
ARGUMENTS
[COMMAND...] Command to show help for.
FLAGS
-n, --nested-commands Include all nested commands in the output.
DESCRIPTION
Display help for sdkck.
See code: @oclif/plugin-help
sdkck mcp start
Start an MCP server over stdio, exposing all CLI commands as tools
USAGE
$ sdkck mcp start
DESCRIPTION
Start an MCP server over stdio, exposing all CLI commands as tools
EXAMPLES
$ sdkck mcp start
See code: src/commands/mcp/start.ts
sdkck permission allow PATTERN
Allow a command pattern in the plugin command permission list
USAGE
$ sdkck permission allow PATTERN
ARGUMENTS
PATTERN Command pattern to allow. Use a full command ID ("jira issue create"), a topic ("jira"), a topic wildcard
("jira *"), or "*" for everything.
DESCRIPTION
Allow a command pattern in the plugin command permission list
EXAMPLES
$ sdkck permission allow "*"
$ sdkck permission allow jira
$ sdkck permission allow "jira *"
$ sdkck permission allow "jira issue create"
See code: src/commands/permission/allow.ts
sdkck permission disallow PATTERN
Disallow a command pattern in the plugin command permission list
USAGE
$ sdkck permission disallow PATTERN
ARGUMENTS
PATTERN Command pattern to disallow. Use a full command ID ("jira issue create"), a topic ("jira"), a topic wildcard
("jira *"), or "*" for everything.
DESCRIPTION
Disallow a command pattern in the plugin command permission list
EXAMPLES
$ sdkck permission disallow "*"
$ sdkck permission disallow jira
$ sdkck permission disallow "jira *"
$ sdkck permission disallow "jira issue create"
See code: src/commands/permission/disallow.ts
sdkck permission export FILE
Export the plugin command permission configuration to a JSON file
USAGE
$ sdkck permission export FILE
ARGUMENTS
FILE Path to the JSON file to export the permission configuration to
DESCRIPTION
Export the plugin command permission configuration to a JSON file
EXAMPLES
$ sdkck permission export permission.json
See code: src/commands/permission/export.ts
sdkck permission import FILE
Import the plugin command permission configuration from a JSON file
USAGE
$ sdkck permission import FILE
ARGUMENTS
FILE Path to the JSON file to import the permission configuration from
DESCRIPTION
Import the plugin command permission configuration from a JSON file
EXAMPLES
$ sdkck permission import permission.json
See code: src/commands/permission/import.ts
sdkck permission list
List all rules in the plugin command permission list
USAGE
$ sdkck permission list
DESCRIPTION
List all rules in the plugin command permission list
EXAMPLES
$ sdkck permission list
See code: src/commands/permission/list.ts
sdkck permission reset
Reset all plugin command permission rules
USAGE
$ sdkck permission reset [--confirm]
FLAGS
--confirm Skip the confirmation prompt
DESCRIPTION
Reset all plugin command permission rules
EXAMPLES
$ sdkck permission reset
$ sdkck permission reset --confirm
See code: src/commands/permission/reset.ts
sdkck plugins
List installed plugins.
USAGE
$ sdkck plugins [--json] [--core]
FLAGS
--core Show core plugins.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
List installed plugins.
EXAMPLES
$ sdkck plugins
See code: @oclif/plugin-plugins
sdkck plugins add PLUGIN
Installs a plugin into sdkck.
USAGE
$ sdkck plugins add PLUGIN... [--json] [-f] [-h] [-s | -v]
ARGUMENTS
PLUGIN... Plugin to install.
FLAGS
-f, --force Force npm to fetch remote resources even if a local copy exists on disk.
-h, --help Show CLI help.
-s, --silent Silences npm output.
-v, --verbose Show verbose npm output.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Installs a plugin into sdkck.
Uses npm to install plugins.
Installation of a user-installed plugin will override a core plugin.
Use the SDKCK_NPM_LOG_LEVEL environment variable to set the npm loglevel.
Use the SDKCK_NPM_REGISTRY environment variable to set the npm registry.
ALIASES
$ sdkck plugins add
EXAMPLES
Install a plugin from npm registry.
$ sdkck plugins add myplugin
Install a plugin from a github url.
$ sdkck plugins add https://github.com/someuser/someplugin
Install a plugin from a github slug.
$ sdkck plugins add someuser/someplugin
sdkck plugins:inspect PLUGIN...
Displays installation properties of a plugin.
USAGE
$ sdkck plugins inspect PLUGIN...
ARGUMENTS
PLUGIN... [default: .] Plugin to inspect.
FLAGS
-h, --help Show CLI help.
-v, --verbose
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Displays installation properties of a plugin.
EXAMPLES
$ sdkck plugins inspect myplugin
See code: @oclif/plugin-plugins
sdkck plugins install PLUGIN
Installs a plugin into sdkck.
USAGE
$ sdkck plugins install PLUGIN... [--json] [-f] [-h] [-s | -v]
ARGUMENTS
PLUGIN... Plugin to install.
FLAGS
-f, --force Force npm to fetch remote resources even if a local copy exists on disk.
