EVE SDK

One obvious entry point per language to govern tool calls, produce signed evidence, and verify it offline.

Who this is for

Engineers integrating EVE governance into an application or agent. You want a small, dependency-light client with a single primary entry point, a clear deployment model, and fail-closed behavior — plus an offline verifier that holds no secrets.

The problem

Governance clients often bury the real entry point, silently fall back to permissive behavior when the service is down, or bundle signing code into places it should never live. You want a client that imports cleanly outside your repository, governs through a defined mode, fails closed on error, and — on the verify side — never signs and never holds secrets.

Supported capabilities

• Python client. The primary Python entry point is from eve_coreguard import CoreGuardClient; installed with pip install eve-coreguard from PyPI. Version 0.2.7; a release-candidate core client (sdks/coreguard/eve_coreguard/).
• TypeScript offline verifier. eve-ai-governance is a browser-safe offline verification library — verifier functions such as verifyDecisionCertificate, verifyDecisionRecord, verifyChain, verifyBundle, and verifyHmac; installed with npm install eve-ai-governance from npm. It has no client class and performs no enforcement — enforce from Node via the REST API. Version 0.3.1; ESM, Node ≥18.
• Deployment modes, fail-closed. EVE supports embedded (in-service), hosted, sidecar, MCP-gateway, and sovereign/offline modes. In every mode, a service error fails closed — no SDK silently falls back to permissive behavior.
• Framework adapters. EVE ships framework adapters that route tool calls through the same governance composition root. The generic adapter is validated; others are experimental.

Readiness: the Python client, the TypeScript verifier, and deployment modes are PILOT_READY (release-candidate core packages). Framework adapters other than generic are EXPERIMENTAL.

How it works

• Python governs via hosted, sidecar, or embedded(service) modes. The pip client reaches CoreGuard over hosted mode (needs an endpoint); embedded in-process governance is the EVE service, not the client wheel.
• TypeScript is verification-only: eve-ai-governance is a browser-safe offline verifier that never signs and holds no secrets. It does not enforce — there is no TypeScript governance client; enforce from Node via the REST API (POST /v1/decisions/evaluate) or the Python eve-coreguard client.
• On service error in any mode, the SDK fails closed — it raises or returns BLOCK, never a silent ALLOW.

Technical example (Python)

The clients are published on public registries: pip install eve-coreguard (PyPI) and npm install eve-ai-governance (npm). Install the provided eve-coreguard 0.2.7 wheel, then:

from eve_coreguard import CoreGuardClient

# hosted mode (default base_url is https://api.eveaicore.com)
client = CoreGuardClient(api_key="eve_sk_...")

result = client.evaluate(
    request_id="req-001",
    tenant_id="org_abc",
    proposed_action={"type": "send_email", "to": "[email protected]"},
    model_output={"decision": "send", "confidence": 0.9},
    context={"principal_id": "u_1", "session_id": "s_1"},
    policy_set="pii_handling",
)
print(result.decision.status)  # ALLOWED | BLOCKED | MODIFIED

Technical example (TypeScript / Node)

There is no TypeScript enforcement client — enforce from Node via the REST API:

// enforce from Node via the REST API
const res = await fetch("https://api.eveaicore.com/v1/decisions/evaluate", {
  method: "POST",
  headers: { Authorization: "Bearer eve_sk_...", "Content-Type": "application/json" },
  body: JSON.stringify({
    request_id: "req-001", tenant_id: "org_abc",
    proposed_action: { type: "send_email", to: "[email protected]" },
    model_output: { decision: "send", confidence: 0.9 },
    context: { principal_id: "u_1", session_id: "s_1" },
    policy_set: "pii_handling",
  }),
});
const { decision, risk } = await res.json();
console.log(decision.status); // ALLOWED | BLOCKED | MODIFIED

Signed evidence example

A governed decision returns an evidence envelope:

{ "content_hash": "…", "canon": "jcs-1", "signature": "kms-ecdsa-p384-…", "decision": { "action": "BLOCK", "decision_id": "…" } }

Verifier example

from core.eve_sdk import verify_evidence
report = verify_evidence("decision", envelope)  # {"valid": True, "reason": "certificate verified", "checks": {...}}

import { verifyDecisionCertificate } from "eve-ai-governance";
const report = await verifyDecisionCertificate(cert, { publicKeyPem }); // report.valid === true (offline; public keys only)

Deployment options

Embedded (in-service), hosted, sidecar, MCP-gateway, and sovereign/offline. Hosted and sidecar modes require a reachable endpoint. Production configuration refuses to disable signed evidence, strict verification, distributed consumption, fail-closed behavior, authenticated identity, or complete scanning.

Readiness

The Python client (eve-coreguard 0.2.7) and TypeScript client (eve-ai-governance 0.3.1) are release-candidate core clients, PILOT_READY. Deployment modes are PILOT_READY and fail closed. Signed evidence and offline verification are SUPPORTED. Framework adapters other than the generic adapter are EXPERIMENTAL. The EVE SDK core overall is a RELEASE CANDIDATE WITH EXCLUSIONS.

Limitations

• The pip eve-coreguard client governs via hosted mode (requires an endpoint); embedded in-process governance is the EVE service, not the client wheel.
• The TypeScript SDK is ESM, Node ≥18. Embedded mode is unsupported in TypeScript (throws SDK_TS_EMBEDDED_UNSUPPORTED). The TS SDK never signs and holds no secrets.
• Only the generic framework adapter is validated. Others (OpenAI Agents, Claude Agent SDK, LangChain, LangGraph, CrewAI, Vercel AI SDK) are experimental and untested against pinned live versions; wrapper-enforced adapters are bypassable by a direct underlying-tool call; Claude Code hooks are cooperative and are not an unbypassable boundary. Hard enforcement requires a gateway or sidecar.
• The clients are published on public registries: pip install eve-coreguard (PyPI) and npm install eve-ai-governance (npm).

Next step

Request pilot access to the eve-coreguard wheel and the eve-ai-governance tarball, and integrate against a hosted endpoint in your environment.