CLI & API reference

AI Governance SDK

EVE ships a Python client (which governs actions) and a TypeScript offline-verification library (which verifies evidence). Actions are governed through the same composition root, and the evidence produced is verifiable offline in either language. There is no TypeScript enforcement client; enforce from Node via the REST API.

Package facts

Python: eve-coreguard 0.2.7 — from eve_coreguard import CoreGuardClient. Python >= 3.9 (validated on 3.12), zero required dependencies.
TypeScript: eve-ai-governance 0.3.1 — an offline verification library, e.g. import { verifyDecisionCertificate } from "eve-ai-governance". ESM, Node >= 18, zero dependencies, browser-safe verifier (no enforcement client; enforce from Node via the REST API).

The clients are published on public registries: pip install eve-coreguard (PyPI) and npm install eve-ai-governance (npm).

Python quickstart

from eve_coreguard import CoreGuardClient, verify_decision_record

client = CoreGuardClient(api_key="eve_sk_...")  # hosted mode

result = client.evaluate(
    request_id="sess_7",
    tenant_id="org_abc",
    proposed_action={"type": "charge_card", "amount": 999, "currency": "USD"},
    model_output={"decision": "approve"},
    context={"principal_id": "billing_svc", "session_id": "sess_7"},
    policy_set="agent_tools_v1",
    include_evidence=True,
)
print(result.decision.status)  # ALLOWED / BLOCKED / MODIFIED

report = verify_decision_record(result.signed_governance, public_key_pem=pubkey)
assert report.valid is True

TypeScript quickstart

// eve-ai-governance (npm 0.3.1) is an offline verification library; there is no
// TypeScript enforcement client. Enforce from Node via the REST API, then verify offline.
import { verifyDecisionCertificate } from "eve-ai-governance";

const res = await fetch("https://api.eveaicore.com/v1/decisions/evaluate", {
  method: "POST",
  headers: { Authorization: "Bearer eve_sk_...", "Content-Type": "application/json" },
  body: JSON.stringify({
    request_id: "sess_7", tenant_id: "org_abc",
    proposed_action: { type: "charge_card", amount: 999, currency: "USD" },
    model_output: { decision: "approve" },
    context: { principal_id: "billing_svc", session_id: "sess_7" },
    policy_set: "agent_tools_v1",
  }),
});
const { decision } = await res.json();
console.log(decision.status);  // ALLOWED / BLOCKED / MODIFIED

// Reviewers verify the signed decision certificate offline, with the public key:
const report = await verifyDecisionCertificate(decision.certificate);
// report.valid === true, signature 'kms-ecdsa-p384-valid'

Readiness

The Python client (eve-coreguard 0.2.7) and TypeScript client (eve-ai-governance 0.3.1) are release-candidate core clients. The wheel is byte-reproducible and installs cleanly outside the repo (site-packages); the npm tarball installs cleanly (node_modules). Evidence verification (Python and TypeScript) is SUPPORTED, including cross-language kms-ecdsa-p384-valid. The SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS.

Limitations

The pip client governs via hosted mode (requires an endpoint); embedded in-process governance is the EVE service, not the client wheel.
The TypeScript SDK never signs and holds no secrets; embedded mode is Python/service-only in TS and raises SDK_TS_EMBEDDED_UNSUPPORTED.
Framework adapters other than the generic adapter are experimental and not yet validated against pinned live framework versions.
The eve CLI ships with the service/repo, not the pip client.

Next step

Request pilot access to the client artifacts and run the quickstart against a pilot endpoint.