-h, --help Show CLI help.
-s, --silent Silences npm output.
-v, --verbose Show verbose npm output.
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Installs a plugin into sdkck.
Uses npm to install plugins.
Installation of a user-installed plugin will override a core plugin.
Use the SDKCK_NPM_LOG_LEVEL environment variable to set the npm loglevel.
Use the SDKCK_NPM_REGISTRY environment variable to set the npm registry.
ALIASES
$ sdkck plugins add
EXAMPLES
Install a plugin from npm registry.
$ sdkck plugins install myplugin
Install a plugin from a github url.
$ sdkck plugins install https://github.com/someuser/someplugin
Install a plugin from a github slug.
$ sdkck plugins install someuser/someplugin
See code: @oclif/plugin-plugins
sdkck plugins link PATH
Links a plugin into the CLI for development.
USAGE
$ sdkck plugins link PATH [-h] [--install] [-v]
ARGUMENTS
PATH [default: .] path to plugin
FLAGS
-h, --help Show CLI help.
-v, --verbose
--[no-]install Install dependencies after linking the plugin.
DESCRIPTION
Links a plugin into the CLI for development.
Installation of a linked plugin will override a user-installed or core plugin.
e.g. If you have a user-installed or core plugin that has a 'hello' command, installing a linked plugin with a 'hello'
command will override the user-installed or core plugin implementation. This is useful for development work.
EXAMPLES
$ sdkck plugins link myplugin
See code: @oclif/plugin-plugins
sdkck plugins remove [PLUGIN]
Removes a plugin from the CLI.
USAGE
$ sdkck plugins remove [PLUGIN...] [-h] [-v]
ARGUMENTS
[PLUGIN...] plugin to uninstall
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Removes a plugin from the CLI.
ALIASES
$ sdkck plugins unlink
$ sdkck plugins remove
EXAMPLES
$ sdkck plugins remove myplugin
sdkck plugins reset
Remove all user-installed and linked plugins.
USAGE
$ sdkck plugins reset [--hard] [--reinstall]
FLAGS
--hard Delete node_modules and package manager related files in addition to uninstalling plugins.
--reinstall Reinstall all plugins after uninstalling.
See code: @oclif/plugin-plugins
sdkck plugins uninstall [PLUGIN]
Removes a plugin from the CLI.
USAGE
$ sdkck plugins uninstall [PLUGIN...] [-h] [-v]
ARGUMENTS
[PLUGIN...] plugin to uninstall
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Removes a plugin from the CLI.
ALIASES
$ sdkck plugins unlink
$ sdkck plugins remove
EXAMPLES
$ sdkck plugins uninstall myplugin
See code: @oclif/plugin-plugins
sdkck plugins unlink [PLUGIN]
Removes a plugin from the CLI.
USAGE
$ sdkck plugins unlink [PLUGIN...] [-h] [-v]
ARGUMENTS
[PLUGIN...] plugin to uninstall
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Removes a plugin from the CLI.
ALIASES
$ sdkck plugins unlink
$ sdkck plugins remove
EXAMPLES
$ sdkck plugins unlink myplugin
sdkck plugins update
Update installed plugins.
USAGE
$ sdkck plugins update [-h] [-v]
FLAGS
-h, --help Show CLI help.
-v, --verbose
DESCRIPTION
Update installed plugins.
See code: @oclif/plugin-plugins
sdkck search QUERY
Search for available commands
USAGE
$ sdkck search QUERY [--json] [-d] [-n <value>]
ARGUMENTS
QUERY Search term to filter commands by
FLAGS
-d, --details Show full help for each matched command
-n, --limit=<value> [default: 5] Maximum number of results to return
GLOBAL FLAGS
--json Format output as json.
DESCRIPTION
Search for available commands
EXAMPLES
$ sdkck search "create pr"
$ sdkck search jira -d
$ sdkck search "update jira" --details
See code: src/commands/search.ts
sdkck update [CHANNEL]
update the sdkck CLI
USAGE
$ sdkck update [CHANNEL] [--force | | [-a | -v <value> | -i]] [-b ]
FLAGS
-a, --available See available versions.
-b, --verbose Show more details about the available versions.
-i, --interactive Interactively select version to install. This is ignored if a channel is provided.
-v, --version=<value> Install a specific version.
--force Force a re-download of the requested version.
DESCRIPTION
update the sdkck CLI
EXAMPLES
Update to the stable channel:
$ sdkck update stable
Update to a specific version:
$ sdkck update --version 1.0.0
Interactively select version:
$ sdkck update --interactive
See available versions:
$ sdkck update --available
See code: @oclif/plugin-update
sdkck version
USAGE
$ sdkck version [--json] [--verbose]
FLAGS
--verbose Show additional information about the CLI.
GLOBAL FLAGS
--json Format output as json.
FLAG DESCRIPTIONS
--verbose Show additional information about the CLI.
Additionally shows the architecture, node version, operating system, and versions of plugins that the CLI is using.
See code: @oclif/plugin-version
Yorumlar (0)
Yorum birakmak icin giris yap.
Yorum birakSonuc bulunamadi