TypeScript SDK

The TypeScript SDK (@triage-integrity/integrity-sdk) is an HTTP client for Node 18+ using the built-in fetch. It ships both ESM and CommonJS builds and is fully typed. Server-side only. Never expose a tsk_ key in a browser.

Install#

npm install @triage-integrity/integrity-sdk

init()#

import triage from '@triage-integrity/integrity-sdk';

triage.init({
  apiKey: 'tsk_...',
  baseUrl: undefined,   // defaults to https://integrity.triage-sec.com
  timeout: 30_000,      // per-request milliseconds
  maxRetries: 2,
});

Checks#

• triage.input.check(text, options?) → InputCheckResult (label, confidence, isSafe, raw)
• triage.cot.check(options) → CotCheckResult (score, threshold, rising, verdict, reason_codes, isDivergent, raw)
• triage.toolCall.check(options) → ToolCallCheckResult (composite_score, isSafe, isFlagged, …)
• triage.output.check(options) → OutputCheckResult (label, severity_score, isSafe, isRefusal, …)

All methods are async and return Promises. Metadata (modelProvider, modelName, sessionId) is passed via the options object. INT-CoT is experimental. A standalone call returns a score and advisory verdict, not an independent block; the gateway may separately use material, rising CoT risk in conjunction with a flagged tool or output result. See INT-CoT.

const tool = await triage.toolCall.check({
  userRequest: 'summarize my inbox',
  toolName: 'send_email',
  toolArguments: {
    to: 'security@example.com',
    subject: 'Inbox summary',
    repo: 'triage-sec/triage',
  },
  sessionId: 'sess_abc123',
});

if (tool.composite_score >= 0.8) throw new Error('blocked unsafe tool call');
if (tool.isFlagged) console.warn('tool call flagged for review');

Call-site scoping#

The SDK is call-site scoped. It only sends traffic where you call it, so you can instrument one route, agent, tool runner, workflow, or package without ingesting traces from the whole repository. For per-subsystem reporting, encode scope in sessionId.

const sessionId = `repo:payments-service:agent:security-review:run:${runId}`;

const input = await triage.input.check(userText, { sessionId });
if (!input.isSafe) block();

const tool = await triage.toolCall.check({
  userRequest: userText,
  toolName: 'github_create_issue',
  toolArguments: { repo: 'org/payments-service', title: issueTitle },
  sessionId,
});
if (tool.composite_score >= 0.8) block();
else if (tool.isFlagged) console.warn('tool call flagged for review');

For a larger app, wrap the specific OpenAI or agent client you care about, for example securityReviewAgent, and leave other model calls untouched. The gateway works the same way: route selected client instances through the proxy instead of the whole app unless you want global coverage.

Errors#

Service, transport, response, and configuration errors raised by the SDK extend TriageError. Invalid arguments passed to a check throw the built-in TypeError before a request is sent.

import triage, { TriageError } from '@triage-integrity/integrity-sdk';

let allowed = false;
try {
  const verdict = await triage.input.check(userText);
  allowed = verdict.isSafe;
} catch (error) {
  if (error instanceof TriageError) allowed = false; // fail closed
  else throw error;
}

Retries & modules#

Transient failures are retried with jittered exponential backoff (honoring Retry-After); other 4xx errors are not retried. The package exposes a proper exports map, so both import and require resolve to the correct build with full type declarations.