What each transport covers

Sentisec speaks several API shapes, and they do not all carry the same protection. This page is the map. Read it before you pick an integration: choosing the wrong transport is the difference between a policy that runs and a policy that watches.

Per-transport capability

Four capabilities, defined:

• Content inspection — Sentisec reads the material your agent pulled in (tool results, retrieved documents, fetched pages) and scores it.
• Tool-call gating — Sentisec can stop a tool call before your code runs it, based on where the call's arguments came from.
• Lineage tracking — Sentisec connects a tool call back to the retrieved content it was derived from, which is what makes indirect injection catchable rather than merely suspicious.
• Egress control — Sentisec checks outbound destinations against the allowlist on your workspace.

Live means the check runs synchronously, in the request path, and can change the response your agent receives. On every API-shape lane above, an agent that retrieves a document carrying a planted instruction and then tries to act on it is stopped before the tool executes, and the reasoning chain that led there is recorded against your workspace.

Streaming is the same route with "stream": true, not a separate endpoint, except on Bedrock Converse, where the SDK calls its own converse-stream route for you. Streaming carries the same coverage: on every API-shape lane above, the streaming and non-streaming rows are identical, and a blocked call is withheld and explained the same way on both. See what happens when a tool call is blocked.

Subscription mode routes an agent that has no API key at all — you keep your existing Claude or ChatGPT plan and Sentisec gates the tool calls. See subscription mode for how it wires up.

The n8n node is in private preview. It is published and installable, but the endpoint it calls is not open, so it does not carry coverage today. If n8n matters to your deployment, talk to us.

Embeddings are a deliberate exception: embedding requests are relayed and recorded but not gated, because embedding a document is not an action an agent takes on your systems. Gating happens on the tool calls an agent makes after retrieval.

What is not in this table

Some of what the integrity engine measures runs after the fact rather than in the request path, because the signal needs the model's completed output and the gate fires before the model is called. Those results reach your dashboard and your evidence exports; they do not block a call in flight. They are kept out of the table above so that Live means exactly one thing: it can stop the call.

Use the workspace-scoped base URL

Every recipe on this site points at the workspace-scoped form:

https://api.sentisec.ch/ws/<your-workspace-id>/v1     # OpenAI-shaped
https://api.sentisec.ch/ws/<your-workspace-id>        # Anthropic-shaped

Your workspace id is on the dashboard next to your API key.

This is not a stylistic preference. The workspace-scoped form is the one shape that guarantees your workspace's own policy travels with the request on every transport. Unscoped base URLs authenticate and return answers, but which policy they resolve depends on the API shape you are speaking — so a configuration that looks connected can be enforcing nothing of yours. Scope the URL and the question does not arise.

Frameworks

Two tiers, and the difference is explicit.

Maintained recipes

Each of these has a recipe page on this site covering setup, a tool-calling loop, and what your code sees when a call is blocked.

The supported versions and the setting itself are in what happens when a tool call is blocked.

Agent frameworks move fast, and a wire-level behaviour is only true for the version you are on. Where a version genuinely changes what you type — as with LangChain 1.x moving AgentExecutor out of the core package — the recipe page says so at the point it matters.

OpenAI-compatible, no recipe yet

These build on a standard OpenAI-compatible client, so pointing that client's base URL at your workspace-scoped endpoint works the same way it does above. They do not have a maintained recipe on this site, and architectural similarity to a covered framework is not the same as a recipe.

The Vercel AI SDK on Amazon Bedrock is not an OpenAI-compatible client. Its Bedrock provider speaks Bedrock's Converse API. Point it at your workspace with the two settings in Bedrock → Native Converse.

Running one of these in production and want a maintained recipe? Tell us — that is how the list gets ordered.

Provider availability

Which upstream model providers carry traffic — a separate question from which API shape you speak to Sentisec.

Each provider connects with a credential you add to your workspace. See Providers for the per-provider setup.

See also

• Integrations — the section index and the blocked-call shapes
• Responses and Embeddings — how the Responses API differs from Chat Completions
• Drop-in replacement
• Providers