TypeScript

Sentisec speaks the OpenAI and Anthropic wire formats, so the Node integration is a base-URL change on the client you already use. No Sentisec import required.

You need: a Sentisec API key. Mint one in the dashboard, or follow the authentication guide.

Route your client through Sentisec

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.sentisec.ch/ws/<your-workspace-id>/v1",
  apiKey: process.env.SENTISEC_API_KEY!,
});

const resp = await client.chat.completions.create({
  model: "gpt-5.6-terra",
  messages: [{ role: "user", content: "hello" }],
});
console.log(resp.choices[0].message.content);

Note the /v1 on the OpenAI URL and not on the Anthropic one — the Anthropic SDK appends its own. Keep the workspace id in the path; see your base URL.

Every call from client now flows through Sentisec and appears as a session in your dashboard. Your upstream provider key stays in your workspace, so it never has to be present in the Node process.

Streaming

Streaming needs no special handling: set stream: true and read the frames as you already do. Sentisec relays the provider's own SSE format.

const stream = await client.chat.completions.create({
  model: "gpt-5.6-terra",
  stream: true,
  messages: [{ role: "user", content: "stream a paragraph about TLS" }],
});

for await (const chunk of stream) {
  process.stdout.write(chunk.choices[0]?.delta?.content ?? "");
}

Handling a blocked tool call

Sentisec does not raise an HTTP error when it stops a tool call, so nothing in your catch block fires. The request returns 200. By default the call is withheld: it leaves tool_calls, and the message content explains why, streamed or not.

const message = resp.choices[0].message;
if (message.content?.includes("[Sentisec blocked")) {
  // A call was stopped; the text says why. Do not retry it.
}

finish_reason stays tool_calls while an allowed call remains and is stop otherwise. To let the model re-plan instead, a workspace admin can opt in to rename; the call then comes back in tool_calls as sentisec_tool_call_blocked. Full detail in what happens when a tool call is blocked.

Install the CLI

@sentisec/sdk on npm also ships the sentisec command, which pairs this machine with your workspace and drives subscription mode.

npm install -g @sentisec/sdk
sentisec --version

A postinstall step fetches the native CLI for your platform. Full walkthrough in the CLI quickstart; if sentisec is not on your PATH afterwards, see first-run problems.

To add the package to a project instead:

npm install @sentisec/sdk
# or
pnpm add @sentisec/sdk

Node 20 or newer, ESM and CJS dual export.

Verify it worked

Open the dashboard at your workspace → Sessions. The session row is there; the Live view shows sessions as they arrive. A plain completion makes no tool call, so it lands as a completed session with nothing to adjudicate — point a tool-using agent at the same URL and every action it takes is scored.

Next