@taplid/client

Official Node.js SDK for the hosted Taplid audit API.

Send a payload and get a trust decision (ALLOW / REVIEW / BLOCK), a 0-100 trust score and an audit trail.

• Docs: https://taplid.com/setup
• Playground: https://taplid.com/playground/audit

Install

npm install @taplid/client

SDK Example

import { Taplid } from '@taplid/client';

const taplid = new Taplid();

const result = await taplid.audit({
  context: `Support access policy:
1. Support agents cannot view an existing password.
2. Users must use the password reset flow to regain access.`,
  prompt: 'Can support tell me my current password?',
  response: 'You can update your billing address in Settings > Billing.'
});

console.log(result);

HTTP API Example

You can call the API directly without the SDK using fetch or any HTTP client.

const payload = {
  context: `Support access policy:
1. Support agents cannot view an existing password.
2. Users must use the password reset flow to regain access.`,
  prompt: 'Can support tell me my current password?',
  response: 'You can update your billing address in Settings > Billing.'
};

const response = await fetch('https://taplid.com/api/review', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(payload),
});

const result = await response.json();
console.log(result);

Request Payload

| Field | Type | Description | |-------|------|-------------| | context | string | Policy, rules, or background context for the audit. | | prompt | string | The user prompt that produced the response. | | response | string | The AI-generated output to audit. | | audit_mode | string | Optional audit mode. Omit for default answer audit, or set to "artifact" for technical artifacts. | | deepAudit | boolean | Optional. Set to true to find issues the standard audit may miss. |

Only response is required; context, prompt, and audit_mode are optional. For file-based input, use @taplid/cli. The hosted SDK/API path accepts inline text only.

File format handling (CLI resolution)

Taplid treats context, prompt, and response file inputs as raw UTF-8 text. Supported examples include .txt, .md, .json, .log, .ndjson, .yaml, and .yml. These files are not parsed by type. Taplid reads the file contents as plain text and uses the resolved text value. This behavior is consistent across the playground, CLI file-location flags, environment file-location variables, and request-payload file-location fields.

@taplid/client does not resolve files directly. When using the SDK, pass resolved inline text values for context, prompt, and response.

Response Shape

{
  "decision": "BLOCK",
  "trustScore": 30,
  "summary": "High-risk reliability issues found. Do not use as-is.",
  "issues": [
    {
      "message": "Does not fully answer the request.",
      "reason": "Important parts of the request are missing."
    },
    {
      "message": "Includes unsupported or unverifiable claims.",
      "snippet": "You can update your billing address in Settings > Billing.",
      "reason": "Key claim is not backed by a source."
    }
  ],
  "nextStep": "Do not use this output yet. Rewrite it with better support and review it again.",
  "details": {
    "reviewThreshold": 60,
    "passThreshold": 80
  }
}

Response Fields

• decision — ALLOW, REVIEW, or BLOCK
• trustScore — 0 to 100 public trust signal
• summary — short explanation for the verdict
• issues — concrete problems found in the response
• nextStep — practical guidance for what to do next
• details.reviewThreshold / details.passThreshold — decision thresholds

Related

• Taplid Playground — run audits in the browser
• Taplid CLI — run audits locally or in CI with npx @taplid/cli audit request.json
• Full docs

ESM only — @taplid/client is ESM-only. If your project is CommonJS you may see ERR_PACKAGE_PATH_NOT_EXPORTED. Use ESM config: package.json => "type": "module", and tsconfig.json => "module": "NodeNext" with "moduleResolution": "NodeNext". If you need to stay on CommonJS, use the HTTP API example above instead of the SDK import.