@intelstrike/sdk

Official TypeScript SDK and CLI for IntelStrike — AI security scanning for LLMs, RAG pipelines, and agentic systems.

What it does

IntelStrike automatically probes your AI endpoints for the OWASP LLM Top 10 attack categories — prompt injection, sensitive data disclosure, excessive agency, model theft, and more — and returns structured findings with OWASP classification, remediation guidance, and token exposure estimates.

Installation

npm install @intelstrike/sdk
# or
pnpm add @intelstrike/sdk

CLI only (no install)

npx @intelstrike/sdk scan --endpoint https://your-api.com/chat

Authentication

Generate an API key at https://app.intelstrike.io/dashboard/api-keys and export it:

export INTELSTRIKE_API_KEY="isk_live_..."

SDK — Quick Start

import { Scanner } from "@intelstrike/sdk";

const scanner = new Scanner(); // reads INTELSTRIKE_API_KEY from env

const result = await scanner.scan({
  endpoint: "https://your-api.com/v1/chat",
  profile: "owasp-llm-top10",
});

console.log(`Found ${result.findings.length} issues.`);
console.log(`Critical: ${result.summary.critical}, High: ${result.summary.high}`);

// Gate a CI/CD pipeline:
if (scanner.hasBlockingFindings(result, ["critical", "high"])) {
  console.error("Security gate failed.");
  process.exit(1);
}

RAG pipeline scan

const result = await scanner.scanRag({
  endpoint: "https://your-api.com/v1/rag-chat",
  profile: "rag-full",
  testCrossDocumentPoisoning: true,
});

Agentic AI scan

const result = await scanner.scanAgent({
  endpoint: "https://your-api.com/v1/agent",
  profile: "agent-strict",
  tools: [
    { name: "send_email", description: "Sends an email on behalf of the user" },
    { name: "read_calendar", description: "Reads the user's calendar events" },
  ],
  testExcessiveAgency: true,
});

CLI Reference

intelstrike scan --endpoint <url> [options]
intelstrike profiles

| Option | Default | Description | |---|---|---| | --endpoint | — | (required) Target LLM endpoint URL | | --api-key | env | IntelStrike API key (or INTELSTRIKE_API_KEY) | | --profile | owasp-llm-top10 | Scan profile | | --fail-on | critical,high | Severities that cause exit code 1 | | --output | pretty | pretty or json | | --base-url | production | Override API base URL |

Examples

# Full OWASP LLM Top 10 scan
intelstrike scan --endpoint https://api.example.com/chat

# CI/CD gate — fail only on critical findings
intelstrike scan \
  --endpoint $LLM_ENDPOINT \
  --profile owasp-llm-top10 \
  --fail-on critical

# RAG pipeline scan with JSON output (pipe to jq)
intelstrike scan \
  --endpoint $RAG_ENDPOINT \
  --profile rag-full \
  --output json | jq '.findings[] | select(.severity == "critical")'

# Quick scan for fast CI pipelines
intelstrike scan --endpoint $LLM_ENDPOINT --profile quick

Scan Profiles

| Profile | Use Case | ~Tokens | |---|---|---| | owasp-llm-top10 | Full coverage — all 10 OWASP LLM categories | 200K–500K | | rag-full | RAG pipelines — injection, poisoning, data exposure | 150K–350K | | agent-strict | Agentic AI — excessive agency, tool abuse | 100K–250K | | quick | Fast CI gate — prompt injection + data disclosure only | 20K–50K |

Run intelstrike profiles to list all profiles with descriptions.

CI/CD Integration

GitHub Actions

- name: AI Security Scan
  env:
    INTELSTRIKE_API_KEY: ${{ secrets.INTELSTRIKE_API_KEY }}
  run: |
    npx @intelstrike/sdk scan \
      --endpoint ${{ vars.LLM_ENDPOINT }} \
      --profile owasp-llm-top10 \
      --fail-on critical,high

GitLab CI

ai-security-scan:
  image: node:20
  script:
    - npx @intelstrike/sdk scan
        --endpoint $LLM_ENDPOINT
        --profile owasp-llm-top10
        --fail-on critical,high
  variables:
    INTELSTRIKE_API_KEY: $INTELSTRIKE_API_KEY

Exit Codes

| Code | Meaning | |---|---| | 0 | Scan passed — no blocking findings | | 1 | Blocking findings detected at --fail-on severity level | | 2 | Scan execution failed (network error, timeout, etc.) | | 3 | Authentication error (invalid or missing API key) | | 4 | Invalid CLI arguments |

API Reference

new Scanner(options?)

| Option | Type | Description | |---|---|---| | apiKey | string | Override API key (default: INTELSTRIKE_API_KEY env var) | | baseUrl | string | Override API base URL |

scanner.scan(options): Promise<ScanResult>

scanner.scanRag(options): Promise<ScanResult>

scanner.scanAgent(options): Promise<ScanResult>

scanner.hasBlockingFindings(result, failOn?): boolean

scanner.getResult(scanId): Promise<ScanResult>

TypeScript Types

All types are exported from the package root:

import type {
  ScanResult,
  Finding,
  Severity,
  ScanProfile,
  AttackCategory,
} from "@intelstrike/sdk";

License

MIT — see LICENSE.