Use the hosted service

Govern tool calls by pointing the EVE client SDK at a hosted EVE endpoint. This is the default path for the pip and npm clients: they call a hosted service that runs the deterministic decision, and every decision fails closed on error.

Prerequisites

• A reachable hosted EVE endpoint and an API credential for it (from your pilot; do not paste production credentials into examples).
• The EVE client SDK (Python or TypeScript).

Installation

pip install eve-coreguard        # Python client
npm install eve-ai-governance                 # TypeScript client (ESM, Node >=18)

Runnable code

Python:

from eve_coreguard import CoreGuardClient

client = CoreGuardClient(api_key="eve_sk_...", base_url="https://eve.internal.example/v1")
result = client.evaluate(
    request_id="req-001",
    tenant_id="acme",
    proposed_action={"type": "loan_approval", "amount": 1000},
    model_output={"decision": "approve", "confidence": 0.9},
    context={"credit_score": 760, "debt_to_income": 0.15},
    policy_set="lending_v1",
)
# The hosted client returns an EvaluationResult; read decision + risk fields.
print(result.decision.status, result.risk.level)

TypeScript:

// There is no TypeScript enforcement client; enforce from Node via the REST API.
const res = await fetch("https://eve.internal.example/v1/decisions/evaluate", {
  method: "POST",
  headers: { Authorization: "Bearer eve_sk_...", "Content-Type": "application/json" },
  body: JSON.stringify({
    request_id: "req-001", tenant_id: "acme",
    proposed_action: { type: "loan_approval", amount: 1000 },
    model_output: { decision: "approve", confidence: 0.9 },
    context: { credit_score: 760, debt_to_income: 0.15 },
    policy_set: "lending_v1",
  }),
});
const { decision, risk } = await res.json();
if (decision.status === "BLOCKED") console.log(`Blocked (risk ${risk.level})`);

Provide the API credential through the client's configured auth mechanism, not by hard-coding it in source.

Expected result

• Governed calls return ALLOW / BLOCK / MODIFY from the hosted service.
• Identity (tenant, principal, session) is propagated to the service; in the MCP path, server-derived identity is authoritative.
• A malformed service response results in a BLOCK, not a silent allow.

Evidence output

{ decision: { status: "ALLOWED|BLOCKED|MODIFIED", action: <...>, reason_codes: [...] }, decision_id: "...", certificate: {...} }

The certificate is signed (ECDSA P-384 (AWS KMS) in production configuration, HMAC-SHA256 fallback).

Verification

Verify a hosted decision's evidence offline, without trusting the hosted server (see verify-evidence-offline.md):

import { verifyDecisionCertificate } from "eve-ai-governance";
const result = await verifyDecisionCertificate(decision.certificate); // offline; public keys only, no network
console.log(result.valid ? "VERIFIED" : "FAILED");

Failure example

If the hosted endpoint is unreachable or returns a malformed response, the client fails closed — Python raises, TypeScript returns a BLOCK. No client silently falls back to permissive behavior.

Production considerations

• Hosted mode requires a reachable endpoint; design for network failure as a deny condition.
• Keep API credentials out of source and logs; the client redacts secrets in structured output.
• eve-ai-governance is a verification-only library — it never signs and holds no secrets; there is no TypeScript enforcement client (enforce from Node via the REST API).

Limitations

• deploy.modes is PILOT_READY. Hosted mode requires a reachable endpoint. The pip client governs via hosted mode; the npm eve-ai-governance package is verification-only (enforce from Node via the REST API); embedded in-process evaluation is the EVE service, not the client wheel.
• CoreGuard deterministic evaluation is PILOT_READY; the decision covers the governance verdict only. Independent verification of evidence needs the ECDSA P-384 public key.

Next step

For enforcement that a direct call cannot bypass, use deploy-as-a-sidecar.md; for air-gapped use, see sovereign-offline-mode.md.