@machine-trust/sdk

The deterministic security orchestrator for the AI economy.

Zero-dependency TypeScript SDK for interacting with the Machine Trust Infrastructure. Protect your AI agents and host machines from supply-chain attacks.

Installation

npm install @machine-trust/sdk

Quick Start

import { TrustClient } from '@machine-trust/sdk';

const client = new TrustClient({
  apiKey: 'your-api-key', // or process.env.MACHINE_TRUST_API_KEY
});

// Check a package (automatically polls if scanning is in progress)
const verdict = await client.packages.check('npm', 'axios', {
  version: '1.7.2'
});

if (verdict.trust_state === 'blocked') {
  console.error(`❌ Blocked: ${verdict.reasons.join(', ')}`);
} else {
  console.log(`✅ ${verdict.trust_state}: Proceed with confidence.`);
}

Features

• Recursive Discovery: Checks the entire dependency tree, not just the root.
• Hash-Lock Security: Anti-repo-jacking verification using package integrity hashes.
• Honest Status Loop: Built-in polling for scanning and queued states.
• AI-Agent Ready: Designed for integration with LangChain, AutoGPT, and MCP.

API Reference

client.packages.check(ecosystem, name, options)

Returns a TrustVerdict.

Parameters:

• ecosystem: 'npm' | 'pypi'
• name: Package name
• options:
  • version: string (default: 'latest')
  • hash: string (optional, for SHA verification)
  • wait: boolean (default: true, polls until final verdict)

License

MIT