example using graphql: https://api.github.com/graphql

[Cyr-Ch]

Summary by cubic

Adds a TypeScript example that calls GitHub’s GraphQL API via UTCP’s HTTP provider, plus an optional OpenAI-driven client for multi-step tool use. This makes it easy to model GraphQL operations as UTCP tools with .env-based auth.

• New Features

  • Example project under typescript/graphql_http_example with README and example.env.
  • graphql_manual.json defines github.graphql_query and github.search_repos (auth via GITHUB_TOKEN).
  • llm_client_openai.ts lets a model choose tools and run multi-step calls (repo search or custom queries).
  • start:llm script to run the client (requires OPENAI_API_KEY and GITHUB_TOKEN).

• Dependencies

  • Adds @utcp/sdk, openai, dotenv, ts-node (dev: typescript).

[cubic-dev-ai]

6 issues found across 7 files

Prompt for AI agents (all 6 issues)

Understand the root cause of the following 6 issues and fix them.


<file name="typescript/graphql_http_example/tsconfig.json">

<violation number="1" location="typescript/graphql_http_example/tsconfig.json:5">
Use NodeNext module resolution to match Node ESM; current &quot;Node&quot; can mis-resolve package exports and file extensions under ts-node/esm.</violation>
</file>

<file name="typescript/graphql_http_example/example.env">

<violation number="1" location="typescript/graphql_http_example/example.env:1">
Non-empty placeholder will pass the missing-env check and may trigger secret-scanner false positives. Leave it empty to force validation and avoid scanner noise.</violation>

<violation number="2" location="typescript/graphql_http_example/example.env:2">
Non-empty placeholder will pass the missing-env check and may trigger secret-scanner false positives. Leave it empty to force validation and avoid scanner noise.</violation>
</file>

<file name="typescript/graphql_http_example/llm_client_openai.ts">

<violation number="1" location="typescript/graphql_http_example/llm_client_openai.ts:10">
Avoid deep imports into package internals; use the package public entrypoint to reduce breakage risk.</violation>

<violation number="2" location="typescript/graphql_http_example/llm_client_openai.ts:21">
Serializing tools directly may expose provider headers (e.g., Authorization) to the LLM; redact or omit provider configuration before embedding in the prompt.</violation>

<violation number="3" location="typescript/graphql_http_example/llm_client_openai.ts:123">
Unbounded history growth can lead to increased memory usage; consider capping or summarizing history.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Ask questions if you need clarification on any suggestion

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[h3xxit]

Hey, thanks for the PR! Note that this is still using the 0.1 outdated typescript library. The v1.0 is still in progess now at https://github.com/universal-tool-calling-protocol/typescript-utcp-sdk. Once that one is done, I can ping you to update it to the 1.0.

Until then feel free to use the python one, which is at 1.0