One base_url. Then the operator takes the wheel.
Point your SDK at the gateway. Instead of you wiring routing, budgets, and guardrails by hand, the operator routes each call, caps the spend, runs the guardrails, and writes a chained receipt your own engineer can fold on their own machine. You ship. It operates — and proves every move.
Verify off our servers, not on them.
Instead of trusting a dashboard that says the operator behaved, you re-run the math. The command below folds the operator's receipt on your machine with one SHA-256 library and zero network calls to us. Here is the object the operator wrote — check it yourself.
The leaf recomputes from the receipt body to the published receipt_hash. If the operator's call changed by a byte, the hash won't match.
Each receipt's prev_hash is the operator's previous move. Tamper with any earlier action and the chain breaks.
The batch's Merkle root is written into a public-ledger transaction memo you can open and read yourself.
# fold a real receipt the operator wrote — on your own machine, no Agentics service needed npx @agentics/verify 8ae41ff9f6cd265ce08a312dacc24f89da2c634c18e0ed47a29a475ad5e70efb → recompute_leaf ok # leaf === receipt_hash → chain_ok ok # prev_hash walks back to genesis → fold_merkle ok # siblings fold to the batch root → anchor_memo ok # on-chain memo === merkle root ✓ verified — independently, against a ledger we don't control
# 1. pull the self-contained evidence bundle (only hashes + metering, no content) curl -sO https://agentics.you/trust/sample-receipt.json # 2. fold it with ~15 lines and a SHA-256 — see the six-line recipe in the docs node verify.mjs sample-receipt.json ✓ leaf, chain, merkle and anchor all match
Full, copy-paste recipe: the six-line verifier →
Anatomy of an operator move.
"Cryptographically anchored" stays abstract until you hold the thing the operator writes after every decision. Hover a field to see what it is and why it's load-bearing. Then flip the tamper switch — change one byte and watch the proof visibly break. This isn't a mock: it re-runs the same client-side fold.
Runs entirely in your browser. No call to Agentics.
receipt_id and batch_id are on the wire but excluded from the leaf — they're server-assigned after the hash is computed.Other tools assert. The operator proves.
Every other tool asserts what it did in a log you control. The operator can't act without writing a record you can't edit. Instead of a row anyone with write access could change, you get an object an auditor folds without trusting us.
A row in a log
You control this database. So could anyone with write access. To believe it, an auditor has to trust your dashboard — and you.
A move the operator can't unwrite
Recompute the leaf, fold the proof, byte-match the public anchor — yourself. Your auditor verifies it without us. Tamper-evident by construction.
One operator, your whole AI stack.
Instead of wiring five tools and staffing a team to run them, you swap one base_url and the operator runs the lot — across any model, from a frontier foundation model to a BYO endpoint, through one wire-compatible surface. Every move it makes writes the receipt you just verified. Nothing here is a black box: each surface writes to the same ledger, and you fold the proof yourself.
Model Catalog, Smart Routing, fallback and load-balance, with Response Cache in line.Signal Metrics — latency, cost and error per dispatch — are the operator's eyes, and each carries a receipt, so observability isn't a separate trust assumption.Guardrails and Tool Governance inline before each call ships, and Spend Guard hard-stops before the provider. Every verdict is receipted.Proof Ledger: a prev_hash-chained receipt, Merkle-batched and anchored — independently verifiable, exactly like the one above.Sovereign runs the operator in your VPC and moves zero data; Key Vault keeps provider secrets off-host with BYO-KMS. Hash-only egress by default.The operator runs live today and proves every move; Observe & Suggest are available now, and assisted and autonomous tiers turn on per tenant as you grant them — reversible in one click. Five surfaces ship today; the reputation network is the one roadmap preview above.
What happens to every request.
Your code calls the gateway
Instead of calling a provider directly, your app, service, or agent sends the request to the gateway — same payload, same SDK. Only the base_url changes.
The operator checks it against your rules
Before anything reaches a model, it applies your policies, budgets, and guardrails inline. If it breaks a rule, it's blocked — and the block itself is receipted.
It routes to the right model
The request goes to the model you chose, or the cheapest one that clears your quality bar. One endpoint reaches every major provider, with cache and fallback in line.
It writes a record you can verify
A tamper-evident prev_hash-chained receipt is returned in the x-agentics-receipt response header and anchored on a public ledger — checkable by anyone, no trust in us required.
Routing deep-dive: how the operator picks a model →
Change one base_url. Keep your SDK.
The gateway is wire-compatible with the SDK you already use. Instead of you orchestrating routing, guardrails, and budgets, you swap the base URL and the operator takes over each call — routes, guards, budgets, proves. The response carries its x-agentics-receipt header — the hash you just learned to verify.
Get your first receipt free.
Point one base_url at the gateway, make a call, and read the verifiable x-agentics-receipt — 100k governed calls/mo, free forever. Spend tracking, guardrail findings, and real receipts in minutes. Upgrade only when you want enforcement.
from openai import OpenAI # your existing SDK, unchanged from agentics import create_headers client = OpenAI( base_url="https://agentics.you/api/v1", # the only change api_key="ak_…", # your gateway key default_headers=create_headers(user="alice@acme.com"), ) resp = client.chat.completions.create( model="@anthropic/claude-opus-4-8", messages=[{"role": "user", "content": "hi"}], ) print(resp.headers["x-agentics-receipt"]) # the receipt_hash you can verify
import OpenAI from "openai"; import { createHeaders } from "@agentics/sdk"; const client = new OpenAI({ baseURL: "https://agentics.you/api/v1", // the only change apiKey: "ak_…", defaultHeaders: createHeaders({ user: "alice@acme.com" }), }); const resp = await client.chat.completions.create({ model: "@anthropic/claude-opus-4-8", messages: [{ role: "user", content: "hi" }], }); console.log(resp.response?.headers.get("x-agentics-receipt"));
curl https://agentics.you/api/v1/chat/completions \ -H "Authorization: Bearer ak_…" \ -H "Content-Type: application/json" \ -H "x-agentics-user: alice@acme.com" \ -d '{ "model": "@anthropic/claude-opus-4-8", "messages": [{ "role": "user", "content": "hi" }] }' # the response carries: x-agentics-receipt: <receipt_hash>
# already have your own model plumbing? wrap it with track() — same receipt, your call. from agentics import Agentics client = Agentics() with client.track( agent_id="support-bot", foundation_model="@anthropic/claude-opus-4-8", scope=["read:tickets", "write:reply"], ) as task: reply = my_llm_call(...) task.set_outputs(reply).set_outcome("success") # → one billable parent receipt, prev_hash-chained, anchored, verifiable.
Native SDK
Python & TypeScript drop-ins, plus track() for your own plumbing.
base_url swap
Any OpenAI-wire-compatible client. Change one line.
REST
Bearer-auth /v1/* dispatch and the /api/proof/* read surface.
OpenTelemetry
Ship GenAI OTLP/JSON traces to /api/otel/ingest.
MCP server
Point any MCP client at the gateway. Every tool call records its own receipt.
Signed webhooks
HMAC-SHA256-signed deliveries for nine receipt & policy events.
Full reference: Quickstart · Gateway API · Config object · SDKs · MCP & webhooks.
The operator governs every tool call.
Point any MCP-capable client at the gateway. Instead of tool use slipping past your controls, the operator records a child receipt for every call the model makes — chained and anchored like any other move — so an agent's tool use leaves the same forensic trail as its model calls.
MCP tools & manifest →{
"mcpServers": {
"agentics": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://agentics.you/api/mcp/jsonrpc"],
"env": { "AGENTICS_API_KEY": "ak_…" }
}
}
}
Every delivery is signed.
Subscribe to receipt and policy events. Each POST is HMAC-SHA256-signed over the timestamp and body, so you can reject anything you didn't sign — replay-resistant and verifiable on your end.
Events: receipt.recorded, violation.detected, policy.blocked, incident.opened/closed, and four more. Full list in the docs.
# header: X-Agentics-Signature: t=1718722927,v1=<hmac> import hmac, hashlib signed = f"{t}.{raw_body}" expected = hmac.new(secret.encode(), signed.encode(), hashlib.sha256).hexdigest() hmac.compare_digest(expected, v1) # reject if False
Every model, your existing stack.
If it speaks the OpenAI API, it works with Agentics today — SDKs, frameworks, and agents included.
Every major provider
OpenAI, Anthropic, Google Vertex, AWS Bedrock, Azure, Mistral — plus any OpenAI-compatible endpoint, including your own.
Drop-in compatible
Use the OpenAI Python and Node SDKs unchanged. LangChain, LlamaIndex, and most agent frameworks just work.
Built for production
Streaming, retries, caching, and per-key budgets. Adds roughly 18ms of governance overhead per call.
A copy-paste recipe for every framework.
Whatever you already build with, there is a one-screen recipe: install, point it at the gateway with one line, run one call, and read the verifiable x-agentics-receipt. Language SDKs, agent frameworks, and coding agents — each labelled Pattern A (routed through the gateway, governed inline) so you know exactly what it does.
Anthropic · Gemini · Go · Java · .NET · Ruby
Native ingress for the Anthropic (x-api-key: ak_) and Gemini (x-goog-api-key: ak_) SDKs, plus the OpenAI-compatible base-URL swap for everything else.
LangChain · LlamaIndex · LiteLLM · CrewAI · more
One config line points the framework's OpenAI client at https://agentics.you/api/v1 with your AGENTICS_API_KEY. Vercel AI SDK, OpenAI Agents, Haystack, DSPy and AutoGen too.
Claude Code · Codex CLI
Wrap the terminal tool's traffic with agentics capture — no code changes. Every model call is routed and receipted.
Already have an agent in your shell?
Start a local Observe session and keep using Claude Code, Codex, or any SDK from that terminal. Agentics forwards provider traffic and writes a hash-only receipt for covered calls — nothing else changes.
# capture this shell — provider traffic is routed + receipted export AGENTICS_API_KEY="ak_…" curl -fsSL https://agentics.you/install.sh | bash eval "$(agentics capture)" # now run claude, codex, or your SDK from this same terminal agentics log tail --limit 1 # → x-agentics-receipt: <receipt_hash>
Full walkthrough: the 5-minute quickstart.
Ship governed agents into enterprise tenants.
Building agents for other companies? The @agentics/partner SDK is the control surface an agent builder, SI, or ISV uses to operate its own governed agents inside enterprise tenants — authenticated with a partner key (pk_…), a separate principal from any tenant credential.
The flow is register → provision → certify: register for a pk_ key, provision a governed tenant, apply a mandate template, then certify your agent so anyone can verify it before deploying.
// npm install @agentics/partner (Node 18+) import { AgenticsPartner } from "@agentics/partner"; // 1. register → your pk_ key is shown once const reg = await AgenticsPartner.register({ name: "Acme Agents", contact_email: "ops@acme.example", }); const partner = new AgenticsPartner({ apiKey: process.env.AGENTICS_PARTNER_KEY }); // 2. provision a governed tenant const t = await partner.provisionTenant({ display_name: "Globex Corp" }); // 3. certify your agent — anyone can verify it, no key needed await partner.certifyAgent({ agent_id: "acme-support-bot", agent_version: "2.1.0", attestations: { receipts_emitted: true, scopes_declared: true, mandate_bound: true }, });
Verify on a ledger we don't control.
The operator's proof never dead-ends at an Agentics endpoint. The receipt schema is public, the verifier is open, and the final step — reading the Merkle root out of a public transaction memo — runs against a ledger no Agentics service can touch. The chain of custody an auditor replays:
- 1Action
The operator dispatches a model call through the gateway. - 2Policy
It runs guardrails and budgets inline, and receipts the verdict. - 3Hash
The receipt is canonicalized and SHA-256'd into a leaf,prev_hash-chained. - 4Anchor
The batch's Merkle root is written into a public-ledger transaction. - 5Independent confirmation
Anyone reads the memo bytes off the public explorer — no Agentics step.
Questions developers ask first.
No. The gateway is wire-compatible with the OpenAI API. Change one base_url, keep your existing SDK, your models, and your call sites. Already have your own plumbing? Wrap it with track() and get the same receipt without changing the request path.
By default, only fingerprints. Prompt and response bodies are SHA-256'd into inputs_hash / outputs_hash — the content never enters the ledger. In Sovereign mode the operator runs inside your VPC and moves zero data, with provider secrets held off-host in BYO-KMS Key Vault.
Pull the self-contained bundle, recompute the leaf with a SHA-256 library, fold the Merkle proof to the published root, and byte-match that root against the public-ledger transaction memo. Every step runs on your machine; the final step touches no Agentics infrastructure. Run npx @agentics/verify <receipt-hash> or read the six-line recipe in the docs.
Roughly 18ms per call for the inline policy, budget, and guardrail checks. Streaming, retries, and the response cache are all supported, so the cache path is typically faster than calling the provider directly.
Every major provider — OpenAI, Anthropic, Google Vertex, AWS Bedrock, Azure, Mistral — plus any OpenAI-compatible endpoint, including your own. The OpenAI Python and Node SDKs work unchanged, and LangChain, LlamaIndex, and most agent frameworks just work.
Not unless you let it. It defaults to Observe & Suggest — proposals only, with projected impact, waiting for your one-click approval. Assisted and autonomous tiers turn on per tenant as you grant them, and every change is reversible in one click and written to the same verifiable ledger.
You verified its work.
Now let it take the wheel.
Swap one base_url, make a call, and read the receipt the operator wrote off the response header. Verify it on your own machine — and arrive at the demo already convinced